none
Prevent File being deleted in Internet Explorer's temp files RRS feed

  • Question

  • Hello,

    I have a file on an employee's computer that builds in Internet Explorer's temp files when using an online service. I need that file to not be deleted at random. The file in question is RinconClient[1].xap, pictured below in the Event Viewer, with file auditing.

    I have narrowed it down to either dllhost.exe or taskhostw.exe deleting the file, in event viewer. We have antivirus software which has not detected anything malicious in regards to the RinconClient[1].xap file.

    In Internet Explorer, I have
    Empty Temporary Internet Files folder when browser is closed = Unchecked

    Delete Browsing History no exit = Unchecked

    Check for Newer versions of stored pages = Never

    Allow website caches and databases = Checked

    In Task Scheduler

    CleanupTemporaryState = Disabled

    SilentCleanup = Disabled

    I have messed with permissions to the C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\Low\IE folders and subfolders and to the file itself. Making sure it is supposed to not get deleted.

    I have tried a script which copies the file to each folder and subfolder in

    C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\Low\IE

    Did not resolve the issue.

    OS Name:                   Microsoft Windows 10 Pro
    OS Version:                10.0.17134 N/A Build 17134

    I have done these same changes on my machine, and the file is still there and the issue does not occur.

    I have made the same changes to the user's machine to no avail.

    Is there a way to make sure IE's temp files do not get cleared out or to protect that file?

    Here's an event from the Event Viewer

    An attempt was made to access an object.

    Subject:
        Security ID:       
        Account Name:        USERNAME
        Account Domain:       
        Logon ID:       

    Object:
        Object Server:        Security
        Object Type:        File
        Object Name:        C:\Users\USERNAME\AppData\Local\Microsoft\Windows\INetCache\Low\IE\QHL0SIIB\RinconClient[1].xap
        Handle ID:        000006BC
        Resource Attributes:    S:AI

    Process Information:
        Process ID:        00000F38
        Process Name:        C:\Windows\System32\taskhostw.exe

    Access Request Information:
        Accesses:        DELETE
                    
        Access Mask:        10000

    Wednesday, January 23, 2019 9:16 PM