Link to home
Start Free TrialLog in
Avatar of lrkwalkers
lrkwalkers

asked on

msiexec.exe running as SYSTEM in 2003 terminal server

Hi

At what appears to be at random times, our 2003 terminal servers (with Citrix PS 4.5) show one or multiple instances of msiexec.exe running under SYSTEM.  Sometimes the process can take up to 50% of the CPU.  What could be causing this?  I've checked the app event log and found a lot of these:

Event Type:      Information
Event Source:      MsiInstaller
Event Category:      None
Event ID:      11728
Date:            26/02/2009
Time:            2:37:23 PM
User:            domain\administrator
Computer:      ComputerName
Description:
Product: ING's Illustrator -- Configuration completed successfully.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 44 39 42 32 39 35 31   {D9B2951
0008: 41 2d 44 33 42 41 2d 34   A-D3BA-4
0010: 44 43 36 2d 38 39 35 38   DC6-8958
0018: 2d 39 31 37 43 33 30 39   -917C309
0020: 41 30 37 41 42 7d         A07AB}  



Could this be causing the issue?  Anything else to check?
Avatar of Abhay Pujari
Abhay Pujari
Flag of India image

Thsi could be the problem. Have you checked anything which is scheduled to run, say windows updates or any software updates?
ASKER CERTIFIED SOLUTION
Avatar of lrkwalkers
lrkwalkers

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of lrkwalkers
lrkwalkers

ASKER

Oh, ignore the actual event in the initial post.  It was an actual install.  These were the events we were getting:

Event Type:      Information
Event Source:      MsiInstaller
Event Category:      None
Event ID:      11728
Date:            3/03/2009
Time:            7:24:20 AM
User:            NT AUTHORITY\SYSTEM
Computer:      FSTS01
Description:
Product: 32 Bit HP CIO Components Installer -- Configuration completed successfully.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 7b 46 37 42 30 45 35 39   {F7B0E59
0008: 39 2d 43 31 31 34 2d 34   9-C114-4
0010: 34 39 33 2d 42 43 34 44   493-BC4D
0018: 2d 44 38 46 43 37 43 42   -D8FC7CB
0020: 42 41 42 42 42 7d         BABBB}  



Notice the HP CIO?   It's related to the cioum32.msi in the fix.

Cheers