ForensicArtifacts/artifacts

Change definitions to use allusersappdata to programdata

joachimmetz opened this issue · 1 comments

  • Change definitions to use %%environ_allusersappdata%% to %%environ_programdata%%
  • define environ_programdata fallback as %%environ_allusersprofile%%\Application Data, alternatively %ALLUSERSPROFILE%

https://docs.microsoft.com/en-us/windows/deployment/usmt/usmt-recognized-environment-variables

Changes to validator to support %%environ_programdata%% eece9c1