Disabling the creation of "desktop.ini".
Posted: Wed Aug 10, 2016 10:19 am
I've always hated this. I also have my Downloads and Pictures folders pointing to an arbitrary "C:\Downloads" directory that I use. With the Anniversary update to Windows 10, not only did this file get automatically recreated in this directory every hour or so, but the name of the directory kept being changed to Pictures also.
I ran procmon and looked for a SUCCESS result on the creation of desktop.ini. This let me narrow the "culprit" to the Windows Runtime Broker service, and a post (http://www.tenforums.com/network-sharin ... post291643) on how to disable it. However, not only would that have required rebooting my computer—but it seems as if this doesn't really disable it altogether anyway, since, even though marked as disabled, Windows will still start it on its own for certain tasks. (Indeed, after stopping the service manually I would find it started again.)
I decided to rename the two DLL files that are responsible: timebrokerclient.dll and timebrokerserver.dll in C:\Windows\System32. It turns out that these files are owned by TrustedInstaller, and I was unable to rename them. Not letting that stop me, I used a utility called RunAsTI (https://github.com/jschicht/RunAsTI). This utility runs a command prompt after cloning the TrustedInstaller token and assigning it to the new process.
After renaming both of these DLLs, and preventing the service from being started, I no longer have desktop.ini files be recreated—nor have I observed my C:\Downloads directory being renamed.
Note: It seems that without this service, Windows Store apps cannot run. However, I don't use any Windows Store apps—so this is a non-issue for me at the moment.
I ran procmon and looked for a SUCCESS result on the creation of desktop.ini. This let me narrow the "culprit" to the Windows Runtime Broker service, and a post (http://www.tenforums.com/network-sharin ... post291643) on how to disable it. However, not only would that have required rebooting my computer—but it seems as if this doesn't really disable it altogether anyway, since, even though marked as disabled, Windows will still start it on its own for certain tasks. (Indeed, after stopping the service manually I would find it started again.)
I decided to rename the two DLL files that are responsible: timebrokerclient.dll and timebrokerserver.dll in C:\Windows\System32. It turns out that these files are owned by TrustedInstaller, and I was unable to rename them. Not letting that stop me, I used a utility called RunAsTI (https://github.com/jschicht/RunAsTI). This utility runs a command prompt after cloning the TrustedInstaller token and assigning it to the new process.
After renaming both of these DLLs, and preventing the service from being started, I no longer have desktop.ini files be recreated—nor have I observed my C:\Downloads directory being renamed.
Note: It seems that without this service, Windows Store apps cannot run. However, I don't use any Windows Store apps—so this is a non-issue for me at the moment.