Jump to content
CCleaner Community Forums
Winapp2.ini

Winapp2.ini additions

Recommended Posts

@APMichael

Regarding the [Sharing MFU *] entry, I have checked a few Windows 10 systems and "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SharingMFU"  is not present in the registry.

Share this post


Link to post
Share on other sites

Revised Entry

Added: %LocalAppData%\Packages\Microsoft.MSPaint_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE

[Paint 3D *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MSPaint_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.MSPaint_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MSPaint_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MSPaint_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MSPaint_*\LocalState|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MSPaint_*\TempState|*.*|RECURSE

Share this post


Link to post
Share on other sites

Revised Entry

It is safe to delete all files from the Backup folder. These are just cached files. ShareX uses original .json files from "%Documents%\ShareX".

Changed DetectFile from "%Documents%\ShareX" to "%ProgramFiles%\ShareX" because ShareX Microsoft Store app also uses "%Documents%\ShareX" location to store files.

[ShareX *]
LangSecRef=3021
DetectFile=%ProgramFiles%\ShareX
Default=False
FileKey1=%Documents%\ShareX\Backup|*.*|RECURSE
FileKey2=%Documents%\ShareX|History.xml
FileKey3=%Documents%\ShareX\Logs|*.*|RECURSE


New Entry

[ShareX App *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\19568ShareX.ShareX_egrzcvs15399j
Default=False
FileKey1=%Documents%\ShareX\Backup|*.*|RECURSE
FileKey2=%Documents%\ShareX|History.xml
FileKey3=%Documents%\ShareX\Logs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\19568ShareX.ShareX_*\AC\INet*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\19568ShareX.ShareX_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\19568ShareX.ShareX_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\19568ShareX.ShareX_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\19568ShareX.ShareX_*\TempState|*.*|RECURSE

Share this post


Link to post
Share on other sites

Revised entries:

I think we can remove DetectOS if we correct the Detect paths. They only exist on the matching Windows versions.

[Action Center *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center
...

[Security and Maintenance *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance
...

After some tests I am sure that the FileKey "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE" belongs to the entry [Notifications *]. You can test it for yourself: Just safely remove a USB drive. While you can see the notification, a file appears in the folder "ActionCenterCache". The file caches the icon. (In addition, the folder does not exist under Windows 7 and 8. And Microsoft itself calls the notification icon in the lower right corner of Windows 10 the action center icon.)

acc_01.jpg.a063a7d7f405a3212edd4fc222c4d261.jpgacc_02.jpg.866496999d142000970c0875cc6b4948.jpg

https://support.microsoft.com/en-us/help/4028116/windows-10-find-action-center-in-windows-10

Share this post


Link to post
Share on other sites
22 hours ago, APMichael said:

Revised entries:

I think we can remove DetectOS if we correct the Detect paths. They only exist on the matching Windows versions.

[Action Center *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center
...

[Security and Maintenance *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance
...

After some tests I am sure that the FileKey "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE" belongs to the entry [Notifications *]. You can test it for yourself: Just safely remove a USB drive. While you can see the notification, a file appears in the folder "ActionCenterCache". The file caches the icon. (In addition, the folder does not exist under Windows 7 and 8. And Microsoft itself calls the notification icon in the lower right corner of Windows 10 the action center icon.)

acc_01.jpg.a063a7d7f405a3212edd4fc222c4d261.jpgacc_02.jpg.866496999d142000970c0875cc6b4948.jpg

https://support.microsoft.com/en-us/help/4028116/windows-10-find-action-center-in-windows-10

You're right. The [Notifications *] entry has nothing to do with notifications. This entry should be removed completely.

I just opened %LocalAppData%\Microsoft\Windows\Notifications\wpnidm, and it has .jpg files that belongs to Microsoft Store apps.
Then, I opened wpndatabase.db from %LocalAppData%\Microsoft\Windows\Notifications\wpnidm, and it has information about Microsoft Store apps.
I then opened HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm, and it has information about the Microsoft Store apps that are listed in wpndatabase.db

Share this post


Link to post
Share on other sites

Thanks for your reply.

