Skip to main content
Solved

Delete file in privileged folder like system32

  • 24 July 2024
  • 2 replies
  • 38 views

Working in a script able to delete files in privileged folder like system 32. 
But getting “File '\Windows\System32\Tryme\new 2.txt' does not exist.” on the script bellow. 
According to the reponce on  this: 

Automox runs as SYSTEM so this issue is unlikely related to elevated privileges.
Any suggestions? What am I missing here? 
 

Evaluation Code:

Exit 1

 

Remediation code:
 

$filePath = "C:\Windows\System32\Tryme\new 2.txt"

# Check if the file exists
if (Test-Path $filePath) {
    try {
        # Attempt to delete the file
        Remove-Item -Path $filePath -Force -Recurse
        Write-Output "File '$filePath' has been successfully deleted."
    } catch {
        # If an error occurs, display the error message
        Write-Output "An error occurred while trying to delete the file: $_"
    }
} else {
    # If the file does not exist, inform the user
    Write-Output "File '$filePath' does not exist."
}

2 replies

Userlevel 3

Hi @victor.tremea !

 

I believe the issue you are seeing is related to the fact that the Automox agent is a 32-bit process.

 

You'd want to use sysnative to return the redirected SysWoW64 folder and test for the file in there.

Source: https://learn.microsoft.com/en-us/windows/win32/winprog64/file-system-redirector

 

Example, $filePath = "$env:windir\Sysnative\Tryme\new 2.txt"

Let me know if that doesn’t work for you!

Badge

That worked! Thank you, @JohnG-Automox .
 

Reply