• Reliability report : Windows installer has reconfigured all installed software

    Home » Forums » AskWoody support » Windows » Windows 10 » Windows 10 version 22H2 » Reliability report : Windows installer has reconfigured all installed software

    Author
    Topic
    #2748673

    Windows Installer reconfigured the product. Product Name: Windows PC Health Check. Product Version: 3.7.2204.15001. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.

    I haven’t installed any Windows updates this morning.

    I have installed Feb. updates on Thursday Feb 13.

    Reliability

    Viewing 5 reply threads
    Author
    Replies
    • #2748696

      Windows Installer reconfigured the product. Product Name: Windows PC Health Check. Product Version: 3.7.2204.15001. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0. I haven’t installed any Windows updates this morning. I have installed Feb. updates on Thursday Feb 13.

      So what’s your question or problem, Alex? What you posted appears to be simply an explanation of what happened, complete with a screenshot.

      Are you wanting to know why all the listed software was reconfigured?

      If you’re just providing the information in order to help others, please bear in mind that just because something like the application reconfiguration happened on your machine doesn’t automatically mean that it’s going to happen on many others’ machines.

      • #2748760

        Are you wanting to know why all the listed software was reconfigured?

        Yes.

        Moderator’s Note: Reply relocated to improve thread’s readability.

        1 user thanked author for this post.
    • #2748711

      If you’re just providing the information in order to help others, please bear in mind that just because something like the application reconfiguration happened on your machine doesn’t automatically mean that it’s going to happen on many others’ machines.

      Correct!

      I installed the Feb updates on my Windows 22H2 PC yesterday and it did not reconfigure anything.

      NothingReconfigured

    • #2748717

      Windows Installer reconfigured the product. Product Name: Windows PC Health Check. Product Version: 3.7.2204.15001. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.

      I haven’t installed any Windows updates this morning.

      I have installed Feb. updates on Thursday Feb 13.

      Reliability

      So your Thursday Windows Update re-enabled the Microsoft Store, which checked/updated the apps listed? That’s an expected outcome as a result of having used a 3rd party tool to block WU/MS Store (and forgetting to re-engage the block), right?

      • #2748761

        having used a 3rd party tool to block WU/MS Store (and forgetting to re-engage the block), right?

        Wrong.
        No 3rd party tool to block WU. Microsoft store updates are disabled and remain so.

        The software on the list are not Microsoft store apps.

        Moderator’s Note: Reply relocated to improve thread’s readability.

    • #2748727

      I haven’t installed any Windows updates this morning. I have installed Feb. updates on Thursday Feb 13.

      It looks like it’s not just Windows Updates that can trigger resiliency checks… which show as Windows Installer reconfigured the product, even though nothing has been reconfigured.

      From what I found, it looks like any MSI-based app can trigger the checks if it carries out a WMI query on the Win32_Product class.

      (Even though it refers to Windows Server, see the Microsoft Learn article Event log message indicates that the Windows Installer reconfigured all installed applications for more info.)

      Have you installed any new MSI-based app or app updates just prior to the first recorded event?

      If you run a PowerShell query on all MSI installer events for the last couple of days then it might show a trigger that begins the resilience checks.

      For example, the following script will (should) show all MSI installer events for the last 3 days:

      # Define time range (last 3 days)
      $startTime = (Get-Date).AddDays(-3)
      
      # Define event log and source
      $logName = “Application”
      $providerName = “MsiInstaller”
      
      # Try to retrieve the events
      try {
      $events = Get-WinEvent -FilterHashtable @{
      LogName = $logName
      ProviderName = $providerName
      StartTime = $startTime
      } -ErrorAction SilentlyContinue |
      Select-Object TimeCreated, LogName, Id, Level, ProviderName, Message |
      Sort-Object TimeCreated
      } catch {
      Write-Host “Error retrieving event logs: $_” -ForegroundColor Red
      exit
      }
      
      # Check if any events were found
      if ($events.Count -eq 0) {
      Write-Host “No MsiInstaller events found in the last 3 days.” -ForegroundColor Yellow
      exit
      }
      
