?
Solved

Why do all users have default set paths using system account folders?

Posted on 2014-07-21
6
Medium Priority
?
3,157 Views
Last Modified: 2014-07-27
I have been trying to diagnose an  issue with an application when I noticed that my test user had most of its paths set to a system profile..

So I deleted my test user profile and logged in so it will create a new user profile.  It did it again.  Most of the paths are set to a SYSTEM user profile.  I tried several other users allow them to create new profiles and they all have the same issue.

I moved the machine into a different OU with no GP applied and the issue is still happening.  Here is an example of cmd->set for a normal user.. this is not the system profile, but lots of the variables are set to that for some reason.

ADMINTOOLS=ADMINTOOLS
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Users\xxxxx\AppData\Roaming
CACHE=C:\Documents and Settings\SYSTEM\Local Settings\Temporary Internet Files
CDBURNING=C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CD Burning
COMMONADMINTOOLS=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
COMMONAPPDATA=C:\ProgramData\
COMMONDESKTOP=C:\Users\Public\Desktop\
COMMONDOCUMENTS=C:\Documents and Settings\All Users\Documents
COMMONFAVORITES=C:\Documents and Settings\All Users\Favorites
COMMONFILES=C:\Program Files\Common Files\
COMMONMUSIC=C:\Documents and Settings\All Users\Documents\My Music
COMMONPICTURES=C:\Documents and Settings\All Users\Documents\My Pictures
CommonProgramFiles=C:\Program Files\Common Files
COMMONPROGRAMS=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
COMMONSTARTMENU=C:\ProgramData\Microsoft\Windows\Start Menu\
COMMONSTARTUP=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
COMMONTEMPLATES=C:\ProgramData\Microsoft\Windows\Templates\
COMMONVIDEO=C:\Documents and Settings\All Users\Documents\My Videos
ComSpec=C:\Windows\system32\cmd.exe
COOKIES=C:\Documents and Settings\SYSTEM\Cookies
DEFAULTUSERPROFILE=C:\Documents and Settings\Default User
DESKTOP=C:\Users\Public\Desktop\
FAVORITES=C:\Windows\system32\config\systemprofile\Favorites\
FONTS=C:\Windows\Fonts\
FP_NO_HOST_CHECK=NO
x=w sdfsdfzzz
HISTORY=C:\Documents and Settings\SYSTEM\Local Settings\History
HOMEDRIVE=Z:
HOMEPATH=\
HOMESHARE=\\x.x.x\xxxxx
KMP_DUPLICATE_LIB_OK=TRUE
LOCALAPPDATA=C:\Users\xxxxx\AppData\Local
LOCALSETTINGS=C:\Documents and Settings\SYSTEM\Local Settings
MEDIAPATH=C:\Windows\Media
MSSHAREDTOOLS=C:\Program Files\Common Files\Microsoft Shared
MYMUSIC=C:\Windows\system32\config\systemprofile\Documents\My Music
MYPICTURES=C:\Windows\system32\config\systemprofile\Pictures\
MYVIDEO=MYVIDEO
NETHOOD=C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\apps\watcom-1.3\binnt;C:\apps\watcom-1.3\binw;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\java\jdk1.7.0_21\bin\;C:\Program Files\MATLAB\R2013a\bin;C:\Program Files\Windows Live\Shared;C:\Windows\System32\WindowsPowerShell\v1.0\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PERSONAL=C:\Windows\system32\config\systemprofile\Documents\
PRINTHOOD=C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 44 Stepping 2, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=2c02
PROFILESDIRECTORY=C:\Documents and Settings
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files\
PROGRAMS=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
RECENT=C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\
SENDTO=C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\
SESSIONNAME=Console
STARTMENU=C:\ProgramData\Microsoft\Windows\Start Menu\
STARTUP=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Documents and Settings\SYSTEM\AppData\Local\Temp
TEMPLATES=C:\ProgramData\Microsoft\Windows\Templates\
TMP=C:\Documents and Settings\SYSTEM\AppData\Local\Temp
UATDATA=C:\Windows\CCM\UATData\D9F8C395-CAB8-491d-B8AC-179A1FE1BE77
USERNAME=xxxxx
USERPROFILE=C:\Users\xxxxx
WATCOM=C:\apps\watcom-1.3
windir=C:\Windows
windows_tracing_flags=3
windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log

Anyone know what may have caused this issue to happen?  I can recreate the issue on all of my lab computers I have tested.

Shell Folders and User Shell folders both have all of the variables set properly in them.  Where is CMD->Set getting its variables from and how do I set them to the proper variables?
0
Comment
Question by:gacus
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 56

Assisted Solution

by:McKnife
McKnife earned 2000 total points
ID: 40210860
Setup a test machine, join it to your domain and setup auditing on that registry branch named environment in HKCU. That way you'll see who does it and when it happens.
0
 
LVL 1

Author Comment

by:gacus
ID: 40211580
If I look under HKCU, not all these variables are even set.
0
 
LVL 1

Author Comment

by:gacus
ID: 40211582
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 56

Accepted Solution

by:
McKnife earned 2000 total points
ID: 40211764
Ok... what you see there are user variables. What you see with "set" are both user- and system variables. In regedit, the system variables are under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

...sorry, missed that.
0
 
LVL 1

Assisted Solution

by:gacus
gacus earned 0 total points
ID: 40211909
Thanks!  I was able to figure out it was a legacy application installer setting all this variables.  I had to go through a list of installers and watch these keys to figure out which application was doing it.  It was fun!
0
 
LVL 1

Author Closing Comment

by:gacus
ID: 40222264
it was part of the fix
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolve DNS query failed errors for Exchange
There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
Suggested Courses

741 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question