Tracking Down Why Group Policy Client Is Changing an Environment Variable

Tracking Down Why Group Policy Client Is Changing an Environment Variable

Something is mysteriously changing one of my environment variables on my Win 7 system. I've followed the guidance in this thread, and tracked down the culprit... to svchost.exe. Process Explorer seems to indicate that that thread of svchost.exe is running the Group Policy Client (gpsvc). Any thoughts about how to track down why gpsvc is changing this environment variable, and how to stop it from doing so?

Thanks in advance...

A registry value was modified.

Subject:
    Security ID:        SYSTEM
    Account Name:       machine$
    Account Domain:     mydomain
    Logon ID:       0xfff

Object:
    Object Name:        \REGISTRY\USER\S-1-5-21-1657032316-61167162-621696214-25666\Environment
    Object Value Name:  R_LIBS
    Handle ID:      0x16c
    Operation Type:     Existing registry value modified

Process Information:
    Process ID:     0x474
    Process Name:       C:\Windows\System32\svchost.exe

Change Information:
    Old Value Type:     REG_SZ
    Old Value:      D:\Program Files\R_libs
    New Value Type:     REG_SZ
    New Value:      z:\R

1 Answer

If your environment variable is set by a group policy setting, try to run in a priviledged command prompt :

gpupdate /r /z > somefile.txt && notepad somefile.txt

Then search inside the text file for your environment variable.

I am not sure if the result are the same but you may also try :

gpupdate /h report.html && start report.html

Then search inside in your browser for the environment variable.

7

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Elena Rostova
Author

Elena Rostova

Elena Rostova holds a Master's degree in Public Health Journalism. She covers groundbreaking medical research, holistic wellness trends, mental health awareness, and nutritional science.