peass-ng/PEASS-ng · error · ArgumentException

MoveOptions.DelayUntilReboot is not allowed when using a net

Error message

MoveOptions.DelayUntilReboot is not allowed when using a network path.

What it means

Windows MOVEFILE_DELAY_UNTIL_REBOOT operations are processed before the network stack is available, so the source file cannot reside on a UNC/network share. AlphaFS checks Path.IsUncPathCore and throws ArgumentException("moveOptions") when DelayUntilReboot is combined with a network path.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Filesystem/File Class/File CopyMove/File.VerifyDelayUntilReboot.cs:43

namespace Alphaleonis.Win32.Filesystem
{
   public static partial class File
   {
      private static bool VerifyDelayUntilReboot(string sourcePath, MoveOptions? moveOptions, PathFormat pathFormat)
      {
         var delayUntilReboot = HasDelayUntilReboot(moveOptions);

         if (delayUntilReboot)
         {
            if (HasCopyAllowed(moveOptions))
               throw new ArgumentException(Resources.MoveOptionsDelayUntilReboot_Not_Allowed_With_MoveOptionsCopyAllowed, "moveOptions");


            // MoveFileXxx: (lpExistingFileName) If dwFlags specifies MOVEFILE_DELAY_UNTIL_REBOOT,
            // the file cannot exist on a remote share, because delayed operations are performed before the network is available.

            if (Path.IsUncPathCore(sourcePath, pathFormat != PathFormat.LongFullPath, false))
               throw new ArgumentException(Resources.MoveOptionsDelayUntilReboot_Not_Allowed_With_NetworkPath, "moveOptions");
         }

         return delayUntilReboot;
      }
   }
}

View on GitHub (pinned to 53fb989abc)

Solutions

1. Copy the file from the share to a local path first, then schedule the delayed move on the local file.
2. Remove MoveOptions.DelayUntilReboot and perform the network move immediately (handle sharing violations with CopyAllowed/retry instead).
3. Point the operation at a local drive path if a delayed move is mandatory.

Example fix

// before
File.Move(@"\\server\share\app.dll", @"C:\app\app.dll", MoveOptions.DelayUntilReboot); // ArgumentException
// after
File.Copy(@"\\server\share\app.dll", @"C:\app\app.dll.new", true);
File.Move(@"C:\app\app.dll.new", @"C:\app\app.dll", MoveOptions.DelayUntilReboot);

if (moveOptions.HasFlag(MoveOptions.DelayUntilReboot) && (sourcePath.StartsWith(@"\\", StringComparison.Ordinal)))
    throw new ArgumentException("DelayUntilReboot is not supported for UNC/network paths.");

static bool IsUncPath(string p) => p != null && p.StartsWith(@"\\", StringComparison.Ordinal);

try { File.Move(src, dst, MoveOptions.DelayUntilReboot); }
catch (ArgumentException ex) when (ex.ParamName == "moveOptions" && ex.Message.Contains("network"))
{
    // copy locally first, then schedule the delayed move on the local copy
    var local = Path.Combine(Path.GetTempPath(), Path.GetFileName(src));
    File.Copy(src, local, true);
    File.Move(local, dst, MoveOptions.DelayUntilReboot);
}

When it happens

Trigger: Calling File.Move / CopyMove with MoveOptions.DelayUntilReboot where sourcePath starts with \\server\share (or \\?\UNC\...).

Common situations: Deploy scripts or cleanup jobs that defer moves of files stored on network shares; moving logs/artifacts from a mapped-share location with DelayUntilReboot set.

Related errors

• Network path is not allowed for directory junction: [{0}]
• MoveOptions.CopyAllowed is not allowed when using the MoveOp
• Neither curl nor wget were found in victim, unset the SRVHOS
• Invalid URL, too many HTTP redirects
• Something failed downloading PEASS script from #{url_peass}

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/1293d8e06a2dc9b8. Report an issue: GitHub.