Windows Temporary Folder Path Changes for SYSTEM Account

Overview

Microsoft has recently (Feb 2026) introduced security improvements that change the default temporary folder location for services and applications running under the SYSTEM account. This is a Windows operating system change and is not related to any changes in our product.

What Changed?

Microsoft introduced a new secure temporary folder location called C:\Windows\SystemTemp specifically for processes running as the SYSTEM account. This folder has stricter security permissions to prevent path redirection attacks.

Previous Behavior

  • SYSTEM account temp folder: C:\Windows\Temp

New Behavior

  • SYSTEM account temp folder: C:\Windows\SystemTemp

Note: This change only affects applications running as the SYSTEM account. Applications running under user accounts are not affected and will continue to use their existing temp folder locations.

What You Might Observe

If your environment is affected, you may notice:

  • Temporary files being created in C:\Windows\SystemTemp instead of C:\Windows\Temp
  • Applications that hardcode the path to C:\Windows\Temp may not find expected temporary files
  • Increased disk usage in the C:\Windows\SystemTemp directory

For example, the temporary folder for Nginx now will be in C:\Windows\SystemTemp\ometascan\

Impact on MetaDefender Core

Currently, there is no known impact on MetaDefender Core services. However, if you experience any issues related to this Windows change, please contact OPSWAT Support for assistance.

Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Next to read:
How to Create Support Package With Web Console
On This Page
Windows Temporary Folder Path Changes for SYSTEM AccountOverviewWhat Changed?Previous BehaviorNew BehaviorWhat You Might ObserveImpact on MetaDefender Core