How does Windows remove locked files in the next reboot when you uninstall a program?

Question

How does Windows remove locked files in the next reboot when you uninstall a program? Maybe with some kind of scheduled process?

Answer 1

The uninstall process uses MoveFileEx with the MOVEFILE_DELAY_UNTIL_REBOOT flag set, which indicates that the operation shouldn't occur until reboot. Leaving the lpNewFileName parameter NULL indicates the file should be deleted:

If dwFlags specifies MOVEFILE_DELAY_UNTIL_REBOOT and lpNewFileName is NULL, MoveFileEx registers the lpExistingFileName file to be deleted when the system restarts. If lpExistingFileName refers to a directory, the system removes the directory at restart only if the directory is empty.

The info on MOVEFILE_DELAY_UNTIL_REBOOT says:

MOVEFILE_DELAY_UNTIL_REBOOT

The system does not move the file until the operating system is restarted. The system moves the file immediately after AUTOCHK is executed, but before creating any paging files. Consequently, this parameter enables the function to delete paging files from previous startups

The above function writes an entry to the registry which is automatically processed during startup:

The function stores the locations of the files to be renamed at restart in the following registry value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations