[1709, fcu] supportedUris files filling C drives.

[free780]

Anybody else seen this?

 

supportedUris files seem to be filling C drives in this path "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Safety\network\remote" .

The size of the files are 10-13MB since April 2018.

[free780]

Traced the issue to C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe . Will do further investigation.

[Arthur]

Traced the issue to C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe . Will do further investigation.

Is AppLocker allowing Windows Defender to execute things from that ProgramData folder (as per the article below)?

 

https://support.microsoft.com/en-gb/help/4052623/update-for-windows-defender-antimalware-platform

 

%OSDrive%\ProgramData\Microsoft\Windows Defender\Platform\*