Endpoint Protection

 View Only

Pending File Rename Operations 

Dec 14, 2009 05:02 PM

Most of the time when we are in a process of installing Symantec Products , we get an error “Symantec Endpoint Protection has detected that there are pending system changes that require a reboot. Please reboot the system and rerun the installation.”
What we do is open the registry and navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager and locate
PendingFileRenameOperations and rename it to  PendingFileRenameOperations2 and then try to install the product.
But why do we get the error?
The fact that executable images and DLLs are memory-mapped when they are used makes it impossible to update core system files after Windows has finished booting. The MoveFileEx Windows API has an option to specify that a file move be delayed until the next boot. Service Packs and hotfixes that must update in-use memory mapped files install replacement files onto a system in temporary locations and use the MoveFileEx API to have them replace otherwise in-use files. When used with that option,
MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager. These registry values are of type MULTI_SZ, where each operation is specified in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
The PendingFileRenameOperations key stores the names of files to be renamed when the system restarts. It consists of pairs of file names. The file specified in the first item of the pair is renamed to match the second item of the pair. The system adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until the system is restarted and they are renamed. This entry is not created by the Operating System.
In order to prevent such things from happening in the, it is mandatory to reboot the server after installing any application/driver when it requests for a reboot immediately.

0 Favorited
0 Files

Tags and Keywords


Oct 22, 2017 04:47 PM

Best way to do some rename operations is use the Batch file rename tools. You can easily found hier  BatchRenameFiles.org

Oct 21, 2017 03:11 PM

Many peoples have problems when try this instructions abowe, so to avoid problems I use Batch Rename Files Tool. You can easily found hier BatchRenameFiles.org 

Apr 06, 2016 04:04 AM

I tried below processes:

1. run clean wipe ,and than  reinstall

2.clear all registry keys..

go to :

HKLM\SYSTEM\CurrentControlSet\ Control\Session Managerand delete the key called PendingFileRenameOperations




Apr 06, 2016 03:57 AM

When i m trying to install it,it take some time to process and after 1 or 2 min it will disappear from desktop.

i tried all the process for this issue...

suggest me..


Feb 25, 2013 07:39 PM

Cool, this article is a life saver and time saver as well :-)

Thank you for sharing !

Oct 06, 2010 03:32 PM

How about a link the actual article?  I too have been struggling with this... Reg hacks, reinstalls, local admins, domain admins, eliminating UAC, you name it....


Does anyone have a link that WORKS? Testing this Win7 rollout has been smooth up until S.A.V.... Help?



Jun 06, 2010 11:02 AM

Try this article.  There is another key at the bottom with windowsupdate that you could try too.  My SEP install script looks at these and fixes them if you would like it.


Jun 06, 2010 10:42 AM

Changed the value did not help

Mar 17, 2010 08:40 PM

Hi All,

I need to delete the content of: HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX\Control\SessionManager\PendingFileRenameOperations to enable 64 bit client AV install, I've done manually on several workstation but how to automate this process in more than 10 clients ? sounds ridiculous if i have to send email for every affected users or even call them one by one to use regedit ?

Mar 05, 2010 06:03 PM

Linking to another thread about Reboot pending that I had some opinions about..


Looking further into the launch conditions within the msi I see the MsiSystemRebootPending Property being used. If you read the requirements it states:
" Windows Installer 5.0 on Windows Server 2008 R2 or Windows 7. Windows Installer 4.0 or Windows Installer 4.5 on Windows Server 2008 or Windows Vista. Windows Installer 4.5 on Windows Server 2003 or Windows XP"

Not Supported in Windows Installer 3.1 and earlier versions I find this interesting considering SEP11 is checking for WI 3.1

Tools such as PendMove are using this same API process which may lead to more failed installations during the deployment phase. Not everyone has the opportunity to utilize server services and the Symantec Deployment tool. I'd like to see more effort into whether a pending reboot is really needed prior to the installation.

Jan 13, 2010 09:17 AM

 You forget to mention about  PendingFileRenameOperations  values which are situated in:

where x is number from 1 to 9.

and this values  should be deleted not renamed.
Please read our internal KBs more deeper.
They will cause a problem. 

Dec 17, 2009 10:15 AM

It's interesting that you bring this up.   Recently, we noticed that the update of Proactive Threat definitions have triggered this registry key thus preventing our Patch Management System from deploying security updates to managed computers.   FYI. 

Dec 15, 2009 04:54 AM

Thank you Prachand I say delete pending rename options everytime but i have no idea why it happend before. But i know now.
thank you.


Related Entries and Links

No Related Resource entered.