Stop using Win32_Product for DHCP Agent version discovery
Since UR5 VMM polls the Hyper-V hosts every half hour for the DHCP agent version. The Win32_Product WMI class is used for this.
Because this class is used, every half hour MSIEXEC processes will run consistency and reconfiguration steps for all MSI packages on all Hyper-V hosts. This results in a flood wave of Application Event ID 1035 occurring every 30 minutes.
The overall impact I cannot oversee as I don't know what is actually reconfigured.
You can validate VMM is the cause of these calls by enabling WMI tracing.
Microsoft itself actually advises (https://support.microsoft.com/en-us/kb/974524) not to use this class because it does more than just list installed products. It’s an old KB but it still applies.
A quote from the KB:
If you have an application that makes use of the above class, please contact the vendor to get an updated version that does not use this class.
This idea has been completed in SCVMM 2012 R2 UR7. For more detail, please go to https://support.microsoft.com/en-us/kb/3066340.
Ned Pyle [MSFT] commented