But I think the entry [Notifications *] is correct after all: I opened the wpndatabase.db you mentioned, scrolled through it and was shocked because I found many snippets of old emails at the end of the file. The wpndatabase.db-wal also contains many snippets of emails. These are traces of email notifications from Outlook. Wow, what a privacy risk! The wpndatabase.db-wal is also updated after new notifications from Outlook:

wpndatabase-db-wal.thumb.jpg.00cf718cf966c0a0c92238b233af6f93.jpg

Therefore I think that the entry [Notifications *] should remain and we should add the FileKey "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE". Unfortunately, the wpndatabase.db files are locked by a service and cannot be removed by CCleaner. (I have to remove them manually.)

Share this post


Link to post
Share on other sites
1 hour ago, APMichael said:

Thanks for your reply.

But I think the entry [Notifications *] is correct after all: I opened the wpndatabase.db you mentioned, scrolled through it and was shocked because I found many snippets of old emails at the end of the file. The wpndatabase.db-wal also contains many snippets of emails. These are traces of email notifications from Outlook. Wow, what a privacy risk! The wpndatabase.db-wal is also updated after new notifications from Outlook:

wpndatabase-db-wal.thumb.jpg.00cf718cf966c0a0c92238b233af6f93.jpg

Therefore I think that the entry [Notifications *] should remain and we should add the FileKey "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE". Unfortunately, the wpndatabase.db files are locked by a service and cannot be removed by CCleaner. (I have to remove them manually.)

Then I think we should change its name to Push Notifications.

By the way, whenever I delete wpndatabase.db file, LiveTile stop working on Microsoft Store apps, but I think we should add this back in the entry since it holds sensitive stuff.

Share this post


Link to post
Share on other sites

Revised Entry

Changed name from [Notifications *] to [Push Notifications *]
Added *.db, *.db-shm and *.db-wal file extensions in FileKey1

[Push Notifications *]
DetectOS=10.0|
LangSecRef=3025
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.db; *.db-shm;*.db-wal;*.tmp
FileKey2=%LocalAppData%\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm
RegKey3=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup
RegKey4=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm

Share this post


Link to post
Share on other sites
1 hour ago, SMalik said:

... By the way, whenever I delete wpndatabase.db file, LiveTile stop working on Microsoft Store apps, but I think we should add this back in the entry since it holds sensitive stuff.

Yes, now I remember that you wrote the issue with the LiveTiles a few weeks ago. And yes, adding the .db files back shouldn't be a problem as they can only be deleted in Safe Mode.

1 hour ago, SMalik said:

Revised Entry

Changed name from [Notifications *] to [Push Notifications *]
Added *.db, *.db-shm and *.db-wal file extensions in FileKey1
...

Is it okay with you if I add the FileKey "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE"? I think the FileKey fits much better in this entry than in the entry [Security and Maintenance *].

1 hour ago, SMalik said:

Have you seen my two posts above with images? I want to delete the images.

Yes, thanks for the screenshots. You can remove them as you like.

Share this post


Link to post
Share on other sites

Revised Entries

Changed the name from [Sound Recorder *] to [Voice Recorder *]

[Voice Recorder *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.WindowsSoundRecorder_*\TempState|*.*|RECURSE


Changed FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady\Cache|*.*|RECURSE with FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady|*.*|RECURSE

[Groove Music *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalCache\PlayReady|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\Database\*|*.log
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageCache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageRetrievalFailure|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\ImageStore|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\navigationHistory|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\LocalState\PlayReady|*.*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.ZuneMusic_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\SearchHistory


Changed FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady\Cache|*.*|RECURSE with FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady|*.*|RECURSE

[Movies & TV *]
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe*
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CLR_v4.0\UsageLogs|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\PRICache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\Temp|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalCache\PlayReady|*.*|RECURSE
FileKey10=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\Database\anonymous|*.log
FileKey11=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageCache|*.*|RECURSE
FileKey12=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageRetrievalFailure|*.*|RECURSE
FileKey13=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\ImageStore|*.*|RECURSE
FileKey14=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\navigationHistory|*.*|RECURSE
FileKey15=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\LocalState\PlayReady|*.*|RECURSE
FileKey16=%LocalAppData%\Packages\Microsoft.ZuneVideo_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneVideo_8wekyb3d8bbwe\SearchHistory\SearchHistory

Share this post


Link to post
Share on other sites

New Entries

[3DViewer *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.Microsoft3DViewer_*\TempState|*.*|RECURSE

[Alarms *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsAlarms_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsAlarms_*\TempState|*.*|RECURSE

[Calculator *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsCalculator_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\AC\Temp|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\LocalCache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\LocalState\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.WindowsCalculator_*\TempState|*.*|RECURSE

