Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. drivers
FolderRisk: Do not touch

drivers C:\Windows\System32\drivers

Kernel-mode drivers (.sys) loaded by Windows, and the etc subfolder (hosts file). Not to be modified by hand.

Updated on By AltF4 Formation

What it’s for

System32\drivers holds the .sys binaries of kernel-mode drivers. A driver is first stored in full in the Driver Store (see DriverStore\FileRepository), then its binary is copied here at install time, since the DestinationDirs directive of its INF points to this folder with code 12. The etc subfolder holds hosts, services, protocol and networks; each has its own page.

What it contains

  • .sys files: storage, network, file system, firewall and security drivers (tcpip.sys, ntfs.sys, disk.sys and so on).
  • Third-party drivers deployed by vendors (antivirus, virtualization, devices).
  • The etc subfolder, which 64-bit Windows exempts from WOW64 redirection to SysWOW64: a 32-bit program sees the same files there.

Risks and best practices

  • Do not delete or replace a .sys by hand: a missing critical driver causes a blue screen at boot. Use pnputil or Device Manager, which handle the whole package.
  • 64-bit Windows rejects unsigned drivers. Check the signature before any deployment.
  • An unknown or very recent driver deserves a look: it runs with kernel privileges.

Useful commands

Fenêtre de terminal
# Recently added or modified drivers
Get-ChildItem "$env:windir\System32\drivers" -Filter *.sys | Sort-Object LastWriteTime -Descending | Select-Object -First 20 Name, LastWriteTime


# Signature of a driver
Get-AuthenticodeSignature "$env:windir\System32\drivers\tcpip.sys" | Select-Object Status, SignerCertificate


# Loaded drivers and their signing state
driverquery /si

Folder contents

Folders 1

Report a mistake