Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1004 Source: MsiInstaller

Detection of product '<GUID>', feature '<feature name>', component '<component GUID>' failed.
In my case, it was a incomplete installation of Symantec Endpoint Protection. Looking through the Application log in the Event viewer, I saw the event 1004 was looking for the file C:\Program Files\Common Files\Symantec Shared\sevinst.exe. I simply remotely managed another XP machine that was successfully running Symantec Endpoint Protection and copied it from the same directory on the remote computer to the directory, to the directory that the event viewer specified. Now all works!
- GUID: 91CA0409-6000-11D3-8CFE-0150048383C9 - There was a service/process runing under another username then the logged in user. that user never logged on to that machine. After logging in under that user and starting word and then Outlook and then log of the service/procees did not generate the error anymore under the default user name.
I Had this problem on a Windows XP Sp3 workstation when updating certain Office 2003 updates. The error was accompanied with errors 0x80072AF9 (WSAHOST_NOT_FOUND) and 0x8024402c (WINHTTP_NAME_NOT_RESOLVED) in the windowsupdate.log file , logged by the WSUS Client DnldMgr component. The re-install of the SoftwareDistribution folder was the remedy for this problem:

net stop bits
net stop wuauserv
rmdir /s "%windir%\SoftwareDistribution"
mkdir %windir%\SoftwareDistribution"
cacls "%windir%\SoftwareDistribution" /G Everyone:F
gpupdate /target:computer
net start bits
net start wuauserv
wuauclt /detectnow
See ME912159 and ME915431 for hotfixes applicable to Microsoft Office SharePoint Portal Server 2003.

See the link to "Windows Installer: Dealing with installation failures" for information on solving this kind of problems.

This event might occur when you remove the last existing instance of SQL Server 2000 on a computer. The removal process removes registry entries that are shared by instances of SQL Server Desktop Engine and instances of SQL Server Desktop Engine (Windows). See ME823519 for details.

This event may occur when you use a limited user account to start one of the Microsoft Office programs. See ME911682 to solve this problem.
- GUID: {00010409-78E1-11D2-B60F-006097C998E7}, feature "OfficeUserData" - See EventID 11706 from source MsiInstaller, with error message: "No valid source could be found for product Microsoft Office 2000".

If this issue occurs when you try to install Windows SharePoint Services, see ME833183 for information on how to fix this problem.

See ME314852 to find out how to enable Windows Installer logging in Windows XP.
ME290301 provides a description of the Windows Installer CleanUp utility. Additional information on this event can be found in the Frequently Asked Questions about Windows Installer.

From a newsgroup post: "These events make sense if they refer to registry keys associated with HKCU and if you installed the application under one user and then use the product as another user. In this case, the key will be missing and Windows Installer will install that key automatically. This is sometimes normal as long as it only happens once per new user. Make sure that when you installed it originally it was a per-machine install and not per-user.
I am not sure what happens after that except that maybe the product itself cannot see that registry key and starts shutting down. It might also be the case that the product is not designed to be used by multiple users on the same system, and that the user is required to be the same as the installing account".

See "Citrix Support Document ID: CTX106101", "Citrix Support Document ID: CTX108764" and "BlackBerry Support Article Number: KB-04393" for additional information on this event.
As Denis Scherbakov, I too was having a problem with SUS after a Server 2003 SP1 update. I set permissions for the NETWORK SERVICE to READ & WRITE on the folders thru \Inetpub\wwwroot\autoupdate\administration\shared, because the error stated that the service could not access the "corporate.asp” file in the shared folder. I granted the service the same rights on the SUS folder too.
I was getting this error when I was using SUS web-administration service. The problem was solved by granting the NETWORK SERVICE permissions to read and execute on problem files.
I had a similar error. I got the error on a Windows XP SP2 machine after installing Citrix MetaFrame Client 8.0. The machine has Microsoft Office 2003. After the installation of Citrix MetaFrame Client 8.0, every time I rebooted and then logged onto the machine, the installer would look for files in the Office XP location. It would go away after canceling the MsiInstaller dialog box 3 times. The main thing was that nothing was broken in MS Office, it was working fine. I could work with all the applications fine. The error message contained the following message: “The resource C:\Program Files\Common Files\ODBC\Data Sources does not exist”. My resolution, somewhat strange, but I created this directory on the machine. After I created the directory, the error went away.
I had this error on client computers; for unknown reason the excel files could not be open. The Installer for Microsoft Office was requesting updates and due to insufficient rights of the client, the installer could not finish the process. After login with Domain Admin rights, the issue was resolved.
Feature: ExcelUserData - A suggestion posted on newsgroups: "
1. Go to HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\components\.. registry key.
2. Run RegMon from
3. Pause it from watching the registry
4. Start Excel and get to the point when the error would happen
5. Start RegMon
6. Create the error
7. Go to RegMon and pause it
8. Search in RegMon for the above registry key, it will go further down the tree and you will see the binary code in the results part of regmon, showing 'ExcelUserData'
9. Save the whole of the key to a .reg file using RegEdit and then delete the single entry within that key.

