I have hard links into system files advapi32.dll, kernel32.dll and etc.

I have used MoveFileEx API for deletion with MOVEFILE_DELAY_UNTIL_REBOOT, it basically uses HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager::PendingFileRenameOperations registry to delete during reboot. I have also included AllowProtectedRenames hack.

Without AllowProtectedRenames there have been many failures, but with this set, there are still a few files (hard links) that cannot be removed in Windows 10.

I wonder if there is any way to get rid of such links without loading external OS, as this issue is in multiple machines.

  • Why would you actually remove those? Where are those links? Especially both files you mentioned are pretty important for the system to actually run? – Seth Dec 20 '17 at 10:11
  • @Seth there is poorly made tool which have generated bunch of garbage in multiple machines. So I want to do cleanup. – ST3 Dec 20 '17 at 11:43
  • If it's additional stuff you should be able to easily remove it by reversing the steps from that tool. As an example if you do have the hard link in a directory with an application stop that application first. The application directory is usually one of the first directories that dependencies such as DLLs are searched for. What is the actual error message you're seeing? Using a backup would probably be the easiest option. – Seth Dec 20 '17 at 12:26

I have checked entire list of files that are in problem, so noticed that the problem with deletion is only with KnownDlls. So I have added all files into ExcludeFromKnowDlls list. This way OS doesn't lock them and on reboot deletion succeeds. This, however, requires additional reboot to restore original (empty) value of ExcludeFromKnowDlls.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.