Something is mysteriously changing one of my environment variables on my Win 7 system. I've followed the guidance in this thread, and tracked down the culprit... to svchost.exe. Process Explorer seems to indicate that that thread of svchost.exe is running the Group Policy Client (gpsvc). Any thoughts about how to track down why gpsvc is changing this environment variable, and how to stop it from doing so?
Thanks in advance...
A registry value was modified. Subject: Security ID: SYSTEM Account Name: machine$ Account Domain: mydomain Logon ID: 0xfff Object: Object Name: \REGISTRY\USER\S-1-5-21-1657032316-61167162-621696214-25666\Environment Object Value Name: R_LIBS Handle ID: 0x16c Operation Type: Existing registry value modified Process Information: Process ID: 0x474 Process Name: C:\Windows\System32\svchost.exe Change Information: Old Value Type: REG_SZ Old Value: D:\Program Files\R_libs New Value Type: REG_SZ New Value: z:\R 1 Answer
If your environment variable is set by a group policy setting, try to run in a priviledged command prompt :
gpupdate /r /z > somefile.txt && notepad somefile.txt Then search inside the text file for your environment variable.
I am not sure if the result are the same but you may also try :
gpupdate /h report.html && start report.html Then search inside in your browser for the environment variable.
7
