Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Windows Server 2008 and Windows Server 2008 R2 querying installed software with WMI and the Win32_Product class events are written to the Application event log.

The events are purely informational but one event is generated for each piece of software identified. What bothers me is the description contains "Windows Installer reconfigured the product. Product Name: ..."

Why would a query trigger a notification that the product has be reconfigured? We have scripts that run against servers looking for changes and this is creating a little bit of an issue. :(

Has anyone else seen this?

share|improve this question
up vote 3 down vote accepted


I would strongly recommend NOT using Win32_Product if you can avoid it. First, it is really, really slow. Second, and more significant is that you can screw up your system:

The Win32_Product class works by enumerating every MSI package that is installed on the system. When a package is touched, it performs a reconfiguration where the application is validated (and repaired if found to be inconsistent with the original MSI).

This can be a huge problem if you have applications that were configured after install (i.e. previously disabled services can be re-enabled, etc.)

As an alternative, you can do a search on a particular file and check its version to see if an application is installed. Here is a link to a blog post I did describing the technique (and also has a link to an article by Darren Mar-Elia discussing Win32_Product):

share|improve this answer
Thanks for the link. I agree Win32_Product basically sucks but it's one of things that can also be very useful. We don't use it in GPOs so speed has never really been a problem. The reconfiguration issue is a completely different story -- it's never burned me but I would really have liked to that it was happening. – Greg Wojan Dec 2 '10 at 21:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.