When examining the root of the Windows system drive, usually C:\, you may notice two unusually named hidden folders:
C:\$WINDOWS.~BT
C:\$Windows.~WS
Their strange names can make them look suspicious. In most cases, however, these are legitimate temporary folders created by Microsoft Windows during an operating-system upgrade, feature update, reset, or installation process.
They are not normally evidence of malware, unauthorized access, or disk corruption. They may, however, occupy a significant amount of storage space after an upgrade has finished.
This guide explains what these folders are, why they appear, when they can be deleted, and the safest ways to remove them.
What Is the $WINDOWS.~BT Folder?
$WINDOWS.~BT is a hidden system folder used by Windows Setup.
It may be created when Windows:
- downloads or installs a major feature update;
- upgrades from one Windows release to another;
- performs an in-place repair installation;
- prepares installation files;
- runs the Windows Installation Assistant;
- attempts an upgrade that later fails or is cancelled.
The folder can contain setup resources, compatibility information, migration data, temporary installation files and diagnostic logs.
Microsoft’s Windows Setup documentation explicitly references $Windows.~BT as a location used during the setup process, including for scripts that run after installation.
On a computer that has recently completed an update, the folder may remain because Windows has not yet performed its automatic cleanup.
What Is the $Windows.~WS Folder?
$Windows.~WS is also associated with Windows installation and upgrade operations.
It is commonly created when using tools such as the Windows Installation Assistant or Media Creation Tool. It may contain downloaded installation sources and files required to start or continue the operating-system upgrade.
The exact contents depend on how the installation was initiated. For example, it may include setup executables, compressed Windows image files, installation media or temporary working files.
Microsoft community guidance generally identifies both $Windows.~WS and $WINDOWS.~BT as folders left behind by a major Windows upgrade or reset.
Why Do the Folder Names Begin With a Dollar Sign?
The dollar sign does not mean the folders are malicious.
Microsoft uses unusual names for some temporary and system-managed directories so that they are less likely to conflict with ordinary user folders.
The folders are normally marked as hidden and may also have protected system attributes. As a result, they might not appear in File Explorer unless hidden and protected operating-system files are visible.
Are $WINDOWS.~BT and $Windows.~WS Viruses?
Normally, no.
Their presence in the root of the Windows system drive is expected after an upgrade or installation attempt. A genuine folder is commonly found at:
C:\$WINDOWS.~BT
C:\$Windows.~WS
However, a familiar-looking folder name does not guarantee that every file inside it is legitimate. Malware can sometimes imitate system names.
A security scan is sensible when:
- the folder is located somewhere unusual;
- executable files inside it run automatically;
- Windows has not been upgraded or repaired recently;
- the folder repeatedly reappears without Windows Update activity;
- antivirus software reports suspicious content;
- file ownership or digital signatures appear abnormal.
To check a folder, right-click it and select Scan with Microsoft Defender. A full system scan can also be started from Windows Security → Virus & threat protection → Scan options.
Is It Safe to Delete These Folders?
They can generally be removed after the Windows installation or upgrade has completed successfully.
Before deleting them, confirm that:
- Windows Update is not currently downloading or installing an update;
- no restart is pending;
- the computer starts and operates normally;
- you do not intend to resume a cancelled upgrade;
- you no longer need the setup logs for troubleshooting;
- important files are backed up.
Do not delete these folders while an upgrade is still in progress. Doing so could interrupt the installation or force Windows to download the update files again.
Windows may also recreate the folders during a future upgrade.
Important Warning About Returning to a Previous Windows Version
Windows may retain files from the previous operating-system version for a limited period after an upgrade.
Microsoft states that the previous Windows installation is normally removed automatically ten days after an upgrade. Removing the previous installation manually is irreversible and eliminates the option to return to that earlier version.
The rollback files are primarily associated with the Windows.old folder, but Windows cleanup may present several related installation items together.
Carefully review every selected cleanup category. Do not remove Previous Windows installation(s) when you still need the option to return to the earlier Windows version.
Method 1: Remove the Folders Through Windows Settings
This is the safest and most strongly recommended method.
Windows can identify temporary installation files and remove them without requiring you to manually change folder permissions.
Windows 11
- Open Settings.
- Select System.
- Select Storage.
- Open Temporary files or Cleanup recommendations.
- Allow Windows to calculate the available cleanup items.
- Look for entries such as:
- Temporary Windows installation files;
- Windows upgrade log files;
- Windows Update Cleanup;
- Previous Windows installation(s).
- Select only the categories you no longer need.
- Click Remove files or Clean up.
Microsoft recommends Storage Sense and Cleanup recommendations for identifying and deleting unnecessary temporary and system files.
Windows 10
- Open Settings.
- Select System.
- Select Storage.
- Select Temporary files.
- Wait for Windows to scan the drive.
- Review the available installation and update cleanup categories.
- Select the appropriate items.
- Click Remove files.
Do not automatically select the Downloads category unless you genuinely want to delete files from the Downloads folder.
Method 2: Use Disk Cleanup
Disk Cleanup remains useful when the folders are not removed through Storage settings.
- Open the Start menu.
- Search for
Disk Cleanup. - Right-click Disk Cleanup.
- Select Run as administrator.
- Select the Windows system drive, normally
C:. - Click Clean up system files.
- Select the system drive again if prompted.
- Review the available categories.
- Select relevant entries such as:
- Windows Update Cleanup;
- Temporary Windows installation files;
- Windows upgrade log files;
- Previous Windows installation(s).
- Click OK.
- Confirm by selecting Delete Files.
Microsoft documents Disk Cleanup as a supported way to delete temporary and system files when additional space is required.
Restart the computer after cleanup and check whether the folders remain.
Method 3: Delete the Folders Manually
Manual deletion should be treated as a fallback, not the first option.
Before proceeding:
- restart the computer;
- install or cancel any pending Windows updates;
- verify that no Windows upgrade is running;
- create a backup or restore point;
- open Command Prompt with administrator privileges.
Open the Start menu, type cmd, right-click Command Prompt, and select Run as administrator.
Run the following commands for $WINDOWS.~BT:
takeown /F "C:\$WINDOWS.~BT" /R /D Y
icacls "C:\$WINDOWS.~BT" /grant "%USERNAME%":F /T
rd /S /Q "C:\$WINDOWS.~BT"
Then run the following commands for $Windows.~WS:
takeown /F "C:\$Windows.~WS" /R /D Y
icacls "C:\$Windows.~WS" /grant "%USERNAME%":F /T
rd /S /Q "C:\$Windows.~WS"
These commands:
- take ownership of the folder;
- grant the current account full control;
- remove the folder and all its contents.
Check the paths carefully before pressing Enter. The rd /S /Q command permanently deletes the selected directory without moving it to the Recycle Bin.
Do not modify the command to point at C:\Windows, C:\, or another important system directory.
What to Do If Access Is Denied
An “Access is denied” message usually means that:
- the folder is still being used by Windows Setup;
- a file is locked by a running service;
- the terminal was not opened as administrator;
- the folder has protected system permissions;
- an update or restart is still pending.
Try the following:
- Restart Windows.
- Check Settings → Windows Update.
- Complete any pending installation or restart.
- Run Storage cleanup again.
- Run Disk Cleanup as administrator.
- Use manual deletion only after the first two cleanup methods fail.
Repeatedly forcing permissions while Windows Setup is active can damage an unfinished upgrade.
Why Do the Folders Return?
The folders may reappear when Windows:
- downloads another feature update;
- retries a failed update;
- runs the Installation Assistant;
- performs an in-place repair;
- prepares an operating-system upgrade;
- creates fresh setup logs.
Reappearance during a legitimate Windows Update process is normal.
If they return immediately after deletion and no update appears to be running, check the Windows Update history and run the Windows Update troubleshooter.
Microsoft recommends using the Windows Update troubleshooter when update components repeatedly create temporary files or fail to complete properly.
How Much Space Can Be Recovered?
The amount varies considerably.
A nearly empty leftover folder might occupy only a few megabytes. A folder containing complete installation sources can consume several gigabytes.
Check the size by:
- opening File Explorer;
- navigating to
C:\; - right-clicking the folder;
- selecting Properties.
Windows Settings normally displays the amount of recoverable space before cleanup, making it easier to determine whether removal is worthwhile.
Should the Folders Be Deleted Just Because They Exist?
Not necessarily.
There is no urgent need to delete them when:
- sufficient disk space is available;
- Windows has only recently upgraded;
- the computer may need to return to an earlier version;
- an upgrade failure is still being investigated;
- setup logs may be needed by technical support.
Removing them is most useful when the upgrade has completed, the computer is stable and storage space is limited.
Frequently Asked Questions
Can I delete $WINDOWS.~BT from File Explorer?
Possibly, but Windows may block deletion because of system permissions. Storage settings or Disk Cleanup is safer than changing ownership manually.
Can I delete $Windows.~WS?
Usually yes, after the associated installation or upgrade has finished. Deleting it during an active upgrade can cause the process to fail or require the installation files to be downloaded again.
Will deleting these folders damage Windows?
Deleting leftover folders after a successful upgrade should not damage the current installation. Deleting them during an active or incomplete upgrade may cause installation problems.
Will they go to the Recycle Bin?
Large protected system folders may be deleted permanently. Command-line removal using rd /S /Q bypasses the Recycle Bin completely.
Can the folders be located on another drive?
They are usually created on the system drive, but Windows Setup may use another drive when additional storage is required. Confirm that the folders are genuinely associated with Windows Setup before removing them from an unexpected location.
Why can I not see them?
They are normally hidden system folders. File Explorer may conceal them unless hidden items and protected operating-system files are displayed.
Are they related to Windows.old?
They can be created during the same upgrade process, but they serve different purposes. Windows.old contains the previous Windows installation, while $WINDOWS.~BT and $Windows.~WS generally contain setup, download, migration and diagnostic resources.
Final Recommendation
$WINDOWS.~BT and $Windows.~WS are normally legitimate Windows installation folders rather than viruses.
They may be deleted when:
- the upgrade has finished;
- Windows Update has no pending operation;
- the computer works correctly;
- rollback and setup troubleshooting are no longer required.
Use the following order:
- Settings → System → Storage
- Disk Cleanup → Clean up system files
- Administrator Command Prompt, only as a last resort
The built-in cleanup tools are preferable because they allow Windows to decide which temporary installation files are no longer required, reducing the risk of deleting files still needed by an unfinished update.
