0

this is the script I'm working with

# Define the top-level folder and the list of files
$topFolder = "C:\Windows\System32"  # Update to System32 directory
$files = @(
     "mstsc.exe",
    "mstscax.dll",
    "msra.exe",
    "termsrv.dll",
    "termmgr.dll",
    "rdpclip.exe",
    "tscon.exe",
    "tsdiscon.exe",
    "qwinsta.exe",
    "shadow.exe",
    "sessenv.dll",
    "sessmgr.exe",
    "rdpshell.exe",
    "rdpint.exe",
    "rdpcorekmts.dll",
    "rdpcore.dll",
    "rdpdd.dll",
    "rdpsnd.dll",
    "termsrv.exe",
    "rdpendp.dll",
    "rdprefmp.dll",
    "rdpendin.dll",
    "rasadhlp.dll",
    "rasman.dll",
    "rasapi32.dll",
    "rdpencom.dll",
    "rdpendcom.dll",
    "rdpcredentialprovider.dll",
    "rdpsa.exe",
    "rasppp.dll",
    "rdpsaps.dll",
    "rdpsauachelper.exe",
    "rdpsharecom.dll",
    "rdpudd.dll",
    "rdpviewerax.dll",
    "rascustom.dll",
    "rasctrnm.h",
    "rasctrs.dll",
    "rasgcw.dll",
    "rasmbmgr.dll",
    "rasmm.dll",
    "rasmontr.dll",
    "rasphone.exe",
    "rasplap.dll",
    "rastlsext.dll",
    "msrdc.dll",
    "msrdpwebaccess.dll",
    "sessionmsg.exe",
    "rasautou.exe",
    "raschap.dll",
    "raschapext.dll",
    "rasdiag.dll",
    "rasdial.dll",
    "rasdig.dll",
    "raserver.exe",
    "rasmans.dll",
    "rasmediamanager.dll",
    "rasmm.dll",
    "rasstapi.dll",
    "rastls.dll",
    "rdpbase.dll",
    "rdpcfgex.dll",
    "rdpcorets.dll",
    "rdpviewerax.dll",
    "rdpinput.exe",
    "rdpnano.dll",
    "RdpRelayTransport.dll",
    "RdpSaProxy.exe",
    "rdpserverbase.dll",
    "rdpsign.exe",
    "RDSAppXHelper.dll",
    "rdsdwmdr.dll",
    "rdvvmtransport.dll"   
)

Function to move files to the Recycle Bin

function Move-ToRecycleBin { param ( [string]$filePath ) $shell = New-Object -ComObject Shell.Application $folder = $shell.Namespace((Get-Item $filePath).DirectoryName) $item = $folder.ParseName((Get-Item $filePath).Name) $item.InvokeVerb('delete') # Move to Recycle Bin }

try { # Take ownership of the top-level folder recursively Write-Output "Taking ownership of $topFolder and all child objects..." takeown /F $topFolder /R /D Y | Out-Null Write-Output "Ownership taken for $topFolder and all child objects."

# Grant full control permissions to the Administrators group recursively
Write-Output "Granting full control permissions to Administrators for $topFolder and all child objects..."
icacls $topFolder /grant Administrators:F /T /C /Q | Out-Null
Write-Output "Full control granted to Administrators for $topFolder and all child objects."

# Wait a few seconds to ensure permissions are applied
Start-Sleep -Seconds 5

# Loop through each file in the list and delete it
foreach ($file in $files) {
    $filePath = Join-Path -Path $topFolder -ChildPath $file
    Write-Output "Checking $filePath..."
    if (Test-Path -Path $filePath) {
        Write-Output "$filePath exists. Attempting to move to Recycle Bin..."
        try {
            # Output file attributes and permissions before moving
            $fileInfo = Get-Item -Path $filePath
            Write-Output "File: $filePath"
            Write-Output "Attributes: $($fileInfo.Attributes)"
            Write-Output "Permissions: $(Get-Acl -Path $filePath | Format-List | Out-String)"

            # Move to Recycle Bin
            Move-ToRecycleBin -filePath $filePath
            Write-Output "Moved $filePath to Recycle Bin"
        } catch {
            # Output the exception message using concatenation
            $errorMessage = $_.Exception.Message
            Write-Output ("Error moving " + $filePath + ": " + $errorMessage)
        }
    } else {
        Write-Output "$filePath does not exist"
    }
}

} catch { Write-Output ("Error processing: {0}" -f $_.Exception.Message) }

When I run it everything works with no errors

C:\Windows\System32\rdvvmtransport.dll exists. Attempting to move to Recycle Bin...
File: C:\Windows\System32\rdvvmtransport.dll
Attributes: Archive
Permissions:

Path : Microsoft.PowerShell.Core\FileSystem::C:\Windows\System32\rdvvmtransport.dll Owner : DESKTOP-USHGRVA\garrett Group : NT SERVICE\TrustedInstaller Access : NT AUTHORITY\SYSTEM Allow ReadAndExecute, Synchronize BUILTIN\Administrators Allow FullControl BUILTIN\Users Allow ReadAndExecute, Synchronize NT SERVICE\TrustedInstaller Allow FullControl APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow ReadAndExecute, Synchronize APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES Allow ReadAndExecute, Synchronize Audit : Sddl : O:S-1-5-21-3924358604-886122918-2420348639-1001G:S-1-5-80-956008885-3418522649-1831038044-1853292631-227147846 4D:PAI(A;;0x1200a9;;;SY)(A;;FA;;;BA)(A;;0x1200a9;;;BU)(A;;FA;;;S-1-5-80-956008885-3418522649-1831038044-185329 2631-2271478464)(A;;0x1200a9;;;AC)(A;;0x1200a9;;;S-1-15-2-2)

But after I check the system32 folder, nothing has changed. What's worse is the recycle bin populates with the listed files. I can empty the recycle bin and everything, but when I browse back to system 32 I find all the files listed with permissions set to TrustedInstaller and Administrator account at Read & Execute . I've checked group policy and Windows Defender but both are not the issue since Defender is turned off and Group Policy is set to allow all scripts. Is there a better way to do this?

If any one has any ideas what is going wrong or why its only half-way working I'm all ears.

DavidPostill
  • 162,382

0 Answers0