Windows 7 access denied to executables.. by what?

I think the issue you are seeing is related to the thumbs.db that Windows explorer creates. Try to disable this, reboot and see if the problem reproduces.

To disable thumbs.db open Group Policy editor (gpedit.msc), go to User Configuration -Control Panel > Administrative Templates-Folder Options > Windows Components-Viev tab > Windows Explorer. find the "Turn off the caching of thumbnails in hidden thumbs.db files" and enable itDo Not Cache Thumbnails.

If it does't work I would try investigating it using Sysinternals Process Monitor. use it to watch who is accessing the folder when you get an access denied. see if it is actually an access denied or a sharing violation which means someone is holding the file.


Are you sure that you do not have any security product installed of any kind ?

The scenarios you describe are compatible with the theory that some product is accessing every executable file that is accessed by you in any possible way, making exclusive access to it impossible. This does not have to be an antivirus, it could be for example be an indexer for fast search or whatever (even a virus).

One can test this theory by booting in Safe mode where no products except for Windows are launched at all.

The best tool for tracing file accesses is Process Monitor. Another excellent tool for finding all startup products and turning them off and on again is Autoruns.


File or directory can be opened from kernel mode, then

handle -a

won't show it and ProcMon will show IRP requests from/to System process.

There's a part of Windows Kernel which is mapped to all processes and there's another part of Windows Kernel which runs in separate process. The latter is called Windows Executive.

So this caused by file or directory opened from kernel mode in Windows Executive process.


It may be Explorer reading icons and metadata from the exe.