Windows Event ID 1034 – MsiInstaller: Windows Installer Reconfiguration Event

Start by examining the specific details of the Event ID 1034 occurrence to understand what product was reconfigured.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 1034 in the Event IDs field and click OK
5. Double-click on the most recent Event ID 1034 entry
6. Review the General tab for product information and user context
7. Check the Details tab for the complete XML data including product codes
8. Note the timestamp to correlate with any recent software changes or maintenance windows

The event description will show the product name and whether the operation was a repair, feature modification, or other reconfiguration type.

Use PowerShell to retrieve detailed information about MSI reconfiguration events and analyze patterns.

1. Open PowerShell as Administrator
2. Run the following command to get recent Event ID 1034 entries:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1034; StartTime=(Get-Date).AddDays(-7)} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. For more detailed analysis, extract specific properties:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1034} -MaxEvents 10 | ForEach-Object {
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        User = $_.UserId
        Message = $_.Message
        ProductInfo = ($_.Message -split '\n')[0]
    }
} | Format-Table -AutoSize

4. To export the results for further analysis:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1034; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\MSI_Reconfig_Events.csv" -NoTypeInformation

This method provides programmatic access to event data and enables bulk analysis of reconfiguration patterns.

Cross-reference Event ID 1034 with detailed MSI logs to understand the complete reconfiguration process.

1. Enable MSI logging by modifying the registry. Open Registry Editor as Administrator
2. Navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
3. Create a new DWORD value named Logging with value voicewarmupx (if not already present)
4. Check the Windows Installer log location, typically:

Get-ChildItem -Path "$env:TEMP" -Filter "MSI*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

5. Locate logs corresponding to the timestamp of Event ID 1034
6. Open the relevant MSI log file and search for reconfiguration details
7. Look for entries containing "Reconfiguring" or "MaintenanceMode"
8. Cross-reference the product code from the event with the log entries
9. Use PowerShell to search log files for specific patterns:

$LogFiles = Get-ChildItem -Path "$env:TEMP" -Filter "MSI*.log"
foreach ($Log in $LogFiles) {
    $Content = Get-Content $Log.FullName | Select-String "Reconfiguring|MaintenanceMode"
    if ($Content) {
        Write-Host "Found reconfiguration entries in: $($Log.Name)"
        $Content | Select-Object -First 3
    }
}

This correlation helps identify the root cause of the reconfiguration and any issues that occurred during the process.

Verify the current installation state of products that generated Event ID 1034 to ensure successful reconfiguration.

1. Use PowerShell to query installed MSI products and their states:

Get-WmiObject -Class Win32_Product | Where-Object {$_.InstallState -eq 5} | Select-Object Name, Version, InstallDate, InstallState | Sort-Object InstallDate -Descending

2. For more detailed product information, query the registry:

$UninstallKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
Get-ItemProperty $UninstallKeys | Where-Object {$_.DisplayName -and $_.UninstallString -like "*msiexec*"} | Select-Object DisplayName, DisplayVersion, InstallDate | Sort-Object InstallDate -Descending

3. Check for any products in a broken or incomplete state:

Get-WmiObject -Class Win32_Product | Where-Object {$_.InstallState -ne 5} | Select-Object Name, InstallState, @{Name="StateDescription";Expression={
    switch($_.InstallState) {
        1 {"Advertised"}
        2 {"Absent"}
        3 {"Default"}
        4 {"Source"}
        5 {"Local"}
        default {"Unknown"}
    }
}}

4. Validate specific product features if the reconfiguration involved feature changes:

# Replace {PRODUCT-GUID} with actual product code from Event 1034
$ProductCode = "{PRODUCT-GUID}"
try {
    $Product = Get-WmiObject -Class Win32_Product -Filter "IdentifyingNumber='$ProductCode'"
    if ($Product) {
        Write-Host "Product: $($Product.Name) - State: $($Product.InstallState)"
    }
} catch {
    Write-Host "Product not found or query failed"
}

This analysis confirms whether the reconfiguration completed successfully and identifies any remaining issues.

Set up proactive monitoring for Event ID 1034 to track software maintenance patterns and identify potential issues.

1. Create a PowerShell script for continuous monitoring:

# MSI Reconfiguration Monitor Script
$ScriptPath = "C:\Scripts\MSI-Monitor.ps1"
$LogPath = "C:\Logs\MSI-Reconfig.log"

# Create monitoring script
@'
$LastCheck = (Get-Date).AddMinutes(-5)
$Events = Get-WinEvent -FilterHashtable @{LogName="Application"; Id=1034; StartTime=$LastCheck} -ErrorAction SilentlyContinue

foreach ($Event in $Events) {
    $LogEntry = "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - MSI Reconfiguration: $($Event.Message.Split("`n")[0])"
    Add-Content -Path "C:\Logs\MSI-Reconfig.log" -Value $LogEntry
    
    # Optional: Send alert for specific products
    if ($Event.Message -like "*Critical Application*") {
        # Add alerting logic here
        Write-EventLog -LogName Application -Source "MSI Monitor" -EventId 9999 -EntryType Warning -Message "Critical application reconfigured: $($Event.Message)"
    }
}
'@ | Out-File -FilePath $ScriptPath -Encoding UTF8

2. Create a scheduled task to run the monitoring script:

$TaskName = "MSI Reconfiguration Monitor"
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-ExecutionPolicy Bypass -File C:\Scripts\MSI-Monitor.ps1"
$Trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable

Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Settings $Settings -User "SYSTEM" -RunLevel Highest

3. Set up Event Viewer custom views for easier monitoring:

# Create custom view XML (save as MSI-Reconfig-View.xml)
<?xml version="1.0" encoding="UTF-8"?>
<ViewerConfig>
  <QueryConfig>
    <QueryParams>
      <Simple>
        <Channel>Application</Channel>
        <EventId>1034</EventId>
        <RelativeTimeInfo>604800000</RelativeTimeInfo>
      </Simple>
    </QueryParams>
  </QueryConfig>
</ViewerConfig>

4. Import the custom view in Event Viewer by right-clicking Custom Views and selecting Import Custom View
5. Configure Windows Event Forwarding (WEF) for centralized monitoring in enterprise environments:

# On collector server, configure subscription
wecutil cs MSI-Reconfig-Subscription.xml

# Subscription XML content:
# <Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
#   <SubscriptionId>MSI-Reconfig</SubscriptionId>
#   <Query><![CDATA[<QueryList><Query Id="0"><Select Path="Application">*[System[EventID=1034]]</Select></Query></QueryList>]]></Query>
# </Subscription>

This comprehensive monitoring approach enables proactive management of MSI-based applications and early detection of reconfiguration issues.