      # Prompt user for output choice
      $choice = Read-Host “Choose output format: [1] Screen, [2] Grid, [3] Text File, [4] CSV File”
      
      # Define file paths
      $desktopPath = [System.Environment]::GetFolderPath(“Desktop”)
      $txtFile = “$desktopPath\MsiInstallerEvents.txt”
      $csvFile = “$desktopPath\MsiInstallerEvents.csv”
      
      # Handle output choice
      switch ($choice) {
      “1” { # Display on screen
      $events | Format-Table -AutoSize
      }
      “2” { # Show in grid view
      $events | Out-GridView -Title “MsiInstaller Event Log Report”
      }
      “3” { # Save as TXT
      $events | Format-Table -AutoSize | Out-File -FilePath $txtFile
      Write-Host “Report saved as TXT file: $txtFile” -ForegroundColor Green
      }
      “4” { # Save as CSV
      $events | Export-Csv -Path $csvFile -NoTypeInformation
      Write-Host “Report saved as CSV file: $csvFile” -ForegroundColor Green
      }
      default {
      Write-Host “Invalid choice! Please run the script again and choose a valid option.” -ForegroundColor Red
      }
      }

      Note: I’ve attached the script as a zip file at the end of this post.

      Have a look at this post if you haven’t used Windows PowerShell ISE (run as administrator) before. I find it’s usually easier to use than the plain PowerShell console.

      Hope this helps…

      Click the link below to download the script as a zipped file.

      Get-MsiInstaller_events

      (Remember to right-click on the downloaded zip file and unblock it.)

      3 users thanked author for this post.
      • #2748766

        Have you installed any new MSI-based app or app updates just prior to the first recorded event?

        None.

        Will check the script.

        Moderator’s Note: Reply relocated to improve thread’s readability.

      • #2748774

        Hope this helps…

        Nothing new . Here is the report :

        TimeCreated LogName Id Level ProviderName Message
        ———– ——- — —– ———— ——-
        13-Feb-25 12:27:33 PM Application 1040 4 MsiInstaller Beginning a Windows Installer transaction: C:\ProgramData\Kaspersky Lab…
        13-Feb-25 12:28:15 PM Application 11707 4 MsiInstaller Application: Kaspersky — Installation completed successfully.<<31707>>
        13-Feb-25 12:28:15 PM Application 1033 4 MsiInstaller Windows Installer installed the product. Product Name: Kaspersky. Produ…
        13-Feb-25 12:28:15 PM Application 1042 4 MsiInstaller Ending a Windows Installer transaction: C:\ProgramData\Kaspersky Lab\AV…
        13-Feb-25 12:28:32 PM Application 1040 4 MsiInstaller Beginning a Windows Installer transaction: {9A1A3E64-2461-35F4-A2A9-8DA…
        13-Feb-25 12:29:20 PM Application 11724 4 MsiInstaller Application: Kaspersky — Removal completed successfully.<<31724>>
        13-Feb-25 12:29:20 PM Application 1034 4 MsiInstaller Windows Installer removed the product. Product Name: Kaspersky. Product…
        13-Feb-25 12:29:20 PM Application 1038 4 MsiInstaller Windows Installer requires a system restart. Product Name: Kaspersky. P…
        13-Feb-25 12:29:20 PM Application 1029 4 MsiInstaller Product: Kaspersky. Restart required. The installation or update for th…
        13-Feb-25 12:29:20 PM Application 1042 4 MsiInstaller Ending a Windows Installer transaction: {9A1A3E64-2461-35F4-A2A9-8DA0EA…
        15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: MyHarmony. Pr…
        15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Common Deskto…
        15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Windows PC He…
        15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Court Digital…
        15-Feb-25 8:26:48 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Acronis Drive…
        15-Feb-25 8:26:49 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: 0patch Agent….
        15-Feb-25 8:26:49 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Win…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: PowerShell 7-…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Upd…
        15-Feb-25 8:26:50 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:51 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Apple Softwar…
        15-Feb-25 8:26:52 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Edg…
        15-Feb-25 8:26:52 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Intel(R) Comp…
        15-Feb-25 8:26:52 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Intel(R) Chip…
        15-Feb-25 8:26:52 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:53 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Apple Mobile …
        15-Feb-25 8:26:53 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:53 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:53 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:26:53 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:26:53 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:26:57 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Acronis True …
        15-Feb-25 8:26:57 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:57 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Bonjour. Prod…
        15-Feb-25 8:26:58 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Apple Applica…
        15-Feb-25 8:26:58 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft ASP…
        15-Feb-25 8:26:58 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: 4K Video Down…
        15-Feb-25 8:26:58 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:59 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:59 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Win…
        15-Feb-25 8:26:59 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:26:59 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Win…
        15-Feb-25 8:26:59 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:26:59 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:00 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: iTunes. Produ…
        15-Feb-25 8:27:00 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:27:01 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Kaspersky. Pr…
        15-Feb-25 8:27:01 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:01 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Apple Applica…
        15-Feb-25 8:27:01 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Windows Share…
        15-Feb-25 8:27:01 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Win…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Win…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:27:02 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:03 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Win…
        15-Feb-25 8:27:03 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Intel Driver …
        15-Feb-25 8:27:03 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft .NE…
        15-Feb-25 8:27:03 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: iCloud Outloo…
        15-Feb-25 8:27:03 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Microsoft Vis…
        15-Feb-25 8:27:03 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: TeraCopy. Pro…

        Moderator’s Note: Reply relocated to improve thread’s readability.

        • #2748789

          That looks like a Kaspersky update triggered a reboot which also re-enabled WU/MS Store to scan and update.

          • #2748792

            That looks like a Kaspersky update triggered a reboot which also re-enabled WU/MS Store to scan and update.

            I am in doubt

            I ran Microsoft Feb updates on Feb 13. Before any update I disable Kaspersky a/v and enable at restart.

            The Application Reconfiguration happened on Feb 15.

            Moderator’s Note: Reply relocated to improve thread’s readability.

            • #2748799

              I took that from your log:

              13-Feb-25 12:29:20 PM Application 11724 4 MsiInstaller Application: Kaspersky — Removal completed successfully.<<31724>>
              13-Feb-25 12:29:20 PM Application 1034 4 MsiInstaller Windows Installer removed the product. Product Name: Kaspersky. Product…
              13-Feb-25 12:29:20 PM Application 1038 4 MsiInstaller Windows Installer requires a system restart. Product Name: Kaspersky. P…
              13-Feb-25 12:29:20 PM Application 1029 4 MsiInstaller Product: Kaspersky. Restart required. The installation or update for th…
              13-Feb-25 12:29:20 PM Application 1042 4 MsiInstaller Ending a Windows Installer transaction: {9A1A3E64-2461-35F4-A2A9-8DA0EA…
              15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: MyHarmony. Pr…
              15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Common Deskto…
              15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: Windows PC He…

              Did you switch to a different machine after the last log on the 13th and then return to the above on the morning of the 15th? That’s what the log you created suggests.

              I’m not making this up, look for yourself…

    • #2748732

      Hi Alex572:

      Do you have a Dell computer with Dell SupportAssist OS Recovery (a.k.a. Dell SupportAssist Remediation or System Repair) installed?

      If so you’ll see dozens, if not hundreds, of “Successful Application Reconfiguration” events logged in your Windows Reliability Monitor each time Dell SupportAssist OS Recovery collects information about your installed software and creates a new snapshot of your system approx. 30 min after Windows boot-up  – see the second image in my 24-Nov-2024 post in newmarket2’s Program Data is huge; something’s wrong in the Dell forum. This “bug” was identified almost 4 years ago and is caused by sloppy program (see my 04-May-2024 post in DELLKaren’s “Successful Application Reconfiguration” and SupportAssist) but Dell seems in no rush to fix it.

