Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


  • NTFS - version 3.1 - used fsutil to obtain information
  • Microsoft Windows XP [Version 5.1.2600]


  • Method (or tool) to obtain, a list of files set for deletion during the next system restart?
share|improve this question
up vote 5 down vote accepted

There is a free MS/Sysinternals program called pendmoves that can show you the list of files waiting to be deleted/moved on reboot.

You can also look at the following registry key for a list of pending operations:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations

The API operation that does this is called MoveFileEx() with the MOVEFILE_DELAY_UNTIL_REBOOT option.

More information in this KB.

FYI, to manually add a working entry to this area of the registry you can do the following:

  1. Start REGEDT32 (W2K) or REGEDIT (WXP) and navigate to: HKLM\System\CurrentControlSet\Control\Session Manager

  2. W2K: Edit, Add Value..., Data Type: REG_MULTI_SZ, Value Name: PendingFileRenameOperations, OK

WXP: Edit, New, Multi-String Value, [enter] PendingFileRenameOperations

  1. In the Data area, enter "\??\" + filename to be deleted. LFNs may be entered without being embedded in quotes. To delete "C:\Long Directory Name\Long File Name.exe", enter the following data:

\??\C:\Long Directory Name\Long File Name.exe

Then press OK.

  1. The "destination file name" is a null (zero) string. It is entered as follows:

W2K: Edit, Binary, select Data Format: Hex, click at the end of the hex string, enter 0000 (four zeros), OK.

WXP: Right-click the value, choose "Modify Binary Data", click at the end of the hex string, enter 0000 (four zeros), OK.

  1. Close REGEDT32/REGEDIT and reboot to delete the file.

From this thread.

Of course using movefile is easier than doing all that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.