"every since I ran the .22 update" my Carbon Black endpoint logs an alert that diskpart.txt was ran on my on-premise Kaseya server at about 9pm every night. The file runs from c:\windows\system32\temp. No diskpart.* exists on the machine, except for the diskpart.exe where it belongs, but nothing in the temp dir. I've checked scheduled tasks on the server, in the registry, and event view without any luck.
I can only assume it's a task run by Kaseya that deletes after it runs?
Anyone have any insight on how I can delete this procedure from running?