Hello,
I have a file on an employee's computer that builds in Internet Explorer's temp files when using an online service. I need that file to not be deleted at random. The file in question is RinconClient[1].xap, pictured below in the Event Viewer, with file auditing.
I have narrowed it down to either dllhost.exe or taskhostw.exe deleting the file, in event viewer. We have antivirus software which has not detected anything malicious in regards to the RinconClient[1].xap file.
In Internet Explorer, I have
Empty Temporary Internet Files folder when browser is closed = Unchecked
Delete Browsing History no exit = Unchecked
Check for Newer versions of stored pages = Never
Allow website caches and databases = Checked
In Task Scheduler
CleanupTemporaryState = Disabled
SilentCleanup = Disabled
I have messed with permissions to the C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\Low\IE folders and subfolders and to the file itself. Making sure it is supposed to not get deleted.
I have tried a script which copies the file to each folder and subfolder in
C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\Low\IE
Did not resolve the issue.
OS Name: Microsoft Windows 10 Pro
OS Version: 10.0.17134 N/A Build 17134
I have done these same changes on my machine, and the file is still there and the issue does not occur.
I have made the same changes to the user's machine to no avail.
Is there a way to make sure IE's temp files do not get cleared out or to protect that file?
An attempt was made to access an object.
Subject:
Security ID:
Account Name: USERNAME
Account Domain:
Logon ID:
Object:
Object Server: Security
Object Type: File
Object Name: C:\Users\USERNAME\AppData\Local\Microsoft\Windows\INetCache\Low\IE\QHL0SIIB\RinconClient[1].xap
Handle ID: 000006BC
Resource Attributes: S:AI
Process Information:
Process ID: 00000F38
Process Name: C:\Windows\System32\taskhostw.exe
Access Request Information:
Accesses: DELETE
Access Mask: 10000
