FolderRisk: Do not touch
System32 C:\Windows\System32
Core of the system: libraries, drivers, tools and configuration. On 64-bit Windows it holds the 64-bit binaries.
What it’s for
The central system folder: DLLs, executables, drivers and administration tools. Microsoft refers to it as FOLDERID_System (%windir%\system32) and states that this directory is reserved for 64-bit applications on 64-bit Windows. 32-bit versions of the DLLs are stored in a different folder, SysWOW64: the WOW64 file system redirector hides this difference from 32-bit applications.
What it contains
- Libraries (.dll) and executables (cmd.exe, system services; PowerShell lives under WindowsPowerShell).
- Subfolders: config (registry hives), drivers, DriverStore, winevt (event logs), LogFiles, spool, Tasks, wbem, catroot2, etc.
- Exempt from redirection to SysWOW64: catroot, catroot2, driverstore, drivers\etc, logfiles and spool.
- Sysnative: a virtual alias that lets a 32-bit process reach the 64-bit folder; it does not physically exist.
Risks and best practices
- Despite their names,
System32holds the 64-bit files andSysWOW64the 32-bit ones. It is the classic mix-up, and it explains why a “missing” DLL is sometimes in the other folder. - For a damaged system file, run
sfc /scannowand then DISM instead of copying a file by hand: a version that does not match the component does more harm than the damaged file. - In a 32-bit script, go through
%windir%\Sysnativeto reach the 64-bit folder. - Third-party software has no business writing here; its place is
Program Files.
Useful commands
# SubfoldersGet-ChildItem "$env:windir\System32" -Directory | Select-Object Name
# Check system file integrity (as administrator)sfc /scannow
# Signature of a system binaryGet-AuthenticodeSignature "$env:windir\System32\cmd.exe"Folder contents
Folders 25
- catrootSecurity catalogs (.cat) for signed Windows components and drivers, used to verify file…
- catroot2Signature catalog database used by Cryptographic Services; resettable as a last resort…
- CodeIntegrityC:\Windows\System32\CodeIntegrity: applied App Control (WDAC) policies (SiPolicy.p7b…
- configRegistry hives (SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT) and their .LOG and .sav files…
- dhcpDHCP Server role folder: lease database, automatic backups and audit logs of the Windows…
- dnsDNS Server role folder: zone files (.dns), root hints and exports for zones stored in…
- driversKernel-mode drivers (.sys) loaded by Windows, and the etc subfolder (hosts file). Not to…
- DriverStoreWindows driver store: a trusted collection of inbox and third-party driver packages…
- GroupPolicyC:\Windows\System32\GroupPolicy: the computer's local Group Policy Object (LGPO), edited…
- GroupPolicyUsersMultiple local Group Policy objects (MLGPO): user configuration settings for a group or a…
- icsxmlC:\Windows\System32\icsxml: XML description files of the UPnP device and its services…
- inetsrvinetsrv: IIS programs and configuration (w3wp.exe, appcmd.exe, inetmgr.exe, config…
- LogFilesFolder of Windows component logs: Firewall (pfirewall.log), Srt (SrtTrail.txt), HTTPERR…
- MicrosoftCryptography data of the System account: Crypto and Protect subfolders (DPAPI master…
- oobeFiles of the Windows out-of-box experience (OOBE): initial setup screens and OEM…
- rasC:\Windows\System32\ras: Remote Access Service (RAS/RRAS) components. VPN connections…
- RecoveryInitial location of the Windows Recovery Environment image (winre.wim), later copied to…
- restoreSystem Restore configuration files (monitored file list); restore points are stored…
- spoolPrint spooler folder: spool files of pending jobs (PRINTERS), drivers, and print…
- sruC:\Windows\System32\sru: the SRUDB.dat database of the System Resource Usage Monitor…
- SysprepSystem Preparation tool (Sysprep) folder: sysprep.exe, Panther logs and tracking files…
- TasksC:\Windows\System32\Tasks: XML definitions of Task Scheduler tasks, extensionless, one…
- wbemWMI (Windows Management Instrumentation) folder: tools, providers, MOF files and the WMI…
- WindowsPowerShell\v1.0Windows PowerShell 5.1 installation folder ($PSHOME): powershell.exe, powershell_ise.exe…
- winevtC:\Windows\System32\winevt: container folder of the Windows Event Log service. The .evtx…
Files 10
- csrss.exeClient/Server Runtime Subsystem: user-mode part of the Windows subsystem (processes…
- hal.dllWindows Hardware Abstraction Layer (HAL): isolates the kernel and drivers from hardware…
- lsass.exelsass.exe: the Local Security Authority Subsystem Service, which authenticates users…
- ntoskrnl.exeWindows kernel (NT OS Kernel): memory manager, scheduler, I/O and security. Protected…
- services.exeService Control Manager (SCM): starts, stops and supervises Windows services and drivers.
- smss.exesmss.exe: the Session Manager Subsystem, the first user-mode process. It creates sessions…
- svchost.exeGeneric host process for Windows services implemented as DLLs; several instances run…
- wininit.exeWindows Start-Up Application: started by smss.exe in session 0, it launches services.exe…
- winload.efiWindows OS loader in UEFI mode (winload.exe on legacy BIOS): loads the kernel, HAL…
- winlogon.exeInteractive logon process: handles the secure attention sequence, loads the profile and…