Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. PFRO.log
LogRisk: Caution

PFRO.log C:\Windows\PFRO.log

Log of file operations deferred to reboot (PendingFileRenameOperations): renames and deletions performed at startup.

Updated on By AltF4 Formation

What it’s for

PFRO stands for PendingFileRenameOperations, the registry value that lists files to rename or delete at the next startup. Windows fills it notably through MoveFileEx with MOVEFILE_DELAY_UNTIL_REBOOT when a file is locked. PFRO.log keeps a trace of these deferred operations. It is the first place to look when Windows keeps asking for a restart that never settles.

What it contains

  • The paths of files to delete, rename or replace at restart.
  • A reflection of the installs and updates that had to wait for a restart.

Risks and best practices

  • Do not edit the PendingFileRenameOperations value by hand: system files may be waiting for replacement, and clearing it abandons those operations.
  • The log itself can be deleted with no effect on Windows.
  • A pending restart that comes back after every boot often betrays a stuck installer. Read the registry value, then identify the installation involved.

Useful commands

Fenêtre de terminal
# Pending operations in the registry (source / destination pairs; empty destination = delete)
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager').PendingFileRenameOperations


# Is a restart requested by servicing?
Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'


# Log content (try -Encoding Unicode if the text is unreadable)
Get-Content "$env:windir\PFRO.log" -Tail 50

Format

Text file. If the content looks spaced out or unreadable, reread it as UTF-16 (-Encoding Unicode).

Rotation and archiving

Copy it before restarting if you are investigating a specific operation.

How to read it

Note the paths cited to identify the files involved, then match them with the PendingFileRenameOperations value and the installation that requested the restart (CBS log, Windows Update).

Report a mistake