Reviewing Files under the Captured Files tab - Community

Ken T (38 posts)

June 25, 2025 05:36 PM

Accepted Answer

When reviewing files under Windows 10, I was able to view files without issue.

Recently after upgrading my machine to Windows 11, when I go to view files, it would give me a message along the lines of "Path could not be found."

Then I experimented and instead of opening the file with NotePad, I directed it to use FireFox. That's when it told me the exact full file path that where it was looking.

This path was:
C:\Users\kzen\AppData\Local\Temp\adTempuse87fb5b9-2937-495b-a5c7-6adedd2797c5\66c16cb2-ceb2-4bba-8a84-2bc9aa39987f

When I looked under:

C:\Users\kzen\AppData\Local\Temp, I couldn't find the subfolders. So I created them, but still I couldn't view the files.

I then went to the path:
C:\Users\kenz\AppData\Local\Temp\adTempuse87fb5b9-2937-495b-a5c7-6adedd2797c5\66c16cb2-ceb2-4bba-8a84-2bc9aa39987f

And I found the file. kenz is the login that I used to run the adTempus Console. I use RunAs to open the adTempus console.

However, I am logged into the workstation as kzen.

I think there is a bug with the adTempus Console 5.0.2. It saves to the correct location but when it goes to open the file, it incorrectly uses the workstation's login ID instead of the login ID used to run the console app, when using Windows 11.

Is there version of the adTempus Console that resolves this?

Thanks.

Ken

Bill Staff (615 posts)

June 26, 2025 11:36 AM

Accepted Answer

When you view a vile, the Console retrieves the data from the adTempus server and saves it under your TEMP folder. It gets the location of the TEMP folder from Windows, which returns the current user's TEMP folder. So as you say, it's saving to the correct path.

Then it tells Windows to open the file. All it does is send the path/filename to Windows and say "open this". It's basically the same as if you go to Start/Run and put in the file name--Windows decides which program to use to open the file base on file associations.

When I tested this it worked correctly--viewing a captured .txt file caused Windows to open the file in Notepad, running under the identity used to launch the Console.

I tested on a second computer and it did not launch the file. The Task Manager showed the Windows OpenWith program running (which should be prompting to select the program to use) but it was running under my identity (not the RunAs identity) and was not showing its UI. So it appears that Windows is not always using the correct identity in this scenario. That's not something we have control over.

Either way, the Console is sending the correct path to Windows, so I don't know what's happening in your case that it's ending up with the wrong path. Maybe Windows sees an AppData path and substitutes the current user instead of the specified user?

The workaround would be to use the Save As command instead of Open, then open the file yourself from Windows Explorer.

Bill Staff (615 posts)

June 27, 2025 02:23 PM

Accepted Answer

We now have another user experiencing this problem; we're looking at what could be causing it.

Ken T (38 posts)

June 27, 2025 02:58 PM

Accepted Answer

Thanks Bill!

Bill Staff (615 posts)

July 7, 2025 02:42 PM

Accepted Answer

In the other case we looked at, this was caused by a missing user profile for the account being used to run adTempus. If you have not logged in to the computer interactively under that account, do that so that Windows creates the user profile for that account. Then go back and try the Console again.