If this error message appears while you are installing Commerce Server 2002 on a computer on which BizTalk Server is installed, Microsoft says that these error messages in the event log are safe to ignore.

See the "Windows Installer FAQ" link for some general information about MsiInstaller.

From a newsgroup post: "I managed to come up with a "work around" for this problem on my Windows 2000 machine. Windows Installer runs as a service on it so I disabled the service".

For errors related to Office, see ME298385.
For Citrix Metaframe XP 1.0 there is a known issue when the Citrix folder in “..\Documents and Settings\All Users\Start Menu\Programs” is removed immediately following installation of, or upgrade to MetaFrame XP 1.0 Feature Release 3. See Citrix Knowledge Base CTX103585 to fix this problem.
GUID: {00100409-78E1-11D2-B60F-006097C998E7}, feature 'ProductNonBootFiles'. - The resource 'HKEY_CURRENT_USER\Software\Microsoft\OfficeCustomizeWizard\1.0\RegKeyPaths\{00000409-78E1-11D2-B60F-006097C998E7}\OCWAddedContentWritten' does not exist.
The solution is to recreate the registry keys as follows:
Copy the following lines (the code between the ***** lines but not the lines!) paste them in a notepad file and call it ocw.reg
Windows Registry Editor Version 5.00

Export this key in the registry for every user using usrlogon.cmd
GUID: {00010413-78E1-11D2-B60F-006097C998E7}, feature: OUTLOOKNonBootFiles" - If someone click on Outlook Today the Windows Installer popsup. And this error is logged in the eventlog. The problem is that there is an Registry entry missing :
UserData RegDword = 1

Feature "OfficeUserData" - This warning came up when I tried to use word2000 before putting in my name and initials and accepting the EULA.
I've finally found a fix after a year of messing around on various servers/sites! Here it is:
Using usrlogon.cmd, write the following to each users registry on login with the following line:
REGEDIT /S ?:\????\OfficeUD.REG

Write the following to OfficeUD.REG (the code between the ***** lines but not the lines!)
Windows Registry Editor Version 5.00





[HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\MS Project]




[HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Shortcut Bar]

From a newsgroup post (according to a Microsoft Online Partner Support suggestion): " The following steps are to fix this error:
a.) go to the actual terminal server console
b.) go to start\run command line and key in the following: regedt32
c.) check the permissions to the following registry keys:

System and Admins - Full Control
Everyone- Read

System and Admins - Full Control
Everyone- Read

System and Admins - Full Control
Everyone- Read

System and Admins - Full Control
Everyone- Read

System and Admins - Full Control
Everyone- Read

System and Admins - Full Control
Everyone- Read

System and Admins - Full Control
Everyone- Read

d.) If you had to change any of the above registry key permissions, empty the application event log file and then launch an Office application and see if you still get 1004 and "Failed to Connect" messages in there.

If you are still getting 1004 messages, you need to do the following:
a.) Go to Windows Explorer and locate C:\Documents and Settings\<user's profile>\Local Settings\Application Data\Microsoft\Windows for each user. Delete the UsrClass.dat and
b.) Then logged on as that user that you just removed those files and see if you still get 1004 messages in the application event log file.
c.) If you have these files then you also want to delete them out of the Default User's profile as well."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.