How to replace files which are in use in Windows

Replacing files which are in use. For non-core files, the simplest solution is often to reboot to Safe Mode and attempt to replace the files. However, some files, such as core-system files, may be in use even in Safe Mode.

Windows offers the ability to replace files on the next boot. This functionality is used by many software installers. To replace a file follow these steps:

1. While logged in as an administrator, launch your registry editor. Note: On Windows NT and Windows 2000 systems, you must use REGEDT32 as the registry value is a Multi-String (MULTI_SZ) type, which is not supported in REGEDIT. REGEDIT on Windows XP or 2003 systems does support MULTI_SZ.
2. Browse to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
3. Open the MULTI_SZ registry value PendingFileRenameOperations. Create it if it does not exist.
4. The format of the entry is as follows:
   • On the first line enter \??\ followed by the path of the new file which will be used as a replacement. The replacement file should be located on a local hard disk to ensure it will be accessible on reboot! It is best to put it in a different folder on the same drive as the file it is replacing.
   • On the second line enter !\??\ followed by the path of the old file which will be replaced.
   • Click OK to save the changes.
   • Close the registry editor.

Example:
I want to update C:\WINDOWS\SYSTEM32\NTOSKRNL.EXE with a new kernel C:\NEWKERNEL\NTOSKRNL.EXE. I edit PendingFileRenameOperations so it reads as follows:

   \??\C:\NEWKERNEL\NTOSKRNL.EXE
   !\??\C:\WINDOWS\SYSTEM32\NTOSKRNL.EXE

Entries made in this value will cause the files to be changed the next time the system is rebooted or started and all entries will be automatically removed from PendingFileRenameOperations. You should, of course, use extreme caution whenever replacing files, particularly system files, as it could easily render your system non-functional.

Microsoft also MV.EXE as part of the Resource Kit which will automate this registry change through a command-line utility.

Warning: By visiting this site and/or by using any information contained herein, you agree to the Techbytes.ca terms of use.

Add a comment about this TechByte

If you wish to add a comment regarding this TechByte, please use the form below. Please note that by submitting comments using this form you are allowing all of the information submitted to be visible on this website. Any comments submitted using this form will only be shown on the website if they are approved by the administrators of this site. IF APPROVED, COMMENTS MAY TAKE SEVERAL DAYS TO BE POSTED.

Other TechBytes:

• Convert int to string using C++
• Convert string to int using C++
• Remotely clear and/or save a Windows event log