Agent Procedures - WriteFile() fails to write files to C:\Windows\system32


You have an Agent Procedure that tries to write a file to the C:\Windows\system32\ directory.

The procedure executes without failure, but the file does not appear to be written to the specified directory


The Agent service Agentmon.exe is a 32bit Application.

32bit Applications are not able to access the 64bit file system on 64bit machines.

When a 32bit process tries to write to a 64bit directory, registry key or other 64bit only part of the OS, Windows will intercept this and redirect the process to the 32bit location silently.

In this case, Windows will intercept the call to the 64bit C:\Windows\system32\ directory and will in fact save the file in the 32bit folder C:\Windows\syswow64\


Add a step to your Agent Procedure to ExecuteShellCommand() and either copy, or move the file from the C:\Windows\syswow64\ directory to the C:\Windows\system32\ directory.

Make sure that you execute this step in a 64bit shell as System.

All versions.

Was this article helpful?
1 out of 1 found this helpful
Have more questions? Contact us
Provide feedback for the Documentation team!