Vince

This is the log entry that is repeated in keybase.kbfs.log until I manually end the process: 2017-05-29T08:18:09.852458-06:00 - [ERRO kbfs fs.go:266] 322f7 Refusing access: SID match error It then seems...

AV is definitely running as a different user, Kaspersky tends to make a new user KAV_????? to give it self local admin, nothing I can do to change that, corporate...

Currently, message traces are being truncated because of this change to only a partial subset. I suspect the warning is breaking the data capture.

This is the same issue as #106 Easiest way to get around it is run `Disconnect-MgGraph` after you have completed the tenant investigation