[SOLVED] Impossible to delete folder recursion (not a junction/symlink) - not even with Windows-Kernel-Explorer!

Software & Operating Systems Windows
, ,
1

So I came here from reddit (link at the bottom) as I thought the LevelOne crowd may be more advanced. Long time watcher of LevelOne news but only recently joined the forums. This is essentially a copy paste from reddit with updates.

At this point I am more curios what the hell is going on as opposed to solving the issue.

Tl;DR: There is an infinitely nested folder structure that isn’t a junction that I cannot delete, rather only move around the same disk (NTFS VHD in a Hyper-V VM; brand new server).

Yes, I’ve read other posts like /t/windows-server-unable-to-delete-folder-tree/165332 on the forum here.

My former colleague (that left) migrated some file shares from Windows Server 2008 to 2019 via robocopy. I was tasked to back up the shared to Azure using Azure Backup (MARS). After multiple failures I have discovered that there is an profile redirection share (that is now just a file share) that has a folder “Application Data” under the “Admin” user (in the Appdata\Local folder) that you cannot delete or go into until the end - it just contains infinitely more nested “Application Data”. I was able to cut and paste the folder out of the way in the same disk to allow for the backup to work, but I still CANNOT delete it!

Some things I’ve tried and some funny properties about the folder:

  • its NOT a junction (symlink) - dir and Junction (from SysInternals) do not see it as a junction
  • each sub-folder can be renamed - I’ve manually renamed like 20 nested folders to “1” to no avail (continued sub folders are still named “Application Data”). Tried with a script too.
  • tried robocopy from an empty folder to this one as target with various parameters to no avail - just goes on infinitely
  • none of the CMD or PowerShell commands work
  • checking for alternative streams - none exist
  • if you Shift+Delete it in Explorer - just crashes. Same happens in cmd “rmdir” with certain parameters. I do see some random files that explorer tries to delete along the way (before crashing
  • It weighs 0 bytes (size and size on disk), has 257 folders (integer limit I guess) and 0 files - in explorer file properties
  • Windows-Kernel-Explorer - crashes the server upon trying to delete the folder
  • List of other tools I’ve tried that failed: FileExile, 7zFM, Long Path eraser, Fastcopy, unlocker, bynow - all just crash or go on forever (7z and Bynow)

What I have NOT tried, but will probably works:

  • move data to another drive (its a VM on Hyper-V) and throw this one away (format or delete VHD) - just a PITA to do
  • use some WSL or some cygwin-bash to delete the folder or boot form Linux - working hours customer downtime isn’t an option for this trivial issue

/r/sysadmin/comments/muqu1p/impossible_to_delete_folder_not_even_robocopy_not/

[SOLVED]
It WAS and VERY deep nested folder issue. I should have let byenow run for like an hour at least an hour…

I’ve added takeown and attrib to a cmd script a redditor suggested and it ran for a few minutes. Eventually it go down to 2 folders within “Application Data”: “Application Data” and “Google”. Each subsequent sub-folder had these 2 folders.

Then I tired just shift+delete the folder and it had 102,812 items in it! Explorer started to chew on ram (got to 1.5GB) and then the delete operation stalled. Had to kill explorer.

So I modified the script to do the same operation on the “Google” folder. It started to stumble (probably because I put the check for errors before the rename - script bellow is where I fixed that issue). Then I just ran bynow again and after 5 minutes it was deleted!

It WAS just a LOT of nested folders after all.

Thank you guys for your answers.

:again

takeown /F "Application Data\Application Data"

takeown /F "Application Data\Google"

attrib -S -H "Application Data\Application Data"

attrib -S -H "Application Data\Google"

move "Application Data\Application Data" Abc

move "Application Data\Google" Abc1

rmdir "Application Data"

rmdir Abc1

rename Abc "Application Data"

if %errorlevel% neq 0 goto:eof

goto again

2

When I have similar problems, it is the FAT that causes the issue, even if its a NTFS filesystem.
I run “chkdsk /f /r /x /b” with elevated cmd, reboot and then the folder can be deleted.

3

How can it be a FAT issue on NTFS?! Those are 2 different file systems 0.o.

/x forces a dismount - which means I can only run it after hours. Hell, if this is the issue I’ll do it tonight after hours when the customer is not using their file server.

4

Could be a carry over of features from FAT, like folder depth or object character length limits. Like FAT, NFTS absolute paths can only be so long.

5

open cmd with elevated privs…
type
rmdir “topmostfoldername” /S

it should all subdirectory’s in the tree.

if it doesnt then its likely some kind of worm designed to fill up the file tree structure and remain persistent. in that case i would look at the files you imported from the share folder. one of them may be a trojan thats triggering the recursion.
(server 2008 is particularly insecure, prone to both infections and exploits) so not really a file system you want to import applications from without proper inspection and scanning.

1 Like
6

I’ve tried rmdir with the subfolder flag already. It just says path not found showing about 20 levels of depth. I doubt this is a trojan. I’ve tried a lot of tools and vanilla ways - if Windows-Kernel-Explorer can’t do it, than there is something really wrong somewhere.

7

You may be hitting the 260 chars path limit.

Try this:

(1) run regedit.exe as administrator
(2) locate [ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem ]
(3) change data value [ LongPathsEnabled ] (DWORD) to " 1 "
(4) close regedit and restart Windows

Source: MSDN

8

… I remember windows xp doing this. Huh

9

NTFS uses several features from FAT, one of them is Master File Table which supersedes FAT. Because it keeps redundant information in a second MFT, it could cause such issues, where the information is different between them.

1 Like
10

Didn’t help.

11

Did you mention you could cut and paste the folder?

How about paste it to a temporary RAM disk / thumb drive? Then remove it after?
As a hypothetical.

1 Like
12

Or on elevated command box:

Move c:\folder\ NUL

(NUL as per this link)

1 Like
13

Thanks for the suggestions - neither work however.

The NUL thing - you can only pipe stdout into it (or whatever CMD has). You can’t perform moves to that destination (try it).

In regards to cutting and pasting - if you do so in the same disk it just moves the pointer in the file system table. If you do that to another drive (i.e. different file system table) then it first copies and then deletes from the source - hence its the same as deleting (i.e. doesn’t work). I already tried that with a VHD.

1 Like
14

without seeing any word limit, you can try LongPath tool software to resolve issues of impossible to delete long files. its use is simple and working is aggressive.