Windows Event ID 1022 – MsiInstaller: Windows Installer Reconfiguration Event

Start by examining the complete event details to understand what triggered the reconfiguration:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter events by clicking Filter Current Log in the Actions pane
4. Enter 1022 in the Event IDs field and click OK
5. Double-click the Event ID 1022 entry to view detailed information
6. Review the event data fields including Product Name, Product Code, and User SID
7. Note the timestamp to correlate with other system activities
8. Check the General tab for the complete event description and any error codes

The event details will show the specific product being reconfigured and the user context. Cross-reference this information with recent system changes or user activities.

Use PowerShell to extract and analyze Event ID 1022 occurrences across multiple systems:

# Get recent Event ID 1022 entries with detailed information
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1022; StartTime=(Get-Date).AddDays(-7)} | 
    Select-Object TimeCreated, Id, LevelDisplayName, Message | 
    Format-Table -Wrap

# Extract specific product information from event messages
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1022; StartTime=(Get-Date).AddDays(-30)} | 
    ForEach-Object {
        $message = $_.Message
        $productMatch = [regex]::Match($message, "Product: (.+?)\. ")
        $userMatch = [regex]::Match($message, "User: (.+?)\. ")
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            Product = if($productMatch.Success) { $productMatch.Groups[1].Value } else { "Unknown" }
            User = if($userMatch.Success) { $userMatch.Groups[1].Value } else { "Unknown" }
            FullMessage = $_.Message
        }
    } | Format-Table -AutoSize

This PowerShell approach provides a comprehensive view of reconfiguration activities and helps identify patterns or problematic installations.

Configure comprehensive MSI logging to capture detailed information about reconfiguration operations:

1. Open Registry Editor as Administrator
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
3. Create a new DWORD value named Logging if it doesn't exist
4. Set the value to voicewarmupx (as REG_SZ) to enable comprehensive logging
5. Create another DWORD named Debug and set it to 7
6. Restart the Windows Installer service:

# Restart Windows Installer service to apply logging changes
Restart-Service -Name "msiserver" -Force

# Verify service status
Get-Service -Name "msiserver" | Select-Object Name, Status, StartType

MSI logs will now be created in %TEMP% directory with detailed information about each reconfiguration operation. Review these logs to identify specific components being modified and any errors encountered during the process.

Determine the installation source and context to understand why reconfiguration was triggered:

# Query installed products and their installation sources
Get-WmiObject -Class Win32_Product | 
    Where-Object { $_.Name -like "*ProductName*" } | 
    Select-Object Name, Version, InstallDate, InstallSource, LocalPackage

# Check for recent Windows Updates that might trigger reconfigurations
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-7) } | 
    Sort-Object InstalledOn -Descending

# Examine Group Policy settings that might affect MSI behavior
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer" -ErrorAction SilentlyContinue

1. Check the Windows Installer cache location at C:\Windows\Installer
2. Verify that cached MSI packages are present and not corrupted
3. Review Group Policy settings under Computer Configuration → Administrative Templates → Windows Components → Windows Installer
4. Examine the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer registry key for product information
5. Check for scheduled tasks that might trigger automatic software maintenance

Understanding the installation context helps determine whether the reconfiguration is expected behavior or indicates a potential issue requiring intervention.

Implement monitoring and prevention strategies for problematic reconfiguration events:

# Create a scheduled task to monitor Event ID 1022 and send alerts
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-Command \"Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1022; StartTime=(Get-Date).AddMinutes(-5)} | Out-File C:\Logs\MSI_Reconfig.log -Append\""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365)
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "MSI_Reconfiguration_Monitor" -Action $action -Trigger $trigger -Settings $settings -User "SYSTEM"

# Disable automatic repair for specific products if needed
# Note: This requires careful consideration as it may affect application functionality
$productCode = "{PRODUCT-GUID-HERE}"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\$productCode\InstallProperties" -Name "NoRepair" -Value 1

1. Configure Windows Event Forwarding to centralize Event ID 1022 collection
2. Set up SCOM or other monitoring tools to alert on excessive reconfiguration events
3. Review and adjust Group Policy settings to control MSI behavior:
• Turn off Windows Installer RDS Compatibility
• Prohibit rollback
• Disable Windows Installer (for specific scenarios)
4. Implement application virtualization to reduce MSI-related issues
5. Create baseline documentation of expected reconfiguration patterns