AutomoxAutomox

Delete file in privileged folder like system32

victor.tremea
July 24, 2024 at 6:43 am UTC
#Worklets#powershell

Working in a script able to delete files in privileged folder like system 32. 
But getting “File '\Windows\System32\Tryme\new 2.txt' does not exist.” on the script bellow. 
According to the reponce on  this: 

https://community.automox.com/find-share-worklets-12/delete-file-in-privileged-folder-like-system32-2203

Automox runs as SYSTEM so this issue is unlikely related to elevated privileges.
Any suggestions? What am I missing here? 
 

Evaluation Code:

Exit 1

 

Remediation code:
 

$filePath = "C:\Windows\System32\Tryme\new 2.txt"

# Check if the file exists
if (Test-Path $filePath) {
    try {
        # Attempt to delete the file
        Remove-Item -Path $filePath -Force -Recurse
        Write-Output "File '$filePath' has been successfully deleted."
    } catch {
        # If an error occurs, display the error message
        Write-Output "An error occurred while trying to delete the file: $_"
    }
} else {
    # If the file does not exist, inform the user
    Write-Output "File '$filePath' does not exist."
}

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack

Replies (2)

JohnG-AutomoxJuly 30, 2024
#1

Hi @victor.tremea !

 

I believe the issue you are seeing is related to the fact that the Automox agent is a 32-bit process.

 

You'd want to use sysnative to return the redirected SysWoW64 folder and test for the file in there.

Source: https://learn.microsoft.com/en-us/windows/win32/winprog64/file-system-redirector

 

Example, $filePath = "$env:windir\Sysnative\Tryme\new 2.txt"

Let me know if that doesn’t work for you!

victor.tremeaJuly 31, 2024
#2

That worked! Thank you, @JohnG-Automox .