Windows 10: .ps1 files running from C:\Windows\system32\config\systemprofile\AppData\Local\

Good afternoon,I'm using sysmon and I've detected random .ps1 files running across my enterprise at different time intervals. I attempted to locate these .ps1 files on my local system and they have disappeared or been deleted. Is this some normal check that windows automatically runs or potentially something malicious. Below is a snippet of the command that is executed.powershell -ExecutionPolicy ByPass -FILE \"C:\WINDOWS\system32\config\systemprofile\AppData\Local\cccbdc7c6d344222978a1a4d9a67e2ee.ps1\I'm just trying to figure out if this is normal behavior as we're seeing across all workstati

:)

 

C:\windows\system32\config\systemprofile\desktop is unavailable error on Windows 10

Hello Vik,

This C:\windows\system32\config\systemprofile\desktop is unavailable error may occur due to corrupt or missing Windows files.

To troubleshoot the issue, you can follow these simple steps:

• Open File Explorer and navigate to: C:\Windows\system32\config\systemprofile and check if it has the
  Desktop folder there.
• If the Desktop folder does not exist, then create a new folder and rename it as
  Desktop or copy it from C:\users\Default\Desktop.

Note: By default, C:\Users\Default is hidden. To unhide click on the View tab and check the
Hidden Items box.

After you have created the folder, it is required that you give full permission to the folder. You can follow these steps to give full permission:

• Right click on the folder, select Properties then click on the Security tab.
• Click on Edit.
• On the Permissions for Desktop window, select Everyone and then click on
  Add.
• In the Enter the object names to select dialog box, type
  Everyone and click on Check Names.
• Click OK.

If you need further assistance, let us know.

 

My C:\WINDOWS\system32\config\systemprofile\Desktop is unavailable.

And when I do this, "C:\WINDOWS\system32\config\systemprofile\Desktop will come back and already be loaded?

 

error: c:\windows\system32\config\systemprofile\desktop is unavailable

If you don't mind my asking, I'd like to learn more about the registry and these numbers in certain locations. Wonder if you could point me to a source so I could read about this stuff. My ProfileList is pasted in below. I have no idea what it all means.

​



- - - Updated - - -

I was able to fix the problem using SFC and DISM. When I used these commands, My system got better. I hope I can login to work tomorrow. For now, I'm out of the woods. Thanks to both Smirk24 and SIW2 for your suggestions. I have more confidence that I've done the right things..