this is the script I'm working with
# Define the top-level folder and the list of files
$topFolder = "C:\Windows\System32" # Update to System32 directory
$files = @(
"mstsc.exe",
"mstscax.dll",
"msra.exe",
"termsrv.dll",
"termmgr.dll",
"rdpclip.exe",
"tscon.exe",
"tsdiscon.exe",
"qwinsta.exe",
"shadow.exe",
"sessenv.dll",
"sessmgr.exe",
"rdpshell.exe",
"rdpint.exe",
"rdpcorekmts.dll",
"rdpcore.dll",
"rdpdd.dll",
"rdpsnd.dll",
"termsrv.exe",
"rdpendp.dll",
"rdprefmp.dll",
"rdpendin.dll",
"rasadhlp.dll",
"rasman.dll",
"rasapi32.dll",
"rdpencom.dll",
"rdpendcom.dll",
"rdpcredentialprovider.dll",
"rdpsa.exe",
"rasppp.dll",
"rdpsaps.dll",
"rdpsauachelper.exe",
"rdpsharecom.dll",
"rdpudd.dll",
"rdpviewerax.dll",
"rascustom.dll",
"rasctrnm.h",
"rasctrs.dll",
"rasgcw.dll",
"rasmbmgr.dll",
"rasmm.dll",
"rasmontr.dll",
"rasphone.exe",
"rasplap.dll",
"rastlsext.dll",
"msrdc.dll",
"msrdpwebaccess.dll",
"sessionmsg.exe",
"rasautou.exe",
"raschap.dll",
"raschapext.dll",
"rasdiag.dll",
"rasdial.dll",
"rasdig.dll",
"raserver.exe",
"rasmans.dll",
"rasmediamanager.dll",
"rasmm.dll",
"rasstapi.dll",
"rastls.dll",
"rdpbase.dll",
"rdpcfgex.dll",
"rdpcorets.dll",
"rdpviewerax.dll",
"rdpinput.exe",
"rdpnano.dll",
"RdpRelayTransport.dll",
"RdpSaProxy.exe",
"rdpserverbase.dll",
"rdpsign.exe",
"RDSAppXHelper.dll",
"rdsdwmdr.dll",
"rdvvmtransport.dll"
)
Function to move files to the Recycle Bin
function Move-ToRecycleBin {
param (
[string]$filePath
)
$shell = New-Object -ComObject Shell.Application
$folder = $shell.Namespace((Get-Item $filePath).DirectoryName)
$item = $folder.ParseName((Get-Item $filePath).Name)
$item.InvokeVerb('delete') # Move to Recycle Bin
}
try {
# Take ownership of the top-level folder recursively
Write-Output "Taking ownership of $topFolder and all child objects..."
takeown /F $topFolder /R /D Y | Out-Null
Write-Output "Ownership taken for $topFolder and all child objects."
# Grant full control permissions to the Administrators group recursively
Write-Output "Granting full control permissions to Administrators for $topFolder and all child objects..."
icacls $topFolder /grant Administrators:F /T /C /Q | Out-Null
Write-Output "Full control granted to Administrators for $topFolder and all child objects."
# Wait a few seconds to ensure permissions are applied
Start-Sleep -Seconds 5
# Loop through each file in the list and delete it
foreach ($file in $files) {
$filePath = Join-Path -Path $topFolder -ChildPath $file
Write-Output "Checking $filePath..."
if (Test-Path -Path $filePath) {
Write-Output "$filePath exists. Attempting to move to Recycle Bin..."
try {
# Output file attributes and permissions before moving
$fileInfo = Get-Item -Path $filePath
Write-Output "File: $filePath"
Write-Output "Attributes: $($fileInfo.Attributes)"
Write-Output "Permissions: $(Get-Acl -Path $filePath | Format-List | Out-String)"
# Move to Recycle Bin
Move-ToRecycleBin -filePath $filePath
Write-Output "Moved $filePath to Recycle Bin"
} catch {
# Output the exception message using concatenation
$errorMessage = $_.Exception.Message
Write-Output ("Error moving " + $filePath + ": " + $errorMessage)
}
} else {
Write-Output "$filePath does not exist"
}
}
} catch {
Write-Output ("Error processing: {0}" -f $_.Exception.Message)
}
When I run it everything works with no errors
C:\Windows\System32\rdvvmtransport.dll exists. Attempting to move to Recycle Bin...
File: C:\Windows\System32\rdvvmtransport.dll
Attributes: Archive
Permissions:
Path : Microsoft.PowerShell.Core\FileSystem::C:\Windows\System32\rdvvmtransport.dll
Owner : DESKTOP-USHGRVA\garrett
Group : NT SERVICE\TrustedInstaller
Access : NT AUTHORITY\SYSTEM Allow ReadAndExecute, Synchronize
BUILTIN\Administrators Allow FullControl
BUILTIN\Users Allow ReadAndExecute, Synchronize
NT SERVICE\TrustedInstaller Allow FullControl
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow ReadAndExecute, Synchronize
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES Allow ReadAndExecute, Synchronize
Audit :
Sddl : O:S-1-5-21-3924358604-886122918-2420348639-1001G:S-1-5-80-956008885-3418522649-1831038044-1853292631-227147846
4D:PAI(A;;0x1200a9;;;SY)(A;;FA;;;BA)(A;;0x1200a9;;;BU)(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-185329
2631-2271478464)(A;;0x1200a9;;;AC)(A;;0x1200a9;;;S-1-15-2-2)
But after I check the system32 folder, nothing has changed. What's worse is the recycle bin populates with the listed files. I can empty the recycle bin and everything, but when I browse back to system 32 I find all the files listed with permissions set to TrustedInstaller and Administrator account at Read & Execute . I've checked group policy and Windows Defender but both are not the issue since Defender is turned off and Group Policy is set to allow all scripts. Is there a better way to do this?
If any one has any ideas what is going wrong or why its only half-way working I'm all ears.