FolderRisk: Do not touch
SysWOW64 C:\Windows\SysWOW64
32-bit libraries and tools on 64-bit Windows (WOW64); target of the System32 redirection for 32-bit processes.
What it’s for
On 64-bit Windows, the %windir%\System32 folder is reserved for 64-bit applications. Most DLL names did not change with the 64-bit versions, so the 32-bit versions are stored in another folder: SysWOW64. WOW64, the x86 emulator built into the system, hides this difference with a file system redirector: when a 32-bit process accesses %windir%\System32, the access is redirected to %windir%\SysWOW64.
What it contains
- The system’s 32-bit libraries (DLLs) and tools, with the same names as their 64-bit equivalents in System32.
- 32-bit executables such as a version of regedit.exe: access to %windir%\regedit.exe is redirected to %windir%\SysWOW64\regedit.exe.
- Some System32 subfolders are not redirected: catroot, catroot2, driverstore, drivers\etc, logfiles and spool.
Risks and best practices
- 32-bit applications stop starting if you delete, replace or add files here.
- A 32-bit application that needs the real System32 uses the %windir%\Sysnative path; it is not a real folder.
- In code, do not hard-code these paths: call GetSystemWow64Directory to get the 32-bit system directory.
- For
regedit.exe, if UAC shows a prompt, redirection does not occur and the 64-bit version of the file is launched. - Keep this folder in the scope of antivirus scans and security reviews, since malicious DLLs imitate system names.
Useful commands
# 64-bit OS and process?[Environment]::Is64BitOperatingSystem[Environment]::Is64BitProcess
# Same-name files in both folders (read-only)Get-Item "$env:windir\System32\notepad.exe", "$env:windir\SysWOW64\notepad.exe" -ErrorAction SilentlyContinue | Select-Object FullName, Length, VersionInfo:: From a 32-bit cmd, %windir%\Sysnative reaches the 64-bit System32dir %windir%\Sysnative\cmd.exe