Windows Event ID 1035 – MsiInstaller: Windows Installer Service Reconfiguration

Start by examining the complete event details to understand what product was reconfigured and why.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter for Event ID 1035 by right-clicking Application → Filter Current Log
4. Enter 1035 in the Event IDs field and click OK
5. Double-click the event to view detailed information including product name, version, and user context
6. Note the exact timestamp and correlate with any user reports or system changes

Use PowerShell to extract multiple events for analysis:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1035; StartTime=(Get-Date).AddDays(-7)} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Enable verbose MSI logging to capture detailed information about reconfiguration operations.

1. Open Registry Editor as administrator
2. Navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
3. Create a new DWORD value named Logging with value voicewarmupx (if not exists)
4. Create a string value LoggingPolicy with value voicewarmupx
5. Restart the Windows Installer service:

Restart-Service -Name msiserver -Force

Check the MSI log directory for recent reconfiguration logs:

Get-ChildItem -Path "$env:TEMP" -Filter "MSI*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

Examine the logs for error patterns or repeated repair attempts that might indicate underlying issues.

Use WMI to query installed products and their current state to identify potential issues.

# Get all installed MSI products
Get-WmiObject -Class Win32_Product | Where-Object {$_.InstallDate -gt (Get-Date).AddDays(-30).ToString('yyyyMMdd')} | Select-Object Name, Version, InstallDate, InstallState

For more detailed product information:

# Query specific product details
$ProductCode = "{PRODUCT-GUID-HERE}"
Get-WmiObject -Query "SELECT * FROM Win32_Product WHERE IdentifyingNumber='$ProductCode'" | Format-List *

Check for products in inconsistent states:

# Find products that may need repair
Get-WmiObject -Class Win32_Product | Where-Object {$_.InstallState -ne 5} | Select-Object Name, InstallState, @{Name='StateDescription';Expression={switch($_.InstallState){1{'Advertised'};2{'Absent'};3{'Default'};4{'Source'};5{'Local'};default{'Unknown'}}}}

Cross-reference these results with Event ID 1035 occurrences to identify problematic applications.

Use Process Monitor to track file system activity during MSI reconfiguration events.

1. Download and run Process Monitor (ProcMon) from Microsoft Sysinternals
2. Set filters to monitor msiexec.exe processes
3. Configure additional filters for the application directory experiencing reconfiguration
4. Trigger a manual repair of the affected application:

# Example: Repair Microsoft Office
msiexec /f {PRODUCT-CODE} /qb

Analyze the ProcMon logs for:

• Files being accessed, modified, or recreated
• Registry keys being updated
• Services being stopped/started
• Temporary files created during the process

Export ProcMon results and correlate timestamps with Event ID 1035 entries to understand the complete reconfiguration workflow.

Set up automated monitoring for MSI events across your environment using PowerShell and scheduled tasks.

Create a monitoring script:

# MSI Event Monitor Script
$LogName = 'Application'
$EventID = 1035
$Hours = 24

$Events = Get-WinEvent -FilterHashtable @{
    LogName = $LogName
    Id = $EventID
    StartTime = (Get-Date).AddHours(-$Hours)
} -ErrorAction SilentlyContinue

if ($Events) {
    $Report = $Events | ForEach-Object {
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            Computer = $env:COMPUTERNAME
            User = $_.UserId
            Message = $_.Message.Split('`n')[0]
        }
    }
    
    # Export to CSV for analysis
    $Report | Export-Csv -Path "C:\Logs\MSI_Reconfig_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation -Append
    
    # Send email alert if threshold exceeded
    if ($Events.Count -gt 5) {
        # Add email notification logic here
        Write-Warning "High number of MSI reconfigurations detected: $($Events.Count)"
    }
}

Schedule this script to run hourly using Task Scheduler or deploy via Group Policy for enterprise-wide monitoring.