SCCM - PS - Detection Method for User APPDATA on March 23, 2017 APPDATA APPDATALOCA detection executable execution file HKCU HKLM Key local method policy powershell presence profile registry Roaming SCCM user +