Windows 10 Ent C Drive Random Name Folder

Ximing Feng 1 Reputation point
2020-09-03T23:00:58.93+00:00

My client workstations are generating folders with random alphanumeric name like 16ce5aac7f355655d4364305c30972. I cannot delete the folder even with elevated privilege. Inside of those folders, there is a "WSUSSCAN.cab" and "$dpx$.tmp" folder.
My questions are

  1. Why/How are those folders generated?
  2. How can I remove the folders
  3. Is there anything that I can do to prevent this kind of folders to be created?

Thank you!

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
10,657 questions
0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dale Kudusi 3,211 Reputation points
    2020-09-04T06:08:18.493+00:00

    Hi, @Ximing Feng
    1.Why/How are those folders generated?
    The Wsusscan.cab file come with every new security release, the files contains metadata from the following classifications: security updates, update rollups, and service packs. These files usually should be automatically deleted after an update is completed, but some installation error during the update might prevent that.

    2.How can I remove the folders
    You could delete these files by taking the ownership of that folder.
    https://www.windowscentral.com/how-take-ownership-files-and-folders-windows-10
    Please note that it’s safer to let the Disk Cleanup tool do these cleanings for you, this avoids accidentally deleting files that you need, and don't forget to make a system backup.

    3.Is there anything that I can do to prevent this kind of folders to be created?
    Based on my research, I’m afraid these isn’t a direct way to prevent this, You could perform Disk Cleanup to remove these files after a successful update.

    Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.

    Best regards.

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
  2. Adam J. Marshall 8,706 Reputation points MVP
    2020-09-04T17:04:26.69+00:00

    Take ownership through a Right Click > Properties > Security > Advanced > Owner > Change Button. Put a checkmark in replace owner on subcontainers and objects. Press OK. Press OK.
    Push down Permissions on newly owned files and folders by Right Click > Properties > Security > Advanced > put a checkmark in "Replace all child object permissions with inheritable permission rights from this object" and press OK. Press OK again.

    Now try to delete the folder.

    SQL Server temp files and .NET install temp files sometimes do this too and require this method too.

    1 person found this answer helpful.
  3. Adam J. Marshall 8,706 Reputation points MVP
    2020-09-08T19:31:48.26+00:00

    Do some research into using takeown.exe to take ownership and propagate the permissions using icacls.exe

    takeown.exe /?
    icacls.exe /?

    1 person found this answer helpful.
  4. Adam J. Marshall 8,706 Reputation points MVP
    2020-09-08T22:37:13.957+00:00

    Do they all start with numbers and/or have a length of 30 characters? Do you think any other folders on the root of C:\ would have a 30 character exactly folder name?

    You could use Get-ChildItem along with iterating through the result set for folder lengths to pull out any folders that have exactly 30 characters and also examine them to confirm they have no spaces. That should narrow it down very quickly.

    Something I did quickly 

    $(Get-ChildItem C:\).Name | ForEach-Object { if ($_.Length -gt 7) { Write-Output "$_ is greator than 7 characters. Do something to $_.FullName" } }
    1 person found this answer helpful.