Something is mysteriously changing one of my environment variables on my Win 7 system. I've followed the guidance in this thread, and tracked down the culprit... to svchost.exe. Process Explorer seems to indicate that that thread of svchost.exe is running the Group Policy Client (gpsvc). Any thoughts about how to track down why gpsvc is changing this environment variable, and how to stop it from doing so?
Thanks in advance...
A registry value was modified.
Subject:
Security ID: SYSTEM
Account Name: machine$
Account Domain: mydomain
Logon ID: 0xfff
Object:
Object Name: \REGISTRY\USER\S-1-5-21-1657032316-61167162-621696214-25666\Environment
Object Value Name: R_LIBS
Handle ID: 0x16c
Operation Type: Existing registry value modified
Process Information:
Process ID: 0x474
Process Name: C:\Windows\System32\svchost.exe
Change Information:
Old Value Type: REG_SZ
Old Value: D:\Program Files\R_libs
New Value Type: REG_SZ
New Value: z:\R
1 Answer
If your environment variable is set by a group policy setting, try to run in a priviledged command prompt :
gpupdate /r /z > somefile.txt && notepad somefile.txt
Then search inside the text file for your environment variable.
I am not sure if the result are the same but you may also try :
gpupdate /h report.html && start report.html
Then search inside in your browser for the environment variable.