Commands like DEL have the optionial /B switch - where the action is perfomed at the next boot. How is this accomplished? It's it involved the registry - wha key's please?
Yes, in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
Btw, I use a command line utility called MoveLater (movelatr.exe) to see what's been marked for later removal and manipulate those entries. It hasn't been updated since 2000, but it still works even on 64bit Windows 7. You can find it here: http://bitsum.com/other.php#movelatr
\??\C:\WINDOWS\system32\drivers\etc\hosts.20080110-102345.backup Is a typical entry. How does Windows know to run TCMD/TCC and not CMD?
It's Windows that does the deleting. No command line processor is involved. That registry location is also used when installers can't update a file that is in use and requires Windows to be rebooted before the install is actually completed. Notice that the value name is "PendingFileRenameOperations". That's because it's actually used to rename files, and renaming to a "blank" means delete. If you highlight that value in the registry and hit Enter, you'll see that there are multiple lines. The first line is the first file to rename, the second line is what to rename that file to or delete if the line is blank. The third line is the second file to rename or delete, and so on. Next time you install something and you're told you have to reboot, check out that value and/or run MoveLater to see what I'm talking about. And lastly, if there are no files set to be renamed or deleted on startup, the value "PendingFileRenameOperations" won't exist at all.
If i did [Del /a: /w PathToDelete\FilesToDelete] does Windows still rename the file so it doesn't exist? IOWs does Windows see the difference between DEL /a: /b and DEL /b ??
The command is not just simply passed to Windows. The help for /B says "If DEL can't delete the file (for example, if access is denied) it will schedule it to be deleted at the next reboot." That indicates to me that if /B is used, DEL will still try and delete whatever file it comes across taking into consideration the switches you passed to it. But if it can't for any certain file, then that file is marked for deletion on next boot. Simple as that. In addition, I'm pretty sure special TCC functions like /W wouldn't have any effect on files deleted that way since it's Windows doing the deleting and not TCC.
