Still not fixed - nothing in 6.2.4 or 6.2.5 changed this part of the agent. Remaining problem is now tracked in https://github.com/netxms/netxms/issues/3621 (#3137 was closed after the split).

To move it forward, please post:

• exact warning lines from the server log - package name in them shows which part of the agent produces the duplicates
• nxagentd log with debug level 6 for tag "winnt", covering a full logon and logoff
• System.InstalledProducts table taken twice - once with a user logged on, once without
• whether these are RDS/terminal servers, and whether profiles are roaming, FSLogix or UPD

Not fixed - I've reopened https://github.com/netxms/netxms/issues/3137. It was closed against a different fix (#3240) that only covered part of the problem.

Your combination is not the version mismatch Filipp mentioned - agent 6.2.3 and server 6.2.2 both contain everything from that work, so the "server must also be 6.2" note does not apply to you.

What is left: the agent can still change the reported user name, and sometimes the display name, for the same Store package between two polls, without signalling that the data is incomplete. Since 6.1 the server treats package name plus user as the package identity, so any such change comes out as a remove plus an install. Most likely triggers are a user profile whose registry hive is not on disk while the user is logged off (roaming profiles, FSLogix, UPD), and a failed SID-to-username lookup.

To tell which one you are hitting, please post:

• nxagentd log with debug level 6 for tag "winnt", covering a full logon and logoff
• System.InstalledProducts table taken twice - once with a user logged on, once without
• whether these are RDS/terminal servers, and whether profiles are roaming, FSLogix or UPD

Workaround is poor. There is no way to exclude Store packages from the inventory, and the inventory is collected on every configuration poll. Since 6.1 SYS_PACKAGE_INSTALLED and SYS_PACKAGE_REMOVED carry the user name as an event parameter, but filtering on it only removes half of each pair - the other half is reported as a system-wide package with empty user.

have the developers been able to find anything in the meantime?
We’re unfortunately losing track quite quickly due to the high volume of messages, as many of the monitored servers are terminal servers with a large number of users.

Best regards,
Alwin

this would disable all package changes - including the system alerts that we need to monitor. We are waiting for the development team and hope for a solution. Thank you for reopen the case!

I've reopened issue, so devs will look into it.

unfortunately, we cannot confirm that this fix works.
We have been experiencing this behavior since updating the NetXMS Agent from 5.0.8 to 6.1.1. Is there a setting to disable these messages during user logins?

We have also noticed that the system is now detecting more non-essential installed software, which is flooding our alarm browser.  For example:

CapturePicker 10.0.17763.1 was installed
Hello-Setup 10.0.19585.1001 was installed
File Explorer 10.0.17763.1 was installed

Is there perhaps also a way to hide specific notifications?

Thanks for your help 

Thanks anyway, I like netxms since version 0.2.27...