The Windows Path Macros in App Control will be expanded by the Agent according to either the CSIDL or KNOWNFOLDERID depending on the version of Windows the Agent is installed on.
It is important to verify the Macro being used will expand correctly based on the operating system in use on the endpoint, as the Known Folder ID could expand differently than the CSIDL would. As an example:
Example: <CommonAppData>\Acme Accounting\*.dll
• FOLDERID_ProgramData: C:\ProgramData\Acme Accounting\*.dll
• CSIDL_COMMON_APPDATA: C:\Documents and Settings\All Users\Application Data\Acme Accounting\*.dll
Example: <LocalAppData>\Acme Accounting\temp\*.log
• FOLDERID_LocalAppData: C:\Users\<UserName>\AppData\Local\Acme Accounting\temp\*.log
• CSIDL_LOCAL_APPDATA: C:\Documents and Settings\<UserName>\Local Settings\Application Data\Acme Account\temp\*.log