Windows Enterprise Desktop

Jan 17 2020   3:45PM GMT

Self-Inflicted Spurious $SysReset Folder

Ed Tittel Ed Tittel Profile: Ed Tittel

Tags:
Disk cleanup
Reset issues
Windows 10
Windows management

Ah, the many wrinkles of Windows 10. I just learned about one (wrinkle, that is) that users can foist upon themselves. Occasionally, I run the Settings → Update & Security → Recovery → Reset this PC → Get Started button, to see if a cloud-based reset option appears. Most of the time the resulting Window does NOT show such an option, at least on my PCs. But you must click the “Cancel” button that appears at the lower right of the “Reset this PC” window (see below) to get out of the reset process. This leaves certain leftovers behind, including the self-inflicted spurious $SysReset folder in the title of this blog post.

Self-Inflicted Spurious $SysReset Folder.reset-window

If you open this windows, you must either reset your system or click “Cancel” at lower right. When I’m just checking things, that’s the only option I really want.
[Click image for full-sized view.]

How I Know It’s a Self-Inflicted Spurious $SysReset Folder

After canceling a reset, I then examined the contents of the $SysReset\Logs folder named setupact.log. I checked its interior timestamps, to prove to myself that the $SysReset folder can result from an aborted reset operation. On one of my test machines, with no such folder present, I ran the described operation (open Reset this PC window, cancel operation). Bingo! The $SysReset folder appears thereafter, with corroborating timestamps to show it happened recently. Here’s the stuff (from the very tail end of that logfile):

2020-01-17 14:25:46, Info     OnlineUI: User cancelled reset
2020-01-17 14:25:46, Info     ResetNotifyCancel: User canceled on page [OnlineResetTypeSelection]
2020-01-17 14:25:47, Info     OnlineUI: Releasing reset session
2020-01-17 14:25:47, Info     ResetReleaseSession: Releasing session

It’s 2:31 PM as I write this text, so 14:25 was six minutes ago. Proof enough for me, anyway.

More About $SysReset

It’s eminently safe to delete the folder and its contents, once a reset operation has been cancelled. If one persists after a reset operation has concluded successfully — it shouldn’t — it’s safe to delete that, too. Back in 2017, I wrote about $SysReset for this same blog. That post was entitled Bid $SysReset Goodbye in Win10. In that post, I asserted that “This folder bears often bears testimony to a failed reset or refresh operation in Windows versions from 8.0 forward.” This is true, but I didn’t realize at the time that canceling a Windows Reset counts, too, where leaving this folder behind is concerned. Now I’ve learned (and demonstrated) that this happens each and every time you decide to cancel the Reset operation. Consider this blog post fair warning, then, that such cancellations also require cleanups. Delete that leftover $SysReset at your convenience.

[Note added 25 minutes later]

Following my own advice, I just attempted to delete $SysReset on the test machine that hosted my experiment. Windows refused to do so, saying the file was in use in another application. My best guess is the Reset process hangs onto $SysReset files and folders until the next reboot. I was able to delete it on another machine (on which I hadn’t run the experiment recently) without issue. My guess got some validation when I rebooted the test machine, and was then able to delete $SysReset without further issue (though I did have to grant admin permission to complete the operation). Thus, you’ll either want to use a forced deletion tool (like Unlocker) or wait until after your next reboot, if you conduct the experiment, too.

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: