| Event Id | 1025 |
| Source | MsiInstaller |
| Description | Microsoft ISA Server 2004. The file D:\Program Files\Microsoft ISA Server\msfpc.dll is being held in use by the following process Name: msiexec , Id 1856. |
| Event Information | This information from some newsgroups may help you: ------------------------------------------------------------------------------ Those are information messages and are logged anytime MSI detects a file in use. The eventlog message was added per request by the Windows reboot team so that they could use it in gathering data about machine reboots. They have tools to collect eventlogs from premier customers. The information can help them learn more about why system reboots were caused, they can correlate this data in the app event log to the data in the system event log (where reboot initiations are logged). A couple of things that are important to note: 1. The installer makes local copies of transforms, patches, and the installation package to run from. 2. For security reasons, the service process cannot trust a local temp copy in the users space (and conversely the client process most likely doesnt have the rights to cache the file in a secure location) 3. The installer makes its best attempt to track temporary copies of files and has a multi-step mechanism for addressing clean-up. a. The engine itself keeps track of the temp copies and tries to delete when it terminates (this is what you see from those logged lines) b. An opcode is created CleanupTempFiles to register files for post-install clean-up. Youll see this from the "Scheduling file %s for deleting during post-install cleanup (not post-reboot)." c. Once the install completes, the service will read the post-install cleanup list and attempt to cleanup those files on the list. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.