      This rapid logging of “Successful Application Reconfiguration” events never caused a serious issue on my Inspiron 5584 before I uninstalled all my SupportAssist-related software but a few users reported in DELLKaren’s topic that each time Dell SupportAssist Remediation created a new snapshot the high CPU usage caused their system to become unstable.
      ———–
      Dell Inspiron 15 5584 * 64-bit Win 10 Pro v22H2 build 19045.5487 * Firefox v135.0.0 * Microsoft Defender v4.18.24090.11-1.1.24090.11 * Malwarebytes Premium v5.2.6.163-1.0.5146 * Macrium Reflect Free v8.0.7783 * Dell Update for Windows Universal v5.4.0 * My Dell v2.2.6.0 * Fusion Service 2.2.14.0

      1 user thanked author for this post.
      • #2748767

        Do you have a Dell computer with Dell SupportAssist OS Recovery (a.k.a. Dell SupportAssist Remediation or System Repair) installed?

        No. I use Lenovo laptop

        Moderator’s Note: Reply relocated to improve thread’s readability.

    • #2748800

      13-Feb-25 12:29:20 PM Application 1029 4 MsiInstaller Product: Kaspersky. Restart required. The installation or update for th…
      13-Feb-25 12:29:20 PM Application 1042 4 MsiInstaller Ending a Windows Installer transaction: {9A1A3E64-2461-35F4-A2A9-8DA0EA…
      15-Feb-25 8:26:47 AM Application 1035 4 MsiInstaller Windows Installer reconfigured the product. Product Name: MyHarmony. Pr…

      Was there nothing more useful in those 3 events? Sorry but… those were just a list sorted by timestamp. IMO the real meat and potatoes is usually in the Message element of events.

      Now you have a specific time range to delve deeper into, i.e. to check what may have happened between 13-Feb-25 12:29:20 PM (when Kaspersky logged Restart required.) and 15-Feb-25 8:26:47 AM (when Logitech’s MyHarmony logged Windows Installer reconfigured the product.)

      I suggest a further PowerShell script to check all event logs during that period, not just the Application log for MsiInstaller-related events. Try the following script, using the same ISE method as earlier:

      # Function to validate and convert user input to DateTime
      function Get-ValidatedDateTime {
      param (
      [string]$prompt
      )
      do {
      $inputDate = Read-Host $prompt
      try {
      $dateTime = [DateTime]::ParseExact($inputDate, “dd-MMM-yy h:mm:ss tt”, $null)
      return $dateTime
      } catch {
      Write-Host “Invalid format! Please use ‘dd-MMM-yy h:mm:ss tt’ (e.g., 13-Feb-25 12:29:20 PM).” -ForegroundColor Red
      }
      } while ($true)
      }
      
      # Get custom date/time range from user
      $startTime = Get-ValidatedDateTime -prompt “Enter start date/time (e.g., 13-Feb-25 12:29:20 PM)”
      $endTime = Get-ValidatedDateTime -prompt “Enter end date/time (e.g., 15-Feb-25 8:26:47 AM)”
      
      # Get all available log names
      $logNames = Get-WinEvent -ListLog * | Select-Object -ExpandProperty LogName
      
      # Define event level filters (1-4: Critical, Error, Warning, Information)
      $eventLevels = @(1,2,3,4)
      
      # Initialize empty event collection
      $events = @()
      
      # Retrieve events for each log
      foreach ($log in $logNames) {
      try {
      $logEvents = Get-WinEvent -FilterHashtable @{
      LogName = $log
      StartTime = $startTime
      EndTime = $endTime
      Level = $eventLevels
      } -ErrorAction SilentlyContinue
      
      if ($logEvents) {
      $events += $logEvents | Select-Object TimeCreated, LogName, Id, Level, ProviderName, Message
      }
      } catch {
      Write-Host “Skipping log $log due to an error.” -ForegroundColor Yellow
      }
      }
      
      # Sort events by TimeCreated
      $events = $events | Sort-Object TimeCreated
      
      # Check if any events were found
      if ($events.Count -eq 0) {
      Write-Host “No events found between $startTime and $endTime with levels 1-4 (Critical, Error, Warning, Information).” -ForegroundColor Yellow
      exit
      }
      
