Chapter 21 · Windows System Files and Directories

Knowledge Check

7 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What does %SystemRoot% usually point to?
  2. On 64-bit Windows, which folder holds the 32-bit system files: System32 or SysWOW64?
  3. What is WinSxS, and may you delete its files by hand?
  4. What is the difference between C:\Program Files and C:\ProgramData?
  5. Which AppData sub-folder is meant to follow you to another PC?
  6. What does hiberfil.sys hold?
  7. Which file is the Windows kernel?
  8. What happens on screen if explorer.exe is missing?
  9. Which account owns protected system files?
  10. Which command scans system files and replaces damaged ones?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. %SystemRoot%

C:\Windows on most PCs. It is a variable so programs do not have to guess where Windows is installed.

2. 32-bit files

SysWOW64. The names are the wrong way round on purpose, for compatibility with old programs.

3. WinSxS

The component store: stored versions of Windows parts, used for updates and repairs. No, do not delete by hand. Use DISM /Online /Cleanup-Image /StartComponentCleanup.

4. Program Files vs ProgramData

Program Files holds the programs themselves. ProgramData holds data shared by all users (and is hidden).

5. Roaming

AppData\Roaming (on a company domain network with roaming profiles).

6. hiberfil.sys

A copy of RAM written to disk when you hibernate (also used by Fast Startup).

7. The kernel

ntoskrnl.exe, in C:\Windows\System32.

8. Missing explorer.exe

A black screen with no desktop or taskbar. Task Manager (Ctrl + Shift + Esc) still works, and Run new task can start explorer.exe again.

9. TrustedInstaller

NT SERVICE\TrustedInstaller (the Windows Modules Installer service).

10. sfc

sfc /scannow (System File Checker), run as administrator.

UNDERSTANDING QUESTIONS

Q1. Why is the folder with 64-bit files called System32?

Answer The name comes from 32-bit Windows. Thousands of programs had the path written into them. When 64-bit Windows came, Microsoft kept the name so old programs still worked, and put the 32-bit files into a new folder, SysWOW64. WOW64 quietly redirects 32-bit programs to it.

Q2. Why does WinSxS look much bigger in File Explorer than it really is?

Answer Many files in System32 are hard links to files in WinSxS. A hard link is a second name for the same data, but Explorer counts the file under both names. The real extra space is less. `DISM /AnalyzeComponentStore` shows the actual size.

Q3. Why can't an Administrator delete a file in System32 straight away?

Answer Protected files are owned by TrustedInstaller, and Administrators only have read and execute rights. This is Windows Resource Protection. It guards against accidents and malware run with admin rights. Taking ownership removes the protection, which is risky.

Q4. Why do user data (AppData, Documents) live apart from the Windows folder?

Answer So you can repair or reinstall Windows without losing your files, and so each user has private settings. It also lets Windows keep `C:\Windows` locked down while users can write to their own profile.

Q5. Why does Windows force a restart if lsass.exe stops, but not if dwm.exe stops?

Answer lsass.exe checks sign-in and security. Without it, Windows cannot trust who is who, so it restarts. dwm.exe only draws windows. If it crashes, Windows can simply start it again.

SCENARIO QUESTIONS (Troubleshooting)

S1. After a restart, you see a black screen with a mouse pointer but no taskbar. What is probably wrong, and what do you try first?

Answer The shell, explorer.exe, did not start. Press `Ctrl + Shift + Esc`, choose *File → Run new task*, type `explorer.exe` and press Enter. If that fails, run `sfc /scannow` from a Command Prompt started the same way.

S2. The PC shows "Your PC needs to be repaired" and names a missing winload.efi. Where is the problem in the start-up chain, and what do you try?

Answer Early in the chain: the boot manager worked but the OS loader is missing or damaged. Boot into the Windows Recovery Environment and try Startup Repair. If that fails, use the Command Prompt with `bootrec` or `bcdboot`, or System Restore.

S3. sfc /scannow says it found corrupt files but could not fix some. What next?

