Jan,

Thanks for the reply.

Yes it was.   After a call to TAC, I used the wizard from the event log and set the application as trusted.

I do not want to do these sort of exceptions heavy handedly, however their council on the matter was that this was a part of windows that was likely updated during a recent windows update.

As a relative newbie to CSA, and advice/suggestions you can offer would be greatly appreciated.

Thanks again.

Windows update directly from the internet ? that's not really good, you should get an internal wsus server or other deployment system, this will enable you to define that deployment tool as a trusted installer, and the files it updates/installs/modifies will not be untrusted, and you won't get popups.

With regular windows update, it's a little tricky, but you should look into the process called wuauclt.exe, if you add that to the trusted apps list, you have a quick way of avoiding some problems, but really you should create some new dummy group and add the "log set actions" option, and then enroll one or a few agents with that group also, this will give you the much more logs that tells you which application was added to which dynamic application class (including untrusted applications) and why, which is a good place to start for understanding how to eliminate many false positives with very rules.