Reply to thread

Message

<blockquote data-quote="Reldel1" data-source="post: 809415" data-attributes="member: 63192">Shmu26,&nbsp; Here are temp log events, FYI the specific temp sub-folders are not visible within Explorer.&nbsp;&nbsp; I&#039;m to early in my Canary Edge experience to be certain but I believe a new CR_ subfolder is used with each update and thus whitelisting may not be possible at that level.&nbsp; I believe the temp folder is deleted after the update completes.&nbsp; Just hypothesis at this point.Event Time&nbsp; &nbsp; Record ID&nbsp; &nbsp; Event ID&nbsp; &nbsp; Level&nbsp; &nbsp; Channel&nbsp; &nbsp; Provider&nbsp; &nbsp; Description&nbsp; &nbsp; Opcode&nbsp; &nbsp; Task&nbsp; &nbsp; Keywords&nbsp; &nbsp; Process ID&nbsp; &nbsp; Thread ID&nbsp; &nbsp; Computer&nbsp; &nbsp; User&nbsp;&nbsp; 4/12/2019 6:54:32 AM.483&nbsp; &nbsp; 637&nbsp; &nbsp; 865&nbsp; &nbsp; Warning&nbsp; &nbsp; Application&nbsp; &nbsp; Microsoft-Windows-SoftwareRestrictionPolicies&nbsp; &nbsp; Access to C:\Users\relde\AppData\Local\Temp\CR_5B2E1.tmp\setup.exe has been restricted by your Administrator by the default software restriction policy level.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x8000000000000000&nbsp; &nbsp; 12868&nbsp; &nbsp; 10208&nbsp; &nbsp; DESKTOP-HSDO7FL&nbsp; &nbsp; DESKTOP-HSDO7FL\relde&nbsp;&nbsp; 4/12/2019 6:54:22 AM.276&nbsp; &nbsp; 636&nbsp; &nbsp; 865&nbsp; &nbsp; Warning&nbsp; &nbsp; Application&nbsp; &nbsp; Microsoft-Windows-SoftwareRestrictionPolicies&nbsp; &nbsp; Access to C:\Users\relde\AppData\Local\Temp\CR_A801A.tmp\setup.exe has been restricted by your Administrator by the default software restriction policy level.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x8000000000000000&nbsp; &nbsp; 11460&nbsp; &nbsp; 8948&nbsp; &nbsp; DESKTOP-HSDO7FL&nbsp; &nbsp; DESKTOP-HSDO7FL\relde</blockquote>

[QUOTE="Reldel1, post: 809415, member: 63192"] Shmu26, Here are temp log events, FYI the specific temp sub-folders are not visible within Explorer. I'm to early in my Canary Edge experience to be certain but I believe a new CR_ subfolder is used with each update and thus whitelisting may not be possible at that level. I believe the temp folder is deleted after the update completes. Just hypothesis at this point. Event Time Record ID Event ID Level Channel Provider Description Opcode Task Keywords Process ID Thread ID Computer User 4/12/2019 6:54:32 AM.483 637 865 Warning Application Microsoft-Windows-SoftwareRestrictionPolicies Access to C:\Users\relde\AppData\Local\Temp\CR_5B2E1.tmp\setup.exe has been restricted by your Administrator by the default software restriction policy level. 0x8000000000000000 12868 10208 DESKTOP-HSDO7FL DESKTOP-HSDO7FL\relde 4/12/2019 6:54:22 AM.276 636 865 Warning Application Microsoft-Windows-SoftwareRestrictionPolicies Access to C:\Users\relde\AppData\Local\Temp\CR_A801A.tmp\setup.exe has been restricted by your Administrator by the default software restriction policy level. 0x8000000000000000 11460 8948 DESKTOP-HSDO7FL DESKTOP-HSDO7FL\relde [/QUOTE]

Verification