We were having random TMP files being created in network shared directories that contained Excel files accessed by our users. These files had randomly generated names and consisted of numbers and letters and did not exceed 8 characters total in most cases. Adding %windir%\CSC to the resident shield exclusions through ADNM prevented further creation of these TMP files. Thanks so much for the tip Vlk!