[Get Help *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.GetHelp_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\Microsoft\Internet Explorer\DOMStore|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\Temp|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.GetHelp_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.GetHelp_*\LocalCache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.GetHelp_*\LocalState\Cache|*.*|RECURSE
FileKey9=%LocalAppData%\Packages\Microsoft.GetHelp_*\TempState|*.*|RECURSE

[Mixed Reality Portal *]
DetectOS=10.0
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MixedReality.Portal_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\AppCache|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\INet*|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\Microsoft\CryptnetUrlCache\*|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\Temp|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\AC\TokenBroker\Cache|*.*|RECURSE
FileKey6=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\LocalCache|*.*|RECURSE
FileKey7=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\LocalState\Cache|*.*|RECURSE
FileKey8=%LocalAppData%\Packages\Microsoft.MixedReality.Portal_*\TempState|*.*|RECURSE

Share this post


Link to post
Share on other sites
2 hours ago, APMichael said:

Push Notifications belong to Microsoft Store apps. Action Center Notifications are different. We should have this "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE" in [Action Center *] and [Security and Maintenance *] entries. It should not be in the [Push Notifications *] entry.

Share this post


Link to post
Share on other sites
4 hours ago, SMalik said:

Push Notifications belong to Microsoft Store apps. Action Center Notifications are different. We should have this "%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE" in [Action Center *] and [Security and Maintenance *] entries. It should not be in the [Push Notifications *] entry.

As I wrote in one of my last posts the folder is only for the new Windows 10 action center (= notifications and quick actions). The folder does not exist under Windows 7/8 and Security and Maintenance is also just the old Windows 7/8 action center. Therefore, the folder cannot belong to the entries [Action Center *] or [Security and Maintenance *].

BTW in my wpndatabase.db are also traces of common programs (e.g. system image program), so it is not limited to Microsoft Store apps. And missed (push) notifications are stored in the new Windows 10 action center, so notifications and the new Windows 10 action center go together. I don't think a separate Windows 10 action center entry is really necessary.

Edit:
I found the registry key for the new Windows 10 action center: "HKLM\Software\Microsoft\Windows\CurrentVersion\ActionCenter". With this key we could make a separate entry. A suggestion for the name of the entry: [Notifications and Action Center *], because that's what Microsoft calls it in the Group Policy Editor. (And "Action Center" is blocked by the old entry for Windows 7/8.)

Share this post


Link to post
Share on other sites
5 hours ago, APMichael said:

As I wrote in one of my last posts the folder is only for the new Windows 10 action center (= notifications and quick actions). The folder does not exist under Windows 7/8 and Security and Maintenance is also just the old Windows 7/8 action center. Therefore, the folder cannot belong to the entries [Action Center *] or [Security and Maintenance *].

BTW in my wpndatabase.db are also traces of common programs (e.g. system image program), so it is not limited to Microsoft Store apps. And missed (push) notifications are stored in the new Windows 10 action center, so notifications and the new Windows 10 action center go together. I don't think a separate Windows 10 action center entry is really necessary.

Edit:
I found the registry key for the new Windows 10 action center: "HKLM\Software\Microsoft\Windows\CurrentVersion\ActionCenter". With this key we could make a separate entry. A suggestion for the name of the entry: [Notifications and Action Center *], because that's what Microsoft calls it in the Group Policy Editor. (And "Action Center" is blocked by the old entry for Windows 7/8.)

You're wrong on this one. "%LocalAppData%\Microsoft\Windows\ActionCenterCache" has nothing to do with Push Notifications. This should go with [Action Center *] and [Security and Maintenance *] entries.

Open Event Viewer

Go to Applications and Services Logs> Microsoft> Windows> PushNotifications-Platform> Operational, and check the logs.

 

Share this post


Link to post
Share on other sites

Here are my suggestions.

[Notifications *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog

[Push Notifications *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.db;*.db-shm;*.db-wal;*.tmp
FileKey2=%LocalAppData%\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm
RegKey3=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup
RegKey4=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm

Share this post


Link to post
Share on other sites
2 hours ago, SMalik said:

Here are my suggestions.

