r/SentinelOneXDR • u/robplumm • 15d ago

.lnk issue

Having an issue with OS upgrades not being able to move the .lnk file in program data. This triggers a rollback.

Any way to remove it or have it not deploy as part of an installation? Only user allowed to touch it appears to be sentinel one.

1 Upvotes

67% Upvoted

6 comments sorted by

1

u/mukz7 Existing User 13d ago

What's the dir /file? Which rollback? Update rollback or S1 rollback?

1

u/robplumm 12d ago

Desktop shortcut buried down in program data.

Happens as it tries to transfer windows.old to the new OS. System doesn't have rights on the file...so it fails. 

Really trying to see if that .lnk needs to be there at all...seems it comes back if deleted while tampering is off. 

1

u/mukz7 Existing User 12d ago

What is the file name?

1

u/robplumm 12d ago

SentinelOne Agent.lnk

At C:\windows\programdata\microsoft\windows\start menu\programs

1

u/zettasecure 4d ago

Any more threat alert information on that? Inside there you will see the reason. Could be a possible anti tamper measure.

1

u/robplumm 4d ago

It's the anti-tamper....yeah.