Skip to contentGo to the directory tree
  1. C:
  2. Windows
  3. System32
FolderRisk: Do not touch

System32 C:\Windows\System32

Core of the system: libraries, drivers, tools and configuration. On 64-bit Windows it holds the 64-bit binaries.

Updated on By AltF4 Formation

What it’s for

The central system folder: DLLs, executables, drivers and administration tools. Microsoft refers to it as FOLDERID_System (%windir%\system32) and states that this directory is reserved for 64-bit applications on 64-bit Windows. 32-bit versions of the DLLs are stored in a different folder, SysWOW64: the WOW64 file system redirector hides this difference from 32-bit applications.

What it contains

  • Libraries (.dll) and executables (cmd.exe, system services; PowerShell lives under WindowsPowerShell).
  • Subfolders: config (registry hives), drivers, DriverStore, winevt (event logs), LogFiles, spool, Tasks, wbem, catroot2, etc.
  • Exempt from redirection to SysWOW64: catroot, catroot2, driverstore, drivers\etc, logfiles and spool.
  • Sysnative: a virtual alias that lets a 32-bit process reach the 64-bit folder; it does not physically exist.

Risks and best practices

  • Despite their names, System32 holds the 64-bit files and SysWOW64 the 32-bit ones. It is the classic mix-up, and it explains why a “missing” DLL is sometimes in the other folder.
  • For a damaged system file, run sfc /scannow and then DISM instead of copying a file by hand: a version that does not match the component does more harm than the damaged file.
  • In a 32-bit script, go through %windir%\Sysnative to reach the 64-bit folder.
  • Third-party software has no business writing here; its place is Program Files.

Useful commands

Fenêtre de terminal
# Subfolders
Get-ChildItem "$env:windir\System32" -Directory | Select-Object Name
# Check system file integrity (as administrator)
sfc /scannow
# Signature of a system binary
Get-AuthenticodeSignature "$env:windir\System32\cmd.exe"

Folder contents

Folders 25

Report a mistake