IksSafonsky, вот это в первую очередь нужно проверять:
"Time of Day","Process Name","PID","Operation","Path","Result","Duration","Detail"
"13:27:32,4682299","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000072","Desired Access: Read/Write"
"13:27:32,4879693","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\SQMClient","ACCESS DENIED","0.0000084","Desired Access: Read/Write"
"13:27:32,4880695","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Common\ProductVersion","ACCESS DENIED","0.0000085","Desired Access: Read/Write"
"13:27:32,4881903","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Common\LanguageResources","ACCESS DENIED","0.0000042","Desired Access: Read/Write"
"13:27:32,4944699","VISIO.EXE","3028","RegOpenKey","HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\LanguageResources\InstalledUIs","ACCESS DENIED","0.0000047","Desired Access: Read/Write"
"13:27:32,4949772","VISIO.EXE","3028","RegOpenKey","HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\LanguageResources\InstalledUIs","ACCESS DENIED","0.0000036","Desired Access: Read/Write"
"13:27:32,5988177","VISIO.EXE","3028","RegOpenKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer","ACCESS DENIED","0.0000061","Desired Access: Read/Write"
"13:27:32,6001503","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\IdentityCRL","ACCESS DENIED","0.0000095","Desired Access: Read/Write"
"13:27:32,6061530","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Common\UICaptions\InstalledLanguages","ACCESS DENIED","0.0000151","Desired Access: Read/Write"
"13:27:32,6063036","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Common\UICaptions","ACCESS DENIED","0.0000043","Desired Access: Read/Write"
"13:27:32,6516361","VISIO.EXE","3028","RegOpenKey","HKLM\System\CurrentControlSet\Services\WinSock2\Parameters","ACCESS DENIED","0.0000050","Desired Access: All Access"
"13:27:32,6695510","VISIO.EXE","3028","RegOpenKey","HKLM\System\CurrentControlSet\Services\WinSock2\Parameters","ACCESS DENIED","0.0000077","Desired Access: All Access"
"13:27:32,6727671","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\Visio","ACCESS DENIED","0.0000114","Desired Access: Read/Write"
"13:27:32,6735372","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Windows Messaging Subsystem","ACCESS DENIED","0.0000084","Desired Access: Read/Write"
"13:27:32,7221546","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Common","ACCESS DENIED","0.0000081","Desired Access: Read/Write"
"13:27:32,7792526","VISIO.EXE","3028","RegOpenKey","HKLM\SOFTWARE\Clients\Mail","ACCESS DENIED","0.0000107","Desired Access: Read/Write"
"13:27:33,3504572","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Visio\Addins","ACCESS DENIED","0.0000126","Desired Access: Read/Write"
"13:27:33,3505276","VISIO.EXE","3028","RegOpenKey","HKLM\SOFTWARE\WOW6432Node\Microsoft\Visio\Addins\PDFMVisio.PDFMVisioCOMAddin","ACCESS DENIED","0.0000045","Desired Access: Read/Write"
"13:27:33,9375025","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\BLOCK_M.VSSX","ACCESS DENIED","0.0000670","Desired Access: Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: None, AllocationSize: n/a"
"13:27:34,7801104","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\BLOCK_M.VSSX","ACCESS DENIED","0.0000548","Desired Access: Generic Read/Write, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: Read, AllocationSize: n/a"
"13:27:34,7810779","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\BLOCK_M.VSSX","ACCESS DENIED","0.0000577","Desired Access: Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: None, AllocationSize: n/a"
"13:27:35,0505955","VISIO.EXE","3028","RegOpenKey","HKCR\WOW6432Node\CLSID\{937C1A34-151D-4610-9CA6-A8CC9BDB5D83}","ACCESS DENIED","0.0000431","Desired Access: Read/Write"
"13:27:35,0994995","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\Theme_m.vssx","ACCESS DENIED","0.0000629","Desired Access: Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: None, AllocationSize: n/a"
"13:27:35,2118795","VISIO.EXE","3028","RegOpenKey","HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\Common\InstallRoot","ACCESS DENIED","0.0000119","Desired Access: Read/Write"
"13:27:35,8233031","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000048","Desired Access: Read/Write"
"13:27:35,8265885","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000064","Desired Access: Read/Write"
"13:27:35,8441895","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000079","Desired Access: Read/Write"
"13:27:35,8445265","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000047","Desired Access: Read/Write"
"13:27:35,8446829","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000038","Desired Access: Read/Write"
"13:27:35,8452852","VISIO.EXE","3028","RegOpenKey","HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration","ACCESS DENIED","0.0000038","Desired Access: Read/Write"
"13:27:36,6290248","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\Theme_m.vssx","ACCESS DENIED","0.0000575","Desired Access: Generic Read/Write, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: Read, AllocationSize: n/a"
"13:27:36,6301409","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\Theme_m.vssx","ACCESS DENIED","0.0001308","Desired Access: Generic Write, Read Attributes, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: N, ShareMode: None, AllocationSize: n/a"
"13:27:52,4087381","VISIO.EXE","3028","IRP_MJ_CREATE","C:\Program Files (x86)\Microsoft Office\Office15\Visio Content\1049\BLOCK_M.VSSX","ACCESS DENIED","0.0000644","Desired Access: Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
Начните с ветки реестра:
HKLM\Software\WOW6432Node\Microsoft\Office\15.0\Registration
какие там права?
vBulletin v3.6.4, Copyright ©2000-2025, Jelsoft Enterprises Ltd.
Available in ZeroNet 1osznRoVratMCN3bFoFpR2pSV5c9z6sTC