[Notifications *]
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\ActionCenterCache|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Providers\EventLog
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Providers\EventLog

[Push Notifications *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%LocalAppData%\Microsoft\Windows\Notifications|*.db;*.db-shm;*.db-wal;*.tmp
FileKey2=%LocalAppData%\Microsoft\Windows\Notifications\wpnidm|*.*|RECURSE
RegKey1=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup
RegKey2=HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm
RegKey3=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup
RegKey4=HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\wpnidm

Both of those would show no matter what os is used, is that on purpose?

Share this post


Link to post
Share on other sites
3 hours ago, Nergal said:

Both of those would show no matter what os is used, is that on purpose?

[Notifications *] entry works on all OS.

[Push Notifications *] is for Windows 10 only, other OS don’t need it.

Share this post


Link to post
Share on other sites
13 hours ago, SMalik said:

[Notifications *] entry works on all OS.

[Push Notifications *] is for Windows 10 only, other OS don’t need it.

Oh guess I missed the detect os on the entry, sorry for misreading

Share this post


Link to post
Share on other sites

New Entry

[Delivery Optimization Service *]
DetectOS=10.0|
LangSecRef=3025
Detect=HKCU\Software\Microsoft\Windows
Default=False
FileKey1=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache|*.*|RECURSE
FileKey2=%WinDir%\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs|*.*|RECURSE

 

Share this post


Link to post
Share on other sites

Revised Entry

Added: RegKey1 & RegKey2

[Snip & Sketch *]
DetectOS=10.0|
LangSecRef=3031
Detect=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe
DetectFile=%LocalAppData%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe
Default=False
FileKey1=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\AC\INet*|*.*|RECURSE
FileKey2=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\AC\Temp|*.*|RECURSE
FileKey3=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\LocalCache|*.*|RECURSE
FileKey4=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\LocalState\Cache|*.*|RECURSE
FileKey5=%LocalAppData%\Packages\Microsoft.ScreenSketch_*\TempState|*.*|RECURSE
RegKey1=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\AppSnipAndSketchFileSaveSettings|LastLocation
RegKey2=HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ScreenSketch_8wekyb3d8bbwe\PersistedPickerData\Microsoft.ScreenSketch_8wekyb3d8bbwe!App\DefaultOpenFileSingle|LastLocation

Share this post


Link to post
Share on other sites

Revised Entry

Added: %AppData%\Foxit Software\Foxit PhantomPDF\StartPage\*\Start\en-US|index.html

[Foxit PhantomPDF *]
LangSecRef=3021
Detect1=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0
Detect2=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0
Detect3=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0
Detect4=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0
Default=False
FileKey1=%AppData%\Foxit Software\Foxit PDF Creator\Creator-Log|*.*|RECURSE
FileKey2=%AppData%\Foxit Software\Foxit PhantomPDF\FormFiller|AutoComplete.ds
FileKey3=%AppData%\Foxit Software\Foxit PhantomPDF\StartPage\*\Start\en-US|index.html
FileKey4=%AppData%\Foxit Software\RMS|FXRMS_Log.txt
FileKey5=%LocalAppData%\Foxit PhantomPDF\msilog|*.log
FileKey6=%WinDir%\System32\config\systemprofile\AppData\Roaming\Foxit Software\Foxit PDF Creator|*__foxittemp.xml|RECURSE
RegKey1=HKCU\Software\Foxit Software Company\Foxit PDF Editor|Recent File List
RegKey2=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\Preferences\History
RegKey3=HKCU\Software\Foxit Software\Foxit PhantomPDF 6.0\RecentFiles
RegKey4=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\File MRU
RegKey5=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\MRU\Place MRU
RegKey6=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\plugins\JSPlugins
RegKey7=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Preferences\History
RegKey8=HKCU\Software\Foxit Software\Foxit PhantomPDF 7.0\Recent File List
RegKey9=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\CommentPanel\Filter
RegKey10=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey11=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\File MRU
RegKey12=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\MRU\Place MRU
RegKey13=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\plugins\JSPlugins
RegKey14=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Preferences\History
RegKey15=HKCU\Software\Foxit Software\Foxit PhantomPDF 8.0\Recent File List
RegKey16=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\CommentPanel\Filter
RegKey17=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Foxit PhantomPDF Advanced Editor\Recent File List
RegKey18=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\File MRU
RegKey19=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\MRU\Place MRU
RegKey20=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\plugins\JSPlugins
RegKey21=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Preferences\History
RegKey22=HKCU\Software\Foxit Software\Foxit PhantomPDF 9.0\Recent File List

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×