I think you may be in UAC hell? When users and admins see different files in given locations, that's usually where you are. Look up UAC File and Registry Virtualization - it can interfere with modifying files in certain protected locations, with result being that different users will see different files in those locations. I haven't looked down the rabbit hole in Win10 with Arduino - I haven't had that problem.
It may well be that some other thing that happened on your system resulted in the strange state of affairs. It wouldn't surprise me if someone or something got the bright idea to try to get rid of cmd.exe (either security software trying to keep users from breaking their computer, or malware trying to make it harder for users to fix their computer)
It's certainly not a problem I've seen go by on these forums before - it sounds to me like a system issue, not something specific to arduino.