---
name: reference_trebesch_qnp3on5
description: AT Trebesch's DESKTOP-QNP3ON5 runs an Explorer shell replacement — detect the logged-on user via Win32_ComputerSystem.UserName, not explorer.exe
metadata:
  type: reference
---

DESKTOP-QNP3ON5 (Syncro customer 238740, GuruRMM client "AT Trebesch", agent ba173f0c-19e8-488d-834c-1b6f6dfd5699, user = `Owner`) **runs a third-party Explorer shell replacement** instead of explorer.exe.

Consequence: `Get-CimInstance Win32_Process -Filter "Name='explorer.exe'"` returns nothing, so the common "logged-on user = explorer.exe owner" check yields **blank** on this box. Confirm the session instead with `(Get-CimInstance Win32_ComputerSystem).UserName` (returned `DESKTOP-QNP3ON5\Owner`). Outlook COM in `context=user_session` works fine here despite the shell swap.

GuruRMM site: code SWIFT-LION-2892, key vaulted at `clients/attrebesch/gururmm-site-main.sops.yaml`. See [[project_trebesch_pst_consolidation]].