Is there are any way to tell which files are pending to be deleted or renamed on Windows system reboot?

Question

Does anyone knows the way to tell which files are going to be deleted or modified on system reboot? Like when you update your system, the system ask to be rebooted because some files are blocked by the system and they need to be replaced or modified. I need to make a script that tells me which file are going to be deleted or modified on startup.

Answer 1

The documentation for MoveFileEx states:

Remarks

If the dwFlags parameter specifies MOVEFILE_DELAY_UNTIL_REBOOT, MoveFileEx fails if it cannot access the registry. The function stores the locations of the files to be renamed at restart in the following registry value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

This registry value is of type REG_MULTI_SZ. Each rename operation stores one of the following NULL-terminated strings, depending on whether the rename is a delete or not:

• szDstFile\0\0

• szSrcFile\0szDstFile\0

The string szDstFile\0\0 indicates that the file szDstFile is to be deleted on reboot. The string szSrcFile\0szDstFile\0 indicates that szSrcFile is to be renamed szDstFile on reboot.

You can use Win32::TieRegistry to query the Windows registry:

#!/usr/bin/env perl

use strict; use warnings;
use Const::Fast;
use Win32::TieRegistry;
use YAML;

const my $REG_DELIMITER => '/';

$Registry->Delimiter($REG_DELIMITER);

my $key = join $REG_DELIMITER, qw(
    HKEY_LOCAL_MACHINE
    SYSTEM
    CurrentControlSet
    Control
    Session Manager
    PendingFileRenameOperations
);

print Dump $Registry->{$key}