FolderRisk: Caution
Web C:\Windows\Web
Images shipped with Windows: wallpapers and default lock screen images; folder protected by TrustedInstaller.
What it’s for
C:\Windows\Web stores the images shipped with Windows: desktop wallpapers and default lock screen images. They show up when the user picks Picture or a theme, or when nothing has been customized. “Windows Spotlight” shows images supplied by Microsoft and does not rely on this folder.
What it contains
Wallpaper: the wallpapers shipped with Windows, grouped by theme.Screen: the default lock screen and sign-in images.4K: high-resolution versions of wallpapers.- Images only (
.jpg,.png), never executables.
Risks and best practices
- The images are owned by TrustedInstaller and Windows may restore them during an update, so there is no point replacing them. For a corporate wallpaper, deploy the image through Group Policy or MDM; for a single machine, use Settings > Personalization.
- An executable or a script in this folder is not normal: investigate it.
Useful commands
# Number of images per subfolderGet-ChildItem "$env:windir\Web" -Recurse -File -ErrorAction SilentlyContinue | Group-Object DirectoryName | Select-Object Count, Name