FolderRisk: Caution
- Legacy from XP
System C:\Windows\System
Folder inherited from Windows 3.x/9x for 16-bit applications; nearly empty, kept for compatibility.
What it’s for
C:\Windows\System dates back to the 16-bit versions of Windows, where the system libraries lived. It remains so that older applications that look for their files in System rather than System32 find a valid path. Current Windows uses System32, and SysWOW64 for 32-bit code on 64-bit Windows, which no longer runs 16-bit applications at all.
What it contains
- Very few files, possibly none.
- No current system component: everything is in
System32andSysWOW64.
Risks and best practices
- Leave it alone: it is part of the standard tree and legacy programs may query it. Cleaning it frees nothing.
- To “fix” an application with a DLL, do not drop it here: put it in the application folder or use the compatibility settings.
- A recent or unexpected executable here is suspicious. Few tools watch this folder, so it can hide code: check its signature.
Useful commands
# Signature of any executables and librariesGet-ChildItem "$env:windir\System" -Include *.exe, *.dll -Recurse -Force -ErrorAction SilentlyContinue | Get-AuthenticodeSignature | Select-Object Path, Status