Skip to main content
Question

Eventlog being spammed with Event ID 1035 after NGTools install.

  • March 4, 2026
  • 3 replies
  • 27 views

Curious if anyone else is seeing the eventlog getting spammed constantly with Event ID 1035 after NGTools is installed on Guest VM machines.

Event Viewer > Windows Logs > Application

 

3 replies

selvamani
Forum|alt.badge.img+3
  • Trailblazer
  • March 5, 2026

Hi ​@lmcneil 
This behavior has been observed in some environments after installing Nutanix Guest Tools (NGT). Repeated Event ID 1035 from MsiInstaller usually indicates that Windows Installer is triggering a reconfiguration or self-repair check for the “Nutanix Checks and  Pre req ” MSI component.

This can occur when Windows Installer performs a self-healing check triggered by system components or services. It may also happen due to Group Policy MSI repair checks running in the background. In some cases, a scheduled task or service periodically validates the NGT prerequisite package. Older NGT versions can also register the prerequisite MSI in a way that causes frequent revalidation, which results in repeated Event ID 1035 entries.

You can usually reduce or stop the log entries by:

Upgrading Nutanix Guest Tools to the latest version , Reinstalling NGT cleanly on the guest VM,Checking for Windows Installer repair triggers via Group Policy or scheduled tasks.

Thanks 
Selvamani.S


  • Author
  • Voyager
  • March 5, 2026

Hello, we have Nutanix Guest Tools v4.5.0.0 installed.

Microsoft mentioned the event log issue here. Windows Installer reconfigured all applications - Windows Server | Microsoft Learn

 

I setup a fresh stand-alone VM (2025 Server Datacenter) to test with no internet and no domain. The only install being the NGTools program. I performed a WMI trace, and it is being triggered by a Nutanix Python script that is doing a query on the mentioned Win32_Product class.

WMI Activity showing the query from the running ID process 5460
​​​​
Python.exe running as process ID 5460, matching the WMI Trace.


 

The file location of the running process.

 

 

 

 


selvamani
Forum|alt.badge.img+3
  • Trailblazer
  • March 6, 2026

Hi ​@lmcneil 

Good effort and thanks for sharing the WMI trace results.
The query against Win32_Product explains the repeated MsiInstaller 1035 events, since Windows performs an MSI consistency check whenever that class is queried.

If the query is originating from the Python components installed with NGT 4.5.0, it may be related to how that version performs software inventory checks using WMI.

Also it is important to note that Windows Server 2025 support in NGT is still evolving, so it would be a good idea to verify the supported NGT and guest OS combination in the Nutanix Compatibility Matrix.

Reference:
https://portal.nutanix.com/page/compatibility-interoperability-matrix/guestos/compatibility

Thanks
Selvamani S