I have a weird problem where something is changing my path in my login session. The permanent path in the registry is not changing.
I wanted to monitor changes to the explorer.exe process's environment variables using Register-CimIndicationEvent with the Win32_Process CIM object. However, I don't see anything about environment variables there. Is there a property I am missing? Is there another way to get the current environment for another process, and track changes to it?
There is a Win32_Environment class. However, it reads from the registry tags where environment variables are stored. It doesn't read the working variables.