5 Extra ways to clean up disk space in Windows Server

Disk cleanup in Windows Server using DISM is one of the most popular posts here on [Saotn.org](https://www.saotn.org Sysadmins of the North). It is still valid for Windows Server 2016 and up. So apparently, disk space usage is an issue in Windows Server. Which made me wonder: what more ways to clean up disk space in Windows Server are there?

Extra ways to free up disk space in Windows Server

Windows logs a lot. Depending on the task your Windows Server has, IIS web server for example, you can find log files all over the place. But not only logfiles from services, also log files created by installers, temporary files, Windows Error Reporting (WER) crash dumps, et cetera. They all use up a lot of disk space.

In this post I'll provide you with 5 ways to clean up files and free up disk space in Windows Server 2016 (and Windows Server 2019, Windows Server 2012 R2) without using the Disk Cleanup Utility.

Want to know how to move an user's Documents folder? Or how to move the SoftwareDistribution folder? Then please read my previous article Disk Cleanup in Windows Server using Deployment Image Servicing and Management (DISM).

If disk space usage is an issue on your system, I'm sure you've disabled System Restore by now:

Disable-ComputerRestore "C:\", "D:\"

Let's continue to make more space available.

Windows Pagefile.sys

A system managed Pagefile.sys (also known as a "page file" or "paging file") can take up gigabytes of hard disk space. Windows needs and uses this file as swap: Windows swaps information in and out this file as an extended memory or virtual memory.

The pagefile has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. Therefore the pagefile must not be removed! On Linux though, you can turn off swap.

You can, however, move the Windows pagefile.sys to a different partition, when you have little space to spare on C: and more available on D: or E:. There are of course more than one ways to move the page file, by GUI or using PowerShell to move Windows pagefile.

Have a look at the following examples to move Windows Pagefile.sys:

This PowerShell snippet uses Get-WmiObject to query the system for the pagefile location, deletes it and sets a new value (d:\pagefile.sys in this example).

$server = $env:computername
$server = Get-WmiObject Win32_computersystem -EnableAllPrivileges
$server.AutomaticManagedPagefile = $false
$server.Put()
$CurrentPageFile = Get-WmiObject -Query "select * from Win32_PageFileSetting where name='c:\\pagefile.sys'"
$CurrentPageFile.delete()
Set-WMIInstance -Class Win32_PageFileSetting -Arguments @{name="d:\pagefile.sys";InitialSize = 0; MaximumSize = 0}

Steps to move Windows Page File pagefile.sys through Control Panel GUI. The screenshots are below these steps. Apologies for the image quality, I'm no pro :-)

1. Go to Control Panel > System and Security > System
2. Click Advanced system settings, and click Settings... under Performance in System Properties
3. In the Performance Options screen, click the tab Advanced, and click Change... under Virtual memory.
4. Deselect Automatically manage page file size for all drives, select C: [system] and choose No paging file (Confirm with Set)
5. Click Yes when asked to confirm the disabling of the paging file.
6. Then select drive D: [data], choose System managed size
7. click Set again
8. Press OK, OK, OK to leave the screens.

A reboot is required after moving the Windows Pagefile! When C:\pagefile.sys wasn't removed after the reboot you can do so manually if D:\pagefile.sys is successfully created.

Read KB2860880 if you want to know more about an appropriate Pagefile size. Moving the pagefile may break your Windows Server VM on Hyper-V.

Windows Server 2016 on Hyper-V stuck at stopping

Windows Error Reporting

The Windows Error Reporting (or WER) service enables users to notify Microsoft of application faults, kernel faults, unresponsive applications, and other application specific problems. Microsoft can use the error reporting feature to provide customers with troubleshooting information, solutions, or updates for their specific problems. Developers can use this infrastructure to receive information that can be used to improve their applications.

You can read more about the Windows Error Reporting here on MSDN.

Even though the Windows Error Reporting crash dumps can provide a lot of valuable information for system administrators, it can take up a lot of disk space.

I use the Windows Error Reporting to keep track of website related PHP and ASP.NET crashes of the websites we host. You may often find an AppCrash_php-cgi.exe directory containting a Report.wer text document. .Wer files are ordinary text files you can open with Notepad and it may contain:

EventType=APPCRASH
[...]
NsAppName=php-cgi.exe
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=php-cgi.exe
Sig[1].Name=Application Version
Sig[1].Value=5.6.24.0
Sig[2].Name=Application Timestamp
Sig[2].Value=57904d99
Sig[3].Name=Fault Module Name
Sig[3].Value=php_opcache.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=5.6.24.0
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=5790503f
Sig[6].Name=Exception Code
Sig[6].Value=c0000005
Sig[7].Name=Exception Offset
Sig[7].Value=00006edc

Ok, so php_opcache.dll crashed with exception code c0000005 (possibly shared memory corruption - but that is for something else, another blog post). This information is also logged to your Application Event Log.