      # Prompt user for output choice
      $choice = Read-Host “Choose output format: [1] Screen, [2] Grid, [3] Text File, [4] CSV File”
      
      # Define file paths
      $desktopPath = [System.Environment]::GetFolderPath(“Desktop”)
      $txtFile = “$desktopPath\FilteredEventLogs.txt”
      $csvFile = “$desktopPath\FilteredEventLogs.csv”
      $selcsvFile = “$desktopPath\SelectedEventLogs.csv” # Added selected events CSV file
      
      # Handle output choice
      switch ($choice) {
      “1” { # Display on screen
      $events | Format-Table -AutoSize
      }
      “2” { # Show in grid view and allow selection for CSV export
      $selectedEvents = $events | Out-GridView -Title “Filtered Event Log Report – Select Entries to Export” -PassThru
      if ($selectedEvents) {
      $selectedEvents | Export-Csv -Path $selcsvFile -NoTypeInformation
      Write-Host “Selected events saved as CSV file: $selcsvFile” -ForegroundColor Green
      } else {
      Write-Host “No entries were selected for export.” -ForegroundColor Yellow
      }
      }
      “3” { # Save as TXT
      $events | Format-Table -AutoSize | Out-File -FilePath $txtFile
      Write-Host “Report saved as TXT file: $txtFile” -ForegroundColor Green
      }
      “4” { # Save as CSV
      $events | Export-Csv -Path $csvFile -NoTypeInformation
      Write-Host “Report saved as CSV file: $csvFile” -ForegroundColor Green
      }
      default {
      Write-Host “Invalid choice! Please run the script again and choose a valid option.” -ForegroundColor Red
      }
      }

      Notes:

      1. Although in theory the query is only reading data, I’ve just read in a blog in the last couple of days that – in practice – Get-WinEvent requires elevation. I don’t know how true that is but, to be on the safe side, always run Get-WinEvent queries elevated irrespective of whether you’re using PowerShell console, ISE, etc.

      2. Rather than include a specific begin/end date/time range, it’s more flexible to allow user input of these… but using the above to make it easier. For example, the screenshot below shows I’ve selected the first suggested date/time.

      powershell_ise_select_datetime

      I then used CTRL+C to copy the suggestion and CTRL+V to paste it at the prompt, thus saving me having to type it (and perhaps fat-finger it).

      If you know the start and end date/time range then you can change lines 18/19 prior to running the script.

      3. Once you’ve input (or copy/pasted) the second date/time and pressed RETURN/ENTER… be patient. Windows reads/writes almost continuously to both the registry and event logs so gathering event log data from all event logs is going to be slow.

      You can speed the data collection by amending the $eventLevels filter variable in line 25. The biggest data speed bump is the Information level… so you can, if desired, delete the 4 and its preceding comma in that line. However, whilst speeding up data collection, you will lose the sense of the flow of events. Your choice. 🙂

      4. IMO GridView (option 2) is usually the most aesthetically pleasing and informative ‘cos you can click on the column headers to carry out additional sorting… on Levels, for example.

      However, it has another big advantage… selected output. In the screenshot below you can see I’ve selected 4 different Group Policy entries (using CTRL+mouse click).

      Selected_entries_in_Out-GridView

      When I click on the grid’s OK button, those 4 entries (and only those 4) are saved to my desktop as a .CSV file… and the ISE’s output pane updated.

      powershell_ise_results_updated

      The previous script can be used to discover a date/time range for further examination. This script can be used as a template for more detailed data diving.

      Click the link below to download the script as a zipped file.

      Get-DateTime_filtered_events

      (Remember to right-click on the downloaded zip file and unblock it.)

      Hope this helps…

      2 users thanked author for this post.
      • #2748847

        On Feb 14 I had Kaspersky block Uninstlr_portable.exe due to Trojan (false positive).

        Apart from that nothing else.

        I am marking the post as resolved (until next time)

    Viewing 5 reply threads
    • The topic ‘Reliability report : Windows installer has reconfigured all installed software’ is closed to new replies.