I once had a fresh installation of Win7 on an SSD drive. Bearing in mind what you always hear about write cycles on these things, first thing I did was changing the TEMP/TMP variables of SYSTEM and my user to a second drive, which path would be D:\Temp_Win (folder name due to some dodgy installers and programs like to mess with TEMP directories in root folders).
My userprofile is a member of the administrators-group and UAC is turned off. There are also no firewall(s) or anti-virii/adware applications installed.
This worked fine up to SOME point in time which I cannot pinpoint. I just recently noticed that the USER variable of TEMP and TMP don't point anymore to the folder I had set, because I went to change my path variable and saw it.
Now if I try to change back TMP and TEMP set for the user (no matter if I use the corresponding sys config panel or by editing the registry-path HKCU/Environment/TMP & TEMP), Win7 (or SOMETHING) keeps resetting both back to %USERPROFILE%\AppData\Local\Temp
I CAN change the value, and its starting to be used as long as I don't log off because I see files popping up in my custom directory. So it doesn't seem to be a permission issue in the registry. I can also kill the explorer.exe and restart it via taskmanager, and my custom temp folder is still in use. But as soon if I restart or log off and back on, the user-variables are back to %USERPROFILE%\AppData\Local\Temp just as if something is writing this back.
Changing the temp path and immediately (re-)booting into safe-mode with the exact same user does NOT reset the temp values so it seems like its something I installed on the profile.
Note that the affected system has no network connection at all, and a malware-check with live-cds from Avira and Sophos have found that machine to be clean.
Is there something that could help tracing this down to either the system or to some installed application?
~~~~~~ I saw this question TEMP environment variable occasionally set incorrectly but it doesn't seem to be related to my problem. Doctor google turns up nothing about the above described behaviour.