Windows temp folder constantly removed by what
Hi
The folder c:\windows\temp is constantly removed from my system. I try to recreate it with proper security settings. I am running Windows 7 pro 64-bit, Visual Studio 2010, IIS 7 etc. By the behaviour of some test projects using ASP .NET, the IIS7 obviously
uses the c:\windows\temp folder. I recreated this folder, but after a while its removed. Why? Whats deleting it and how do I fix so it is not removed?
August 3rd, 2011 10:40am
Hi,
Any process launched with enough privilegs can delete the folder.
I would recommend using the sysinternals toolkit to find out which executable is culprit. If it is some process or script doing it, this might enable you to find out which one otherwise it may hint you to the user (the process owner of the process doing
the action)
Use process monitor to find out which process access the files. filter for "event class" "is" "File System", "path" "is" "c:\windows\temp" and "Operation" is "SetDispositionInfo"
Enable some columns of your choice (for example "user" "command line" and when the deletion happens, one nice line should show you all you need to know!
http://technet.microsoft.com/en-us/sysinternals/bb896645
MCP/MCSA/MCTS/MCITP
Free Windows Admin Tool Kit Click here and download it now
August 3rd, 2011 1:18pm
The process deleteing the c:\windows\temp folder is svchost.exe running svchost -k netsvcs. And its never recreated by the system again. I have to create it my self, and later its removed again by this process.
SWEDEV
August 5th, 2011 5:36am
That's tricky; that must be some service deleting the folder... unfortunately the svchost process host several services.
http://windows.microsoft.com/en-US/windows-vista/What-is-svchost-exe shows how to easily find out which services are related. Maybe better you can check
also with process explorer. For this particular process (svchost -netsvcs) that is a lot: dhcp, dns, logical disk manager,....even task scheduler depends on the process.
But... as far as I know this process hosts only Microsft services; you can check whether non-Microsoft services are hosted in the process and stop those.
I do not know it for a fact, but chances are the behaviour is due to a Windows configuration I (we) do not know of. I would surely investigate policies applied to the system.(http://social.technet.microsoft.com/Forums/ar/winserverGP/thread/5ac7d863-92c6-4fb5-be72-3956ba1aaa12)
by running an Rsop for the pc.
MCP/MCSA/MCTS/MCITP
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2011 6:38am
Are you running disk cleanup (manually) or is it part of group policy or a scheduled event?
Temp folders are just that, temporary, and anything that attempts housekeeping/cleanup operations is likely to kill the folder and its contents because it is named expressly FOR easy cleanup.
If it ends up being a policy issue, see if you can cause your tools to save to a folder with a different name, one that isn'r begging to be deleted based on its name...
DAS
August 5th, 2011 9:02am
a workaround might be to remove the "delete" privilege for "system" on the folder. System runs the svchost process so it will no longer be able to delete the folder. This however does not resolve the root cause and it even might spawn an error message in
some logfile here or there.
I do not share the opinion of Win7Tester that a temporary folder should be removed in a cleanup. A lot of processes rely on such folders to exist.
MCP/MCSA/MCTS/MCITP
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2011 9:26am
You can disagree if you like, but they are included in the cleanup options by their very name. I didn't design that, its just the way it is.
DAS
August 5th, 2011 10:58am
After some tests I am now sure its the "Group Policy Client" service thats behind it (gpvcs). After changing access rights and start mode from 2 to 4 in registry i was able to start without this service and then the temp folder was untuched. After restoring
registry settings and starting the service again + a reboot, then the windows temp folder was removed.
At my work we have an active directory policy applied for the computers. But my collegue has the same GPO and his temp folder is not removed upon reboot. But I'm nu 100% sure though, because a .tmp file is left in his temp folder since may this year. Maybe
only that hinders his policy from deleting the folder.
I have also read that the system and applications on it, continously adding and removing files to and from the windows temp folder. And also if its is normal to even delete the folder its self. Then its strange that its never recreated again automatically.
Because of this my web application projects doesnt work. I have to create the windows temp folder my self. That doesnt feel normal to me.SWEDEV
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2011 10:59am
I just talked to the AD admnistrator and they had a GPO policy deleting the folder. They ment it was a left behind from an earlier policy. Now they have removed it. My windows temp folder was now normally recreated upon reboot. Also, now it doesnt seem to
be deleted anymore. :)
Personally I think its wrong to delete a temp folder, at least not this one. Maybe its another story if its a temp subfolder for a specific application or in a local user application temporary folder. Good applications should clean their own temporary
files by them self (through OS API:s), a GPO or some other part of the system it self should at most, only remove the files within the windows temp folder and then only in the late shutdown phase or early startup phase. In that case only removing
files thats not locked or used by any application or subsystem components.
SWEDEV
August 5th, 2011 11:47am
Glad you got it worked out, I pretty much knew it had to be a policy...
DAS
Free Windows Admin Tool Kit Click here and download it now
August 5th, 2011 12:01pm


