Hi,
I may be missing something important but cann't we directly use Scan-Directories.ps1 to factorise parent folder which are not user-writable in all sub-folders?
In this particular case it's better to add C:\Apps* in GetSafePathsToAllow.ps1 instead of adding all sub-folders that contains binaries even if C:\Apps\ doesn't have any binary.
Because for the moment, we need to use Support\Enum-WritableDirs.ps1 to verify if the NonDefaultDir is totally safe.
Many thanks.