WER report log files can be found in a number of places on your hard drive, the most common are:

• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• C:\Users\%USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportQueue

These directories and files can take up a lot of disk space, you can safely remove them to regain some extra free space.

Disk Cleanup in Windows Server

Deployment Image Servicing and Management (DISM) and Component-Based Servicing (CBS) log files

Every time you install a Windows Server Role or Feature, or install additional softare, this is logged. In C:\Windows\Logs you find a few sub-directories named 'BPA', 'CBS' (Component-Based Servicing), 'DISM', 'MeasuredBoot' and 'WindowsServerBackup'.

The CBS and DISM directories are the most interesting, in my opinion.

The directory C:\Windows\Logs\CBS belongs to Windows Component-Based Servicing, and is part of the servicing stack. The servicing stack is a set of files and resources that are required to service a Windows image or operating system. The servicing stack is available on all Windows Vista and Windows Server 2008 installations, as well as in the Windows Automated Installation Kit AIK (Windows AIK) and the Windows OEM Preinstallation Kit (Windows OPK). CBS provides various APIs (which are not publicly available) to its client installers to service the operating system components.

Client installers such as Windows Update or Windows Installer work with CBS to enumerate, install, update, and uninstall component packages on the destination operating system. CBS interacts with the Component Servicing Infrastructure to perform the necessary system changes (source).

CBS log files are rotated so to speak, and older -renamed- CBS log files may be removed. CBS log file are renamed to CbsPersist_[date+timestamp].log. Per default, these logs are compressed, so they take up less space than their size Windows Explorer shows.

The above is also valid for the DISM log files you find in C:\Windows\Logs\DISM. You can safely remove old, renamed dism.log files. When there aren't any, and your current dism.log file is very large, then stop Windows services like Windows Module Installer (TrustedInstaller) and Windows Update (wuauserv) to remove the file.

Windows Temp and User Temp temporary files locations

The following %TEMP% temporary files locations can be emptied safely:

• C:\Windows\Temp
• C:\Users\%USERPROFILE%\AppData\Local\Temp

You can often find old Windows Update installation logs in your C:\Users\%USERPROFILE%\AppData\Local\Temp folder, which may take up lots of unnecessary disk space.

I use the following PowerShell snippet to clean-up IIS' IUSR temporary files (everything older than 2 days):

function cleanup_c_users {
  $Path = "C:\Users\IUSR_*"
  $Daysback = "-2"
  $CurrentDate = Get-Date
  $DatetoDelete = $CurrentDate.AddDays( $Daysback )
	
  Get-ChildItem "$Path\AppData\Local\Temp" -Recurse | Where-Object { $_.LastWriteTime -lt $DatetoDelete } | Remove-Item -Recurse -Force
}

IIS HTTP.SYS log files - in case of IIS web server and SMTPSvc Badmail

Are you running an IIS web server? Then I bet you can free up a ton of extra disk space by simply deleting old HTTP Server API log files.

The HTTP.SYS driver logs some requests it couldn't handle to C:\Windows\System32\Logfiles\HTTPErr. Some errors that occur in an HTTP-based application are automatically handled by the HTTP API instead of being passed back to an application for handling. This behavior occurs because the frequency of such errors might otherwise flood an event log or an application handler.

Have a look at them, and if you want more information about the log content I advice you to read Error logging in HTTP APIs.

Relocate HTTP Server API Error Logging log files

You can easily move the HTTP.SYS HTTPErr log files to a different location. Relocate them to another partition to save disk space on your system partition. The HTTP Server API Error Logging location is configured in the Windows registry. Use these PowerShell commands to change its location to E:\log and enable logging:

Write-Host "[i] Configuring HTTP Server API Error Logging"
Write-Host "[ii] - change the default path"
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\HTTP\Parameters" -Name "ErrorLoggingDir" -Value "e:\log" -PropertyType String
Write-Host "[ii] - enable errorlogging (default value is TRUE, set to FALSE to disable)"
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\HTTP\Parameters" -Name "EnableErrorLogging" -Value "1" -PropertyType DWORD

IIS SMTPSvc Badmail

When you're running IIS SMTP service, it logs all emails that couldn't be delivered into the directory C:\inetpub\mailroot\Badmail. After investigation, as to why the email couldn't be delivered, you can remove these files. Bounces are dropped into the C:\inetpub\mailroot\Drop directory.

Look into why those mails bounced and delete them too.

Conclusion cleaning up extra disk locations

In this article I showed you some locations on your disk to clear up extra space, by removing various old log files. This goes perfectly along side the tip to use DISM to perform disk cleanup in Windows Server.

Did you notice that that article also showed you how to move your user's Documents folder and move Windows Update SoftwareDistribution folder?