Should you delete files in the WinSXS directory? And what’s the deal with VSS?


 

I like to read about how Windows is affecting peoples lives, specifically, the servicing components.  One of the common threads I noticed in my recent web trolling was the question “Can I delete the \Windows\Winsxs directory to save space?”.  This is usually asked in conjunction with what the directory does and why its consumed the space it has, but I’ve already covered that in prior posts.

So, to answer the question, the answer is simply: No.

Why?  Because the component store (\Winsxs) is needed to repair the OS binaries in the event that a file becomes corrupted or, in worst case scenarios, compromised.  There are a few directories in the component store so let’s look at them and what their general role is in Windows.

  1. \Winsxs\Catalogs:  Contains security catalogs for each manifest on the system
  2. \Winsxs\InstallTemp: Temporary location for install events
  3. \Winsxs\Manifests: Component manifest for a specific component, used during operations to make sure files end up where they should
  4. \Winsxs\Temp: Temp directory used for various operations, you’ll find pending renames here
  5. \Winsxs\Backup: Backups of the manifest files in case the copy in \Winsxs\Manifests becomes corrupted
  6. \Winsxs\Filemaps: File system mapping to a file location
  7. \Winsxs\<big_long_file_name>: The payload of the specific component, typically you will see the binaries here.

So, can you delete these?  Sure, you could I guess.  What would happen?  Well, it depends.  So long as the files in the \Windows\System32 directory are valid, most likely you wouldnt see any problems initially, the machine would “most likely” operate properly.  However, the first time you attempt to update a binary, apply a service pack or service a component, it’s going to fail because the backing components needed arent there.  The way the files end up in \System32 are via hardlinks.  This should help answer another common question I see regarding how VSS is used in servicing.  Short answer: It’s not.  We use NTFS hardlinks to project the file to the file system from the component store.  That’s why the \Winsxs directory is so important.  The files there can be seen as the “authoritative” versions on the file system.  When you encounter an issue and that binary needs to be replaced, running an SFC /SCANFILE against it will check the directories above and if the version doesnt match, it will re-project it so that its working.

Here’s an example of how you can see the hardlink via CLI:

C:\Windows\System32\drivers>fsutil hardlink list ntfs.sys
\Windows\System32\drivers\ntfs.sys
\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.16385_none_02661b64369ca03a\ntfs.sys

This isnt the best overall example but its one I use often as a quick and dirty way to see the links in the OS.  You can see that the NTFS file has a link to the \Winsxs directory and if that version of NTFS were to become corrupted, we could go back to the component store and find you a new copy.  The backup directory in \Winsxs is there in the event that the version in that directory has also become corrupted.  It’s a good way of having protection on the OS without consuming a huge amount of space. 

Also, as Andre mentions in the comment below, its worth noting that the new servicing structure does remove the $NTUninstall$ folders that many people have become accustomed to from Windows NT to Windows 2003.  Updates, if they are marked removable, no longer contain that structure.  Instead, updates are recommended to be removed via the Control Panel –> Programs  –> View Installed Updates path.  You can remove the updates via the appropriate switches in DISM.EXE or PKGMGR.EXE, but the control panel method tends to be cleaner.

Hope that helps.

–Joseph

Comments (173)

  1. Anonymous says:

    @Bear, thats the nature of the hardlinks (again, I have a blog on this too <G>).  Explorer will count the files twice because of the linking mechanisms.

  2. Anonymous says:

    but this only saves a small amout of HDD space. removing older Updates and the compression saves much more space.

  3. Anonymous says:

    What about Windows Embedded Standard 7?  It's very crucial for it to be as compact as possible in a limited device.  I have a HP t5740e and they're only made with 4GB of flash storage.  I've applied the latest updates from Microsoft Update and now I only have 700MB left free.  Windows reports Winsxs to be 1.8GB in size.  DSIM doesn't find anything to clean up