Answer The good copy in the component store is probably damaged too. Run `DISM /Online /Cleanup-Image /RestoreHealth` (needs admin and internet), then run `sfc /scannow` again. If it still fails, use System Restore or Reset this PC.

S4. A friend says C: is full and wants to delete everything in WinSxS. What do you tell them?

Answer Do not. It can break updates and repairs, or even stop Windows from booting. Use Storage settings, Disk Cleanup, or `DISM /Online /Cleanup-Image /StartComponentCleanup`, which remove only old, replaced versions safely. Also look at the temp folders and large downloads.

S5. Task Manager shows a svchost.exe running from C:\Users\Sam\AppData\Local\Temp. Is this normal?

Answer No. The real svchost.exe lives in `C:\Windows\System32` and is started by services.exe. One running from a temp folder is very likely malware pretending to be a system file. Scan with antivirus and disconnect from the network if unsure.

INTERVIEW QUESTIONS

I1. Explain System32 versus SysWOW64 on 64-bit Windows.

Answer System32 holds the native 64-bit binaries, SysWOW64 holds 32-bit ones. The names are historical. WOW64 redirects file system paths for 32-bit processes so they see their own files under the name System32. Registry views are redirected in a similar way.

I2. Walk through the files used from power button to desktop.

Answer Firmware (UEFI) reads the ESP and starts bootmgfw.efi, which reads the BCD. winload.efi loads ntoskrnl.exe, the SYSTEM hive and boot drivers. The kernel starts smss.exe, which starts csrss.exe and wininit.exe. wininit starts services.exe and lsass.exe. Per session, winlogon.exe shows sign-in and starts explorer.exe. dwm.exe composes the display.

I3. What is the component store and how does it relate to sfc and DISM?

Answer WinSxS stores component versions. sfc compares protected files with the store and repairs from it. DISM RestoreHealth repairs the store itself, from Windows Update or other sources. So sfc fixes files, and DISM fixes what sfc fixes them from.

I4. What are WFP, WRP and TrustedInstaller?

Answer WFP was the older system that restored replaced system files. WRP (Vista onwards) protects system files, folders and registry keys by permissions, with TrustedInstaller as the owner. Only servicing code (Windows Update, the Windows Modules Installer) can change them.

I5. Which system processes are critical, and what is the effect if each fails?

Answer smss.exe, csrss.exe, wininit.exe and winlogon.exe are treated as critical: if one dies, Windows stops with a blue screen. lsass.exe failing forces a restart. services.exe is also critical to a working system. explorer.exe and dwm.exe are not critical: they restart or can be restarted.

PRACTICAL TASK

Draw a one-page "map of Windows on my PC". Using your lab results, draw a folder tree of C:\ with at least ten folders or hidden files from this chapter. Next to each, write one sentence about what it does and mark each one SAFE TO LOOK or NEVER DELETE. Then draw the start-up chain from firmware to explorer.exe and mark which file would fail for the message "Your PC needs to be repaired".

Why This Matters

When Windows breaks, the symptom tells you where in the chain the problem is. A map in your head lets you pick the right repair tool, instead of guessing, and keeps you from deleting the one file that holds everything up.

CHAPTER SUMMARY

  • Folders: Windows is the OS; System32 holds 64-bit core files (historic name) and SysWOW64 the 32-bit ones; WinSxS is the component store (clean only with DISM); Program Files, ProgramData, Users and AppData split programs, shared data and personal data.
  • Hidden helpers: pagefile.sys, hiberfil.sys, swapfile.sys, $Recycle.Bin, System Volume Information, and the EFI System Partition with bootmgfw.efi and BCD.
  • Critical files: ntoskrnl.exe, HAL, ntdll.dll, kernel32/kernelbase, user32/gdi32, smss, csrss, wininit, services, svchost, lsass, winlogon, explorer, dwm, winload, and the registry hives.
  • Failure rule: the earlier a file is used in the start-up chain, the worse the symptom when it breaks.
  • Protection: WRP and TrustedInstaller keep even administrators out of system files; do not take ownership.
  • Repair: sfc /scannow, then DISM /RestoreHealth, then WinRE (Startup Repair, bootrec), System Restore and Reset this PC.