# Deleting the catroot2 folder on a Windows Server - Access Denied

**URL:** <https://forum.ansible.com/t/deleting-the-catroot2-folder-on-a-windows-server-access-denied/43620>\
**Category:** Get Help\
**Tags:** windows\
**Created:** [June 28, 2025, 7:33pm UTC](https://forum.ansible.com/t/deleting-the-catroot2-folder-on-a-windows-server-access-denied/43620 "2025-06-28T19:33:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Pendergraft](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris_pendergraft/32/8359_2.png) [@Chris\_Pendergraft](https://forum.ansible.com/u/Chris_Pendergraft)\
**Post date:** [June 28, 2025, 7:33pm UTC](https://forum.ansible.com/t/deleting-the-catroot2-folder-on-a-windows-server-access-denied/43620/1 "2025-06-28T19:33:24Z")

</div>

Hi, I have a playbook which I can stop all the required services to repair the windows update agent, run sfc and dism, delete the softwaredistribution folder. Unfortunately when I try to rename the catroot2 folder to catroot2.old I get access denied. I can delete/rename it locally on the server from cmd or powershell. I’m running the playbook as the local administrator. When I try to rename it the cryptsvc service automatically starts which gives me the access denied.

Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\
**Post date:** [June 29, 2025, 12:32pm UTC](https://forum.ansible.com/t/deleting-the-catroot2-folder-on-a-windows-server-access-denied/43620/2 "2025-06-29T12:32:00Z")

</div>

> [@Chris\_Pendergraft](#):
>
> catroot2

Does [this Microsoft Answers post](https://answers.microsoft.com/en-us/windows/forum/all/how-do-i-delete-all-contents-of-catroot2-folder/13c9045c-29f7-48b4-9c6c-fdec1d3cb3ef) help?

---

<div class="post-metadata">

**Author:** ![Chris\_Pendergraft](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris_pendergraft/32/8359_2.png) [@Chris\_Pendergraft](https://forum.ansible.com/u/Chris_Pendergraft)\
**Post date:** [June 29, 2025, 2:41pm UTC](https://forum.ansible.com/t/deleting-the-catroot2-folder-on-a-windows-server-access-denied/43620/3 "2025-06-29T14:41:52Z")

</div>

Yes, the catroot2 folder. Looks like it detects tampering and starts the cryptsvc which locks the folder located in c:\windows\system32.  
Any workaround?