I need assistance with a lockup stumper Sage 100 Standard 6.10 PU 3

So my team and I find ourselves faced with a recurring issue that has so far escaped our attempt to defeat it.

Environment is domain network, Windows Server 2016 (hyper V) Windows 10 workstations. Up do date with MS updates. Webroot with roper configuration per Sage document.

Symptom 1: One machine will lockup the entire application for ALL users.

1.Can occur during attempt to open just about any of your typically daily use 

2. Locks files and does not release them, the result is available in computer management on the server if you look at the open files on the share.

3. Once it occurs no other user can function.

4. Does not occur when same user id is used on a different machine.

5. If machine is not used for a day, the problem does not occur. (see attempted resolution for customer feedback on our suggestions)

6. Time of day is not relevant

7. Number of users in the system is not relevant

Symptom 2: The remote desktop user

1. One user loges in after hours to their machine via RDP

2. They have no issues during the day when in from of that PC.

3. No one else is in the system.

4. Same exact behavior as the problem machine during the day.

Attempted resolution

1. a brand new hyper V was spun up and the Sage 100 system reinstalled from scratch and migrated, no joy.

2. As we didn't realize that Webroot is now OK for Sage 100, we wanted it removed to try to see if that resolved the issue. They did not believe us so we conferenced them with Sage support to be told Webroot is JUST fine if it's configured based on article support sent us. According to IT, that's been done, but they refuse us access to the Webroot console to show us to be certain so we have no way other than their word that this is the case.(lack of seeing is believing, I can't be certain its configures as it should be. 3rd party IT knows everything because they have another customer runs Sage 100 Contractor and won't accept that 1 customer makes no one an expert AND it's not the same product.)

3. The problem computer was found to have FOUR virus packages including Webroot. They were all uninstalled, no joy.

4. Customer will not let go of idea that it "must be Sage" because it only happens in Sage. I feel reinstalling the application from scratch crossed this off the list. Difference of opinion.

Current thoughts (limited ability to do more than suggest as IT is not willing to entertain anything other than the application

1. UAC, DEP or some other invasive permission item is windows

2. Windows roaming profile problem

3. Heuristic or aggressive behavior of some kind of security software.

4. The remote late night user if my fly on the ointment. There problem should occur physically using the  machine as well.

All thoughts and suggestions are welcome. I feel like I am at a mental impasse.

Thanks!

Chris Fix