5 Extra ways to clean up disk space in Windows Server

Reading Time: 10 Minutes

Disk cleanup in Windows Server 2012 (R2) using DISM is one of the most popular posts here on Saotn.org. It’s also valid for Windows Server 2016. So apparently, disk space usage is an issue on Windows Server. And that made me wonder: what more ways to clean up disk space in Windows Server are there?

Extra ways to clean/free up disk space in Windows Server #

Windows logs a lot. Depending on the task your Windows Server has, IIS web server for example, you can find logfiles all over the place. But not only logfiles from services, also logfiles created by installers, temporary files, Windows Error Reporting (WER) crash dumps, et cetera. They all use up a lot of disk space.

Advertisement:

In this post I’ll provide you with 5 ways to clear up files and free up disk space in Windows Server 2016 (and 2012 R2) without using the Disk Cleanup Utility.

Want to know how to move an user’s Documents folder? Or how to move the SoftwareDistribution folder? Then please read my previous article How To: Disk Cleanup in Windows Server 2012 (R2) using Deployment Image Servicing and Management.

If disk space usage is an issue on your system, I’m sure you’ve disabled System Restore by now. I’m not addressing that, in this article you’ll learn about the other locations large files resides that can be removed safely.

Windows Pagefile.sys #

A system managed Pagefile.sys (also known as a “page file” or “paging file”) can take up gigabytes of hard disk space. Windows needs and uses this file as swap: Windows swaps information in and out this file as an extended memory or virtual memory. The pagefile has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. Therefore the pagefile must not be removed! On Linux though, you can turn off swap.

You can, however, move the Windows pagefile.sys to a different partition, when you have little space to spare on C: and more available on D: or E:. There are of course more than one ways to move the page file, by GUI or use PowerShell to move Windows pagefile. Have a look at the following examples to move the Windows Pagefile.sys:

Using PowerShell, move_pagefile.ps1. This script uses Get-WmiObject to query the system for the pagefile location, deletes it and sets a new value (d:\pagefile.sys in this example):

$server = $env:computername
$server = Get-WmiObject Win32_computersystem -EnableAllPrivileges
$server.AutomaticManagedPagefile = $false
$server.Put()
$CurrentPageFile = Get-WmiObject -Query "select * from Win32_PageFileSetting where name='c:\\pagefile.sys'"
$CurrentPageFile.delete()
Set-WMIInstance -Class Win32_PageFileSetting -Arguments @{name="d:\pagefile.sys";InitialSize = 0; MaximumSize = 0}

By Control Panel GUI (screenshots below these steps. Apologies for the image quality, I’m no pro ;-) ):

  1. Go to Control Panel > System and Security > System
  2. Click Advanced system settings, and click Settings… under Performance in System Properties
  3. In the Performance Options screen, click the tab Advanced, and click Change… under Virtual memory.
  4. Deselect Automatically manage page file size for all drives, select C: [system] and choose No paging file (Confirm with Set)
  5. Click Yes when asked to confirm the disabling of the paging file.
  6. Then select drive D: [data], choose System managed size and click Set again.
  7. Press OK, OK, OK to leave the screens.
to change Windows pagefile settings click performance in Windows Server Advanced System Properties
Windows Server Advanced System Properties
click advanced in Windows Server Performance Options to change pagfile settings
Windows Server Performance Options
Confirm your new pagefile settings
Windows Server Virtual Memory System Properties
Adjust Windows Server Virtual Memory Properties
Windows Server Virtual Memory Properties

A reboot is required after moving the Windows Pagefile! When C:\pagefile.sys wasn’t removed after the reboot you can do so manually if D:\pagefile.sys is successfully created.

Read KB2860880 if you want to know more about an appropriate Pagefile size.

(please note, screenshots were taken from a small Hyper-V virtual machine)

Windows Error Reporting #

The Windows Error Reporting (or WER) service enables users to notify Microsoft of application faults, kernel faults, unresponsive applications, and other application specific problems. Microsoft can use the error reporting feature to provide customers with troubleshooting information, solutions, or updates for their specific problems. Developers can use this infrastructure to receive information that can be used to improve their applications.

You can read more about the Windows Error Reporting here on MSDN.

Even though the Windows Error Reporting crash dumps can provide a lot of valuable information for system administrators, it can take up a lot of disk space. I use the Windows Error Reporting to keep track of website related PHP and ASP.NET crashes of the websites we host. You may often find an AppCrash_php-cgi.exe directory containting a Report.wer text document. .Wer files are ordinary text files you can open with Notepad and it may contain:

EventType=APPCRASH
[...]
NsAppName=php-cgi.exe
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=php-cgi.exe
Sig[1].Name=Application Version
Sig[1].Value=5.6.24.0
Sig[2].Name=Application Timestamp
Sig[2].Value=57904d99
Sig[3].Name=Fault Module Name
Sig[3].Value=php_opcache.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=5.6.24.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=5790503f
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=00006edc

Ok, so php_opcache.dll crashed with exception code c0000005 (possibly shared memory corruption – but that is for something else, another blog post). This information is also logged to your Application Event Log.

WER report log files can be found in a number of places on your hard drive, the most common are:

  • C:\ProgramData\Microsoft\Windows\WER\ReportQueue
  • C:\Users\%USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportQueue

These directories and files can take up a lot of disk space, you can safely remove them to regain some extra free space.

Deployment Image Servicing and Management (DISM) and Component-Based Servicing (CBS) log files #

Everytime you install a Windows Server Role or Feature, or install additional softare, this is logged. In C:\Windows\Logs you find a few sub directorys named BPA, CBS, DISM, MeasuredBoot and WindowsServerBackup.

The CBS and DISM directories are the most interesting. The directory C:\Windows\Logs\CBS belongs to Windows Component-Based Servicing, and is part of the servicing stack. The servicing stack is a set of files and resources that are required to service a Windows image or operating system. The servicing stack is available on all Windows Vista and Windows Server 2008 installations, as well as in the Windows Automated Installation Kit AIK (Windows AIK) and the Windows OEM Preinstallation Kit (Windows OPK). CBS provides various APIs (which are not publicly available) to its client installers to service the operating system components.

Client installers such as Windows Update or Windows Installer work with CBS to enumerate, install, update, and uninstall component packages on the destination operating system. CBS interacts with the Component Servicing Infrastructure to perform the necessary system changes (source).

CBS log files are rotated so to speak, and older -renamed- CBS log files may be removed. CBS log file are renamed to CbsPersist_[date+timestamp].log. Per default, these logs are compressed, so they take up less space than their size Windows Explorer shows.

The above is also valid for the DISM log files you find in C:\Windows\Logs\DISM. You can safely remove old, renamed dism.log files. When there aren’t any, and your current dism.log file is very large, the stop Windows services like Windows Module Installer (TrustedInstaller) and Windows Update (wuauserv) to remove the file.

Windows Temp and User Temp temporary files locations #

The following temporary files locations can be emptied safely:

  • C:\Windows\Temp
  • C:\Users\%USERPROFILE%\AppData\Local\Temp

You can often find old Windows Update installation logs in your C:\Users\%USERPROFILE%\AppData\Local\Temp folder, which may take up lots of unnecessary disk space.

IIS HTTP.SYS log files – in case of IIS web server and SMTPSvc Badmail #

Are you running IIS as a web server? Then I bet you can free up a ton of extra disk space by simply deleting old HTTP API log files. The HTTP.SYS driver logs some requests it couldn’t handle to C:\Windows\System32\Logfiles\HTTPErr. Some errors that occur in an HTTP-based application are automatically handled by the HTTP API instead of being passed back to an application for handling. This behavior occurs because the frequency of such errors might otherwise flood an event log or an application handler.

Have a look at them, and if you want more information about the log content I advice you to read Error logging in HTTP APIs.

IIS SMTPSvc Badmail
When you’re running IIS SMTP service, it logs all emails that couldn’t be delivered into the directory C:\inetpub\mailroot\Badmail. After investigation, as to why the email couldn’t be delivered, you can remove these files. Bounces are dropped into the C:\inetpub\mailroot\Drop directory.

Look into why those mails bounced and delete them too.

Conclusion cleaning up extra disk locations #

In this article I showed you some locations on your disk to clear up extra space, by removing various old log files. This goes perfectly along side the tip to use DISM to perform disk cleanup in Windows Server.

Did you notice that article also showed you how to move your user’s Documents folder and Windows Update SoftwareDistribution folder?

 

Advertisement:

One Reply to “5 Extra ways to clean up disk space in Windows Server”

Hi! Join the discussion, leave a reply!