16-bit %temp% points to %systemroot%temp

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I'm trying to restrict execute access on XP wherever a limited user has
write access to, including the temporary folders.

For 32-bit apps, %temp% points to %userprofile%\locals~1\temp (in short
filename mode too) and any apps creating temporary files store them here.
For 16-bit apps, for some reason, this points to %systemroot%\temp. This
breaks such things as printing from Internet Explorer when launched from a
16-it app.

To demonstrate, launch cmd.exe and type SET. Then launch command.com and
type SET and compare the two results.

Windows 2000 since Service Pack 3 behaved like this, too, until I applied a
patch described in KB840214, which normally applies to Win2K Terminal Server
but also applies to Win2K Pro. After applying KB840214, %temp% points to
the same place for 16-bit and 32-bit apps.

Is there a similar patch available for Windows XP? The MSKB returned no
results.

I've tried editing autoexec.nt and config.nt - %temp% gets overridden by the
operating system settings.

--
PGP key (0x0AFA039E): <http://www.pan-am.ca/consulting@pan-am.ca.asc>
Sometimes it's hard to tell where the game ends and where reality bites,
er, begins. <http://vmyths.com/resource.cfm?id=50&page=1>