A lifetime ago (back in July) I was struggling to understand why my Win 10 workplace laptop’s hard-drive was running out of storage space.
grand stream dreams: QuickPost: PowerShell Scripts and Win 10 Helps
Despite my best efforts the 500 GB HDD had gotten down to about 60 GB – 80 GB of free space despite some pretty severe Windows space-hog/temp-file cleaning work.
That post detailed a number of PowerShell scripts I was using to try to find out the source of the space usage.
Reminder – because this was a work-laptop, my use of the normal third-party storage analysis tools I would rely on was verboten.
After several weeks of running modified versions of many of these scripts I was nowhere closer to finding the issue. I had lots of data, but the results suggested that the file or folder where the space eating usage had happened was off-limits to typical admin-level scripting runs.
Just before giving up and planning for a system reimage, I had an epiphany; Windows 10 comes with a built-in Storage Sense platform to let you understand (at a very high-level) space usage of your local drives in a categorized manner!
How to manage Disk Space & Storage using Windows 10 Settings – The Windows Club
Go into Settings (the gear icon in Win 10), select “System”, on the left side-bar select “Storage”, then click on one of the local system drives at the top you want to explore under the “Storage” section.
Let it run for a moment and it will then give you a report of storage use.
In my case it was immediately apparent that the “System & reserved” section was where the maximum file-usage was occurring; way more than a baseline Win 10 laptop in our enterprise.
You can click on any section and dive deeper into that.
That revealed that I had over 250 GB of files related to “System Restore”.
This was an interesting find as our Group Policy turns off System Restore. A visual check of all the options and settings under “Manage system restore” confirmed these were all disabled…so what was there and how did it get there?
VSSAdmin to the rescue!
I opened an administrator-elevated CMD window and ran the following command:
vssadmin list shadows
That revealed one “orphaned” shadow copy file created quite some time before I actually noticed the space drain. A check of our operations logs for that timeframe couldn’t find any obvious actions or infrastructure routines that should have created it. So how it was triggered remains a mystery.
With the shadow copy ID known now I next ran this, using the actual ID # I found for that argument variable:
vssadmin delete shadows /Shadow={shadow copy ID}It ran for quite a while, but then returned back to the blinking prompt cursor.
Another “vssadmin list shadows” confirmed it was gone, and a look at the local drive properties showed my space usage was back to a normal level with lots of free space available again.
Mischief managed!
More resources:
- Windows 10 Storage and how to view disk space and how it is used (YouTube) – Learn Windows 10 and Computers
- Vssadmin - Microsoft Docs
- VSSADMIN - Windows CMD - SS64.com
- Shadow Copies – Delete - Windows 7 Help Forums
- How to Delete Individual System Restore Points in Windows? – WinHelp Online
- Diskshadow, VSSAdmin’s best friend - danblee.com
- SysAdmin Tools – EventSentry – This free collection of command-line and GUI tools is offered by EventSentry. Its got a big collection of specialized utilities that well-supplements the on-board tools. While I couldn’t have used them at work, the “datahog” cmd tool looked especially handy and cool.
Cheers!
Claus V.
No comments:
Post a Comment