Utility SpotlightPendMoves and MoveFile

Lance Whitney

After you install or uninstall a Windows application, specific files associated with that app often have to be replaced or deleted. But sometimes those files are locked in memory and can't be removed until Windows shuts down. Whether you're troubleshooting a problem with a bad install or are just curious, you may at times want to see a list of those files. Microsoft's free PendMoves tool can help—by showing you the names of all scheduled file moves and deletions before they occur. Additionally, you might sometimes need to move or delete a locked file yourself, either to totally remove an application or to clean up a PC. The MoveFile tool fits that bill.

Written by Mark Russinovich, PendMoves and MoveFile are part of the Windows Sysinternals library. To download PendMoves and MoveFile, go to the Code Downloads section of our Web site, .com. Extract the downloaded PendMoves.zip, and inside you'll find three files: EULA.text, pendmoves.exe, and movefile.exe. Like most Windows Sysinternals tools, no installation is required. Just trigger the programs from their EXE files.

PendMoves displays a list of any fi les scheduled to be moved or deleted

Both PendMoves and MoveFile run from a command line, so you'll need to open a prompt. At the prompt, move to the directory in which you extracted PendMoves.zip. Type pendmoves, and a console window opens to display basic information about the tool, including its name, date, and author, followed by a list of any files scheduled to be moved or deleted. Each file will contain a Source line, which displays the path name of the file, and a Target line, which displays the action or location set for the file—DELETE for deletions or the directory path for moves or renames, as shown in the screenshot. If a program has been installed or uninstalled and requires a reboot, you'll typically see the names of files belonging to that app.

How does PendMoves work? Windows uses an API called MoveFileEx, which lets an application queue up the files that need to be removed or replaced as part of its installation. That information is stored in the Registry key: HKLM\System\CurrentControlSet\Control\Session Manager\Pending FileRenameOperations. PendMoves reads and displays that Registry value.

The second half of this team, MoveFile, comes into play if you need to delete, remove, or rename a file in use. To run MoveFile, first copy movefile.exe to the directory containing the file you wish to move or delete. Open a command prompt and move to that directory. Type movefile followed by the name of the file and the location to which you want to move it—for example, movefile config.log c:\backups. To rename the file, specify the new name—for example, movefile config.log config.bak. To delete the file, type two quotation marks as the location—for example, movefile config.log "".

MoveFile will not accept wildcards. Therefore, to remove several files in one shot, you can create a script with a separate command string for each file. You can also run MoveFile on an entire directory to delete or rename it.

If you plan to use PendMoves or MoveFile on a regular basis, copy them to the Windows/System32 directory or other location in your path so that you can easily run them from any directory. Both PendMoves and MoveFile are compatible with all NT-based versions of Windows, including Windows XP, Windows Vista, and Windows Server.

Lance Whitney is an IT consultant, trainer, and technical writer. He has spent countless hours tweaking Windows workstations and servers. Originally a journalist, he took a blind leap into the IT world 15 years ago.