Cmdt doesn't work when trying to delete Windows Defender Log files. Result is access denied. GUI as well as Command prompts Code: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service>cmdt_x64.exe -cli del *.log
TrustedInstaller won't help at all here because the restriction is enforced directly in the kernel. I'm actually thinking about building a tool to bypass this. The way to do it is via a BYOVD approach, leveraging a signed driver like IObitUnlocker.sys to execute low-level deletion. The key is to construct a raw IRP packet and send it directly to the underlying file system device object (Ntfs.sys / ReFs.sys), completely bypassing the Filter Manager (FltMgr.sys). By routing the I/O request below the Anti-Malware altitude, you effectively blindsided WdFilter.sys and its pre-operation callbacks. Otherwise, you're not getting past it on a live system. P.S. I’ve actually written my own custom driver called kvcstrm which has god-mode privileges and covers all possible primitives. It’s unsigned, but since I can map/load it anyway, I’ll either use that or just leverage a signed vulnerable one.
Code: @echo off if /i "%UserName%" == "SYSTEM" (Goto GotAdmin) else (reg query "HKLM\SYSTEM\ControlSet001\Control\MiniNT" 1>nul 2>nul&&Goto GotAdmin) :BatchGotAdmin Set _Args=&Set Args=%* if `%1` neq `` Set "_Args=%Args:"=""%" if exist %WinDir%\System32\fltMC.exe fltMC 1>nul 2>nul||(echo CreateObject^("Shell.Application"^).ShellExecute "cmd.exe","/c """"%~f0"" %_Args%""",,"runas",1 >"%TEMP%\getAdmin.vbs"&(CScript 1>nul 2>nul&&CScript //nologo "%TEMP%\getAdmin.vbs" 1>nul 2>nul||"%TEMP%\getAdmin.vbs" 2>nul)&del /f /q "%TEMP%\getAdmin.vbs" 2>nul&Exit /b) :GotAdmin Pushd "%CD%"&cd /d "%~dp0" schtasks -create -f -sc onStart -ru "NT AUTHORITY\SYSTEM" -tn DWDH -tr "cmd /c cd /d 'C:\ProgramData\Microsoft\Windows Defender\Scans' & rd /s /q History\Service & del /f mpenginedb.db* & schtasks /delete /f /tn DWDH" >nul 2>nul Exit
Early ForceIO build I’m posting an early ForceIO build. It is a tiny standalone client for the signed IObit Unlocker driver and can remove Defender-protected quarantine/log files where TrustedInstaller elevation is not enough. The real code is small; most of the EXE is checksum padding. IObitUnlocker.sys verifies the caller EXE against hardcoded checksums from the original IObitUnlocker.exe, so I pad my binary to match them instead of patching the signed driver. The driver remains untouched and normally signed. Tomorrow I’ll publish a full write-up on my site and I’ll continue testing all IOCTL combinations. The goal is to polish ForceIO into a clean, fast replacement for the bloated original GUI, reproducing every useful operation with much less overhead. Treat it as an early test build for now. Use it only on files you really intend to remove.
Sorry, but for me the double prompt is back. Admin Session and Non-Admin: Microsoft Windows Pro [Version 10.0.22631.7219] Noticed that an invalid command doesn't show any output: 'netsession' is not recognized as an internal or external command, operable program or batch file. Code: U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> cmdt_x64.exe -cli netsession U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> cmdt_x64.exe -cli net session U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026> U:\SwApps\Tools4Maint\CmdElevation\CmdT\cmdt12_07_2026>There are no entries in the list. f8787bdc7968469c6c00b2c159e1aca825ff56ce9773577688b33a69e7ecbf05 ?SHA256*cmdt_x64.exe --a-- W32 APP ENU 1.0.0.1 shp 31,232 01-01-2030 cmdt_x64.exe
Quick follow-up on the previous fix. Two more things surfaced after that build went out: 1. What looked like a second UAC prompt on some setups turned out to be my own relay code re-elevating through ShellExecuteExW("runas") even when the caller was already admin -- "runas" can pop a consent dialog a second time even from an elevated process. Fixed properly now: the already-elevated path captures output entirely in-process (local temp file + direct token duplication), no ShellExecuteExW involved at all when already admin. Zero prompts past the first one, verified with redirect/pipe/plain console, elevated and non-elevated. 2. Separately: the GUI never scaled for PerMonitorV2-aware displays. The manifest declares PerMonitorV2 but the window/controls were laid out with fixed 96-DPI pixel values, so on scaled displays (125%/150%/etc) the window rendered tiny with clipped/cramped controls. Fixed: DPI queried via GetDpiForWindow/GetDpiForSystem, every control coordinate scaled accordingly, and the window's total size is now computed from the desired client area via AdjustWindowRectExForDpi instead of a guessed constant, so caption/menu/border overhead is correct regardless of theme or DPI. Tested through the terminal at several DPI scales, elevated and non-elevated shells.
Still have double prompt on non-admin. Batch file doesn't show this, but starting a non-admin prompt and running cmdt from there does. Code: U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>cmdt_x64 -cli net session U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT> U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>There are no entries in the list. Also, is it possible to add showing stderr output when an error is indicated in addition to only stdout? I noticed the old -cli method showed stdout on a separate line like it should. This is no longer the case. Code: U:\SwApps\Tools4Maint\CmdElevation\CmdT>cmdt_x64 -cli net session There are no entries in the list. U:\SwApps\Tools4Maint\CmdElevation\CmdT\CmdT>There are no entries in the list. Sorry for all the nitpicking. I hope you aren't being annoyed by my comments. Still a great useful tool..
This version doesn't work on Windows 7 any more. Most of the previous versions (the ones I tried) did.
I'm not mad—it's a tool for you guys, so I've gotten back to work on it. Scaling and modern Windows features have broken compatibility with older versions of Windows. I'm creating fallback versions and adding two versions of cli-gui. I'll upload them again after testing.
Console is good now. Double-clicking GUI opens and closes it immediately. Run as administrator GUI is displayed normally.