- C:
- Windows
FolderRisk: Do not touch
Windows C:\Windows
Operating system folder (%windir% and %SystemRoot% variables): system files, drivers, logs and components.
What it’s for
C:\Windows is the operating system’s installation folder. The %windir% and %SystemRoot% variables and the known folder ID FOLDERID_Windows all point to it. Scripts and applications should use them instead of a hard-coded path, because the drive letter can vary.
What it contains
System32: programs, 64-bit libraries, drivers and system configuration.SysWOW64holds their 32-bit equivalents on 64-bit Windows.WinSxS(component store),servicingandassembly: components and updates.Logs,Temp,Prefetch,Fonts,Inf,Web,Bootand other folders covered in their own pages.- Executables at the root, such as
regedit.exeornotepad.exe. For a 32-bit process, the file system redirector sends%windir%\regedit.exeto the 32-bit version. Windows.old, left at the drive root after an upgrade, is a separate folder holding the previous installation.
Risks and best practices
- Deleting, moving or renaming anything here by hand can make Windows unusable. To free space, use Disk Cleanup, the storage settings or DISM.
- To repair system files, run DISM and then
sfc /scannow, in that order. - The default permissions (TrustedInstaller, SYSTEM) protect the files. Do not change them to get around an access error.
- An unexpected executable at the root or in a rarely monitored folder deserves a closer look.
Useful commands
# Windows folder path and first level (read-only)$env:windirGet-ChildItem $env:windir -Force | Select-Object Name, Mode, LastWriteTime:: As administrator: verify system file integrity (makes no repair)sfc /verifyonly
:: As administrator: repair the system image before sfc /scannowDISM.exe /Online /Cleanup-image /RestorehealthFolder contents
Folders 34
- AppPatchApplication compatibility databases (.sdb files) and fix libraries (shims) used by…
- assemblyC:\Windows\assembly: the legacy Global Assembly Cache (GAC) of .NET Framework 1.x to 3.5…
- BootReference copies of the Windows boot files (BIOS and UEFI), used to create or repair the…
- CSCClient-side caching (CSC) store: local copies of offline files synchronized with network…
- CursorsC:\Windows\Cursors: mouse pointer files (.cur and .ani) for the pointer schemes that ship…
- debugFolder for Windows component debug logs, mainly netlogon.log (Netlogon service); nearly…
- FontsFonts installed for all users of the computer (TrueType, OpenType and others); registered…
- GlobalizationC:\Windows\Globalization: Windows language and region data (sorting, time zones, ICU…
- IMEComponents of the Windows Input Method Editors (IME) for typing Japanese, Korean and…
- ImmersiveControlPanelFiles of the Windows Settings app (SystemSettings.exe and its resources); do not modify.
- INFINF files for the drivers built into Windows and copies of installed third-party drivers…
- InstallerWindows Installer cache: copies of the .msi and .msp files needed for repair, update and…
- LiveKernelReportsC:\Windows\LiveKernelReports: "live kernel" dumps written without stopping Windows when a…
- LogsFolder of Windows servicing text logs (CBS, DISM, Windows Update, MoSetup), not to be…
- MediaWindows system sounds (.wav files for notifications, errors, sign-in and so on). You…
- Microsoft.NETSystem folder for the .NET Framework: runtimes, compilers and tools for .NET Framework…
- MinidumpSmall .dmp files (small memory dumps) generated on blue screens. They can be deleted…
- NTDSDefault folder of ntds.dit, the Active Directory database, and its transaction logs on a…
- PantherFolder of logs and working files from the Windows installer (setupact.log, setuperr.log).
- PolicyDefinitionsPolicyDefinitions: ADMX files (language-neutral administrative templates) and ADML files…
- PrefetchC:\Windows\Prefetch: .pf prefetch files for launched applications, rebuilt by Windows…
- ResourcesWindows interface resources: themes (Themes folder), including ease-of-access and…
- SecurityLocal security configuration database and logs used by secedit and the Security…
- ServiceProfilesC:\Windows\ServiceProfiles: profiles of the Local Service and Network Service accounts…
- servicingComponent-Based Servicing folder: package manifests, servicing sessions and servicing…
- SoftwareDistributionC:\Windows\SoftwareDistribution: Windows Update working folder (Download, DataStore)…
- SystemFolder inherited from Windows 3.x/9x for 16-bit applications; nearly empty, kept for…
- System32Core of the system: libraries, drivers, tools and configuration. On 64-bit Windows it…
- SYSVOLC:\Windows\SYSVOL: a domain controller's replicated folder, with GPO files and logon…
- SysWOW6432-bit libraries and tools on 64-bit Windows (WOW64); target of the System32 redirection…
- TasksLegacy scheduled tasks folder (.job files of Task Scheduler 1.0). Current tasks live in…
- TempC:\Windows\Temp: temporary folder of the System account, services and elevated…
- WebImages shipped with Windows: wallpapers and default lock screen images; folder protected…
- WinSxSWinSxS: the Windows component store, holding system file versions for installing…
Files 5
- explorer.exeExecutable of File Explorer and the Windows shell (desktop, taskbar, Start menu); never…
- MEMORY.DMPMEMORY.DMP: memory dump Windows writes on a stop error (blue screen) for crash analysis…
- regedit.exeWindows Registry Editor: graphical tool to read and modify registry hives; an incorrect…
- system.iniC:\Windows\system.ini: INI file inherited from Windows 3.x, kept for old 16-bit…
- win.iniINI configuration file inherited from Windows 3.x, kept for legacy application…
Logs 5
- DtcInstall.logMSDTC (Distributed Transaction Coordinator) installation log, written at Windows setup…
- ntbtlog.txtntbtlog.txt, the Windows boot log: lists the drivers loaded or not loaded at startup when…
- PFRO.logLog of file operations deferred to reboot (PendingFileRenameOperations): renames and…
- setupact.logSecondary log of setup component actions at the root of C:\Windows; the main Setup log is…
- setuperr.logErrors-only log of setup components, at the root of C:\Windows; counterpart of…