Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 11327 Source: MsiInstaller

Product: <product name> -- Error 1327. Invalid Drive: <drive letter>:\
In my case, the %commonprogramfiles% path in the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ was pointing to "<network drive>:\ProgramFiles\Common" which is not a valid path. What I did was:
1. Change the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir key to point to "C:\Program Files\Common Files"
2. Reboot the server
3. Restart the software installation.
There are several Microsoft articles with information about this issue. See ME217666, ME262318, ME290356, ME292802 and ME327763.
This may occur when installing new software - the installation will abort saying "Invalid Drive Letter <letter>:". The solution is to change some registry values. Verify that the values under:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders use valid drive letters. If there are invalid drive letters, change them to point to valid drives.
I was getting an event id error of 11327 from the msiInstaller that was stating there was an invalid H:\ drive while I was trying to uninstall a program. After looking on the Internet I found out that this could come up as any drive letter and in my case it happened to be the H:\ drive. To fix this I had to check registry entries in 5 places to make sure they were not pointing to this drive for install files. The registry keys were:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Make sure none of the values in these 5 keys are pointed to the drive of the error message. I had two of them that I had to change. Once I made the change I no longer got this error message.
This error ocurred when I tried to run the Office installer over remote desktop on a terminal server after running "change user /install". Installing while logged into the console worked fine.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.