I have an executable file in my system32 that I want to remove on startup using a service that I have written.

The service that's attempting the deletion is running under Local System account. The Executable file the service is trying to delete has "Full control" permissions assigned to SYSTEM and Administrators yet the service still fails to delete the file. I should add that the executable isn't running at the time the service trys to delete it. I have also tried to run the service under local service and network service accounts with the same problem.

Any suggestions advice as to what I may be doing wrong or things I can try would be very much appreciated.

I should add that I am able to delete the executable using windows explorer without running it as administrator.

when I run a batchfile as administrator to delete the executable , it deletes successfully but it does have to be run as administrator or I get access denied error.

  • 1
    Just because you are running a process or service as those users does not mean you don't have to escalate the permission in order to do a protected action. – Ramhound Sep 27 '13 at 14:31
  • if your service is running and you look at it in Process Explorer, is it running as a High Integriy process? – Frank Thomas Sep 27 '13 at 15:16
  • @FrankThomas I've looked at the process through process explorer and the integrity column is blank for my service. – Rich Sep 27 '13 at 16:08
  • @FrankThomas Seeing that I can delete the file with explorer which is running as medium integrity maybe I should be looking into how to set the integrity level of my service to medium as well. – Rich Sep 27 '13 at 16:28
  • Go to File and select "Show processes for all users". that should fill in the integrity column for service processes. – Frank Thomas Sep 27 '13 at 16:29

If it's a Windows file you are aiming to delete, then the System File Protection may be stopping you.

It's there to prevent things from accidentally or maliciously deleting or overwriting Windows files in places like the System32 folder.

More info from Wikipedia: Windows File Protection


You will have to take ownership of that folder by going to Properties\security\advanced (on the bottom). I have deleted any files in system 32 folder by doing this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.