question

frapc-2930 avatar image
0 Votes"
frapc-2930 asked frapc-2930 answered

Random programs accessing Solidworks fonts folder

Hi, I'm asking here because I have no idea about what's going on, and it's kinda driving me crazy. I have installed Solidworks on my secondary HDD, and I have noticed that once in a while some program will do some stuff on a folder cointaining fonts in the Solidworks installation. The list of these programs include: consent.exe, mmc.exe, systemsettings.exe, firefox.exe, and probably others that I haven't catched yet (I can provide Process Monitor screenshots and/or logs if needed).

I cannot find anything on the web similar to this, and I cannot find a way to understand why some random and apparently unrelated programs should access that folder. I don't want background HDD activity and most importantly I don't want activity that makes no sense!

I really hope someone will be able to help me, even just a way to prevent access to that folder would be something.

Thanks :)

windows-10-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

frapc-2930 avatar image
0 Votes"
frapc-2930 answered

As I noticed that the Solidworks fonts folder was regularly accessed when I launched Firefox, probably all the activity related to that folder was just because of those Fonts being installed in Windows. After removing the installed Solidworks fonts (located on the secondary HDD) through the Settings app, I have not seen any further activity related to them yet.

I hope it was just as simple as that; my fault I didn't know how do fonts work in Windows.

Thank you a lot for your help :)

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered frapc-2930 edited

Hi,
Following method for your reference:
Enable the file system audit on the folders.
https://www.lepide.com/how-to/track-who-read-files-on-your-windows-file-servers.html

Define the access permission for necessary users.
Read permission for the standard users. Only administrators or specific users have the modify permission.

Best Regards,

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for your suggestion. I'm afraid I'm on windows 10 home, so I cannot use Group Policy. Is it possible to do the same thing by modifying folder permissions in the Properties - Security options in File Explorer? Also, for example when mmc.exe or consent.exe access that folder, ProcMon says that the user is me, not System, so I don't know to who I should deny access to that folder

0 Votes 0 ·
GaryNebbett avatar image
0 Votes"
GaryNebbett answered frapc-2930 converted comment to answer

Hello @frapc-2930,

I could give you some instructions about how to capture this activity with Event Tracing for Windows (ETW) but you would probably have to share the trace data here (via OneDrive, Google Drive, etc. link), since the data is not easy to interpret. The trace would also gather a lot of data every second, so you would probably need to be able to reproduce the problematic behaviour on demand in order to keep the trace data to a manageable size.

You should be able to use ProcMon in parallel with the ETW capture, so you should be able to tell if there are interesting events in the trace data.

This issue seems more like an irritation than a major problem and you might not want to risk revealing too much information in the publicly shared trace data just to resolve it. Let us know if you are interested in pursuing this course of action.

Gary

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @GaryNebbett , yes, it is definitely more like an irritation rather than a major problem, though it is completely ruining the work I have to do with this machine. It's not possible to reproduce the issue on demand and it might be very time consuming to record it since, for example, this morning it has happened several times in a row and now it hasn't happened for a while. Still, I may try what you suggest since it looks like there is nothing else to do; also, after you give me the instructions, I'm not 100% sure I will follow up with an actual ETW capture for practical reasons, so I don't want to waste your time if that's the case.

Before trying to proceed, maybe there is a way to tell Windows to treat this secondary non-os drive more like a mass storage rather than a drive where it has to do all of this stuff I've never asked for? The secondary HDD in my PC was supposed to be active only when I'd access it and for nothing else.

Thank you for your time

0 Votes 0 ·

Hello @frapc-2930,

I have attached a file to this message, which you can save somewhere; conventionally, it should have a .wprp extension (Windows Performance Recorder Profile). Assuming that you save the file with the name "ts.wprp", to start a trace, issue the command wpr -start ts.wprp!Troubleshoot -filemode; to stop the trace, issue the command wpr -stop why.etl (you can choose your own name for the output file in place of "why.etl").

If you do make a trace file available, please broadly indicate (via timestamp or whatever else seems sensible) what to look for in the trace that is of interest to you.

Gary

98821-tswprp.txt


1 Vote 1 ·
tswprp.txt (1.2 KiB)