ProblemConsider the following scenario:
- Microsoft Internet explorer has been configured, either manually or through a policy, to "delete browsing history on exit"
- Process Interception has been configured for Microsoft Internet Explorer
If you close Microsoft Internet Explorer, a hidden iexplore.exe will be started which will then be intercepted and as a result, the already applied configuration will be re-applied.
CauseThe hidden iexplore.exe process is a child of rundll that has no parent anymore.
When closing Microsoft Internet Explorer, a sub-process "rundll32.exec:\windows\system32\inetcpl.cpl,ClearMyTracksByProcess" will start. This then launches a new child process "iexplore.exe" and then closes the parent "iexplore.exe" process.
RES Workspace Manager currently does not intercept child processes if the parent process was already intercepted. In this case, the parent process is killed and RES Workspace Manager will not be able to know that the parent was an intercepted application, thus the new iexplore.exe process will be intercepted again and configuration will be applied.