IFileOperation::DeleteItem doesn't work in system directory .Local

Question

I trying to delete not empty folder sysprep.exe.Local from C:\\Windows\\System32\\sysprep . First, I try remove only root test directory:

...
res = SHCreateItemFromParsingName("C:\\Windows\\System32\\sysprep\\sysprep.exe.Local", NULL, IID_ShellItem, &isrc);
if (res != 0) printf("Error: %#X\n", res);
res = fileOp.lpVtbl.DeleteItem(fileOp, isrc, NULL);
if (res != 0) printf("Error: %#X\n", res);
res = fileOp.lpVtbl.PerformOperations(fileOp);
if (res != 0) printf("Error: %#X\n", res);
...

Later, I try remove all files in test folder, then remove sysprep.exe.Local folder itself.

Every time, I run my programm - I have res == 0 . No errors, but files and folder are in the same place. When I try to remove not empty C:\\Windows\\System32\\sysprep\\test directory - it was successfully disappeared.

Firstly, I think, files and folders will be removed after reboot - nope.

Why this happens?

Answer 1

System32 , as the name indicates, is a system directory which holds critical files. It's protected against inadvertent file removal. Do not create files there, either.

Exceptions to this rule might be found in MSDN for special cases, but then the specific functions to use will be clear from context. Eg driver installation will create files there, but you still don't call CreateFile to do so.

[edit]

Now that you've identified that you're not just trying to remove files from System32, but actual parts of the Operating System, this confirms the suspicion.

If you rightclick on SysPrep.EXE , you will see it's owned by TrustedInstaller . This identifies it as a protected file which is managed by Windows Update. Not only will you fail to delete it, your attempts will probably set off every decent anti-virus program.