Ehh why did outlook.exe try to execute mtail.exe?

In ePO I have created an automatic response to send an email to me of every blocked execution. So I was scrolling through my email, which always contain some of those responses. Most of them are driver updates which seem to appear because of windows update, still figuring this out, but now I noticed the execution denial for mtail.exe.

Mtail.exe is a freeware tool to open a .log file and monitor it at realtime. I use it every now and than for troubleshooting, but never installed it on my laptop.

This was the body of the email:

Event: execution_denied
File (Full Path): \\server\c$\users\erik\desktop\mtail.exe
Program (Full Path): C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
Registry Key:
System Name: LAPTOP
User: DOMAIN\Erik

So basically Application Control on my laptop blocked outlook.exe from executing mtail.exe somewhere on a server?!?!? Looks scary!

I remember I have attached something from my desktop which was stored on that server, so that I have opened that particular location from outlook is true, but i certainly did not run mtail.exe at that point. That is: not deliberately :)

I just tried to reproduce the execution and it does not occur when I try to add mtail.exe as an attachment to an email (neither by drag&dropping nor by inserting it through outlook toolbar). It really only gets blocked this way when I click to attach a file in outlook, than browse to that directory and than richt-click mtail.exe and choose to open instead of select. That obviously is not something I think I could have done accidently, so this behaviour still is pretty peculiar: still don't have an explanation to it... If you do: please reply :)

If any such events reoccurs i'll let you know!

Trusted Users

It appeared to me I earlier misunderstood the Trusted User policy option. I thought it allowed certain users to install new applications or run unknown executables, but it does not.

Instead, a Trusted User is allowed to unlock the CLI and enable the update mode, without having to type a password.

The command:
CLI > sadmin recover

Is to unlock Solidcore. Afterwards the update mode can be initiated by "sadmin bu" (shortcut for begin-update). "sadmin recover" prompts for a password that can be set in ePO. The password prompt is thus disabled for trusted users, so they can do "sadmin bu" at any time.