Bit of a weird one - I have Windows Desktop and Server OS's machines, a few are affected by an issue where the c:\windows\installer directory fills up with TMP files such as MS166AC.tmp - and I've been unable to find a cause of this issue. I did some work with Process Monitor, and saw that the files were being touched by the AV, but after an quick uninstall, I saw that the issue was still present, so that can be discounted. Looking in Process Monitor, I can see that a CANNOT DELETE result is present when msiexec.exe runs a SetDispositionalInformationFile with a detail of Delete: True which looks like why folder is filling up with files, but I can't find a reason why. I've also previously seen a BUFFER OVERFLOW for QuerySecurityFile operation, and a FILE LOCKED WITH ONLY READERS for a CreateFileMapping event. I was wondering if:

a.) Anyone else has seen a similar behaviour?

b.) Any advice on what steps to take next?