In my previous post I have provided a long list of paths Windows Defender is trying to access when the Windows Server 2022 starts. Since the Windows Server 2025 is now available, I thought it would be interesting to repeat the exercise and provide a very similar list for the latest version of the server. Surprisingly, the log file is waaaay longer now. See it for yourself.
Beyond good ol’ Run key, Part 146
I did consider writing about:
C:\Windows\System32\WptsExtensions.dll
but this phantom DLL has been documented all over the place, so let’s look at a different one:
C:\Windows\System32\XboxNetApiSvcExtHost.dll
It’s loaded by svchost.exe on Windows 11 24H2 and Windows Server 2022.