AAP behavior
About a month ago I changed my computers from legacy boot to UEFI. I created a new backup task and deleted the old task but left the backups. Today I decided that saving all the backups made no sense so I used File Explorer to delete some of the backup chains. I expected AAP to complain but it did not.
Does AAP protect only .tib files associated with existing backup tasks? I could swear that it used to complain when I tried to delete any .tib file on a local drive.
Another point: I don't know if this is usual behavior, but the ATI GUI is slow to recognize that AAP is active. When first displaying AAP status after starting the GUI, it shows as inactive for about 3 seconds. I don't remember that in the past.
I should have checked the obvious. For some reason I have explorer.exe in my "Manage processes" list with "Allow to modify your backups" set. I've deleted it.
I don't remember putting Explorer in the list, but I vaguely remember using it a few months ago to delete old unneeded backups. I expected the "Allow for one hour" option but didn't get it. Maybe whatever option I picked added Explorer to the list permanently. I will test this.
I removed explorer from the list and tried deleting some .tib files. I got the following popup.
Is this regular ATI 2019 behavior? Has the option for a 1 hour exemption been removed or is there some option I've got set wrong? I thought that old 1 hour exemption was too limited - usually far too long but sometimes too short. This "Allow always" or "Deny" choice is worse.
If this is now the standard behavior then I think I have something for the Wishlist.
Patrick, I have to say that I don't remember seeing the old 'Allow for 1 hour' option for some time so not sure if this is still even given? I checked my own permissions list and found that Explorer is shown there but don't recall ever adding it myself and there is no mention of it being added in the list of activity?
Steve Smith wrote:...I don't remember seeing the old 'Allow for 1 hour' option for some time so not sure if this is still even given? ...
I suspect that option was never in ATI 2019. I'm pretty sure it was in ATI 2018, though, and I remember discussing the option with someone (maybe Ian?) in or around the beta test.
Maybe I'm way off base here, but I think it is dangerous to give Explorer blanket permission to delete or modify.tib files. I would like to be able to give myself the option of using Explorer that way but I don't want malware to have that opportunity. Turning off AAP for a while is an obvious solution ... except that I know I will sometime forget to turn it back on.
Patrick,
I believe the behavior you have discovered is a result of the last update to the application. I checked my own install on one of my machines to see if Explorer were a Managed process and I found that it was not listed. I have 5 monitored processes by AAP, they are a graphics driver, and USB driver and a NIC driver. I show a total of 160 processes that are listed in the AAP GUI.
The above tells me that:
- You should not have Explorer in your managed list unless you have taken some action to have it there.
- Monitored processes are those which AAP flagged due to certain behaviors of them.
- Total processes are the number active on this system.
If you look at the AAP GUI screen you will notice 2 new entries:
- Defense from ransomware: Files - Memory - Backups - OS - NAS These five are actively protected by AAP from ransomware known behaviors.
- Defense from illicit cryptomining: CPU - Networks These two are actively protected by AAP from known Cryptomining behaviors.
Although this is rather sparse detail it appears that AAP is working properly. I am confident that it is working as there are times when I have to temporarily turn off AAP for some management tasks although I have changed my behavior in that aspect to one in which I do not use Explorer to manage backups, rather I use the True Image app itself to do so and that works very well for me.
I would recommend that you remove Explorer from the Managed process list (I think you have already) and in fact limit of not eliminate processes from that list. If you have processes that must be there so that conflicts are managed to accommodate everyday computing task then so be it. As for me I choose not to have any managed processes. If I have am app that cannot get along with AAP I am removing or updating that app as it clearly exhibits rogue behavior if I must have it managed.
Enchantech wrote:there are times when I have to temporarily turn off AAP for some management tasks although I have changed my behavior in that aspect to one in which I do not use Explorer to manage backups, rather I use the True Image app itself to do so and that works very well for me.
I'm sure this is true. Some time shortly after installing ATI 2019 I tried using Explorer to delete some old .tib files. I expected the old "Allow for one hour" option and, not seeing it, picked Allow. I didn't occur to me that this would forever allow Explorer to delete .tib files.
Enchantech wrote:there are times when I have to temporarily turn off AAP for some management tasks although I have changed my behavior in that aspect to one in which I do not use Explorer to manage backups, rather I use the True Image app itself to do so and that works very well for me.
As of yesterday, I, too, resort to turning off AAP to do things like deleting .tib files. (I'm in the middle of cleaning up after a Windows upgrade and have a number of obsolete backups.) Using ATI Cleanup works well if the task creating the backup exists but that is not the case for some of the backups I'm deleting.
Turning off AAP is quite a blunt instrument. The old ATI 2018 option to allow for an hour was also a blunt instrument, but it was better than turning off AAP. I think a much better option would be to allow a task to be exempt from AAP control for a user-specified period of time.