On Windows Server 2008 and Windows Server 2008 R2 querying installed software with WMI and the Win32_Product class events are written to the Application event log.
The events are purely informational but one event is generated for each piece of software identified. What bothers me is the description contains "Windows Installer reconfigured the product. Product Name: ..."
Why would a query trigger a notification that the product has be reconfigured? We have scripts that run against servers looking for changes and this is creating a little bit of an issue. :(
Has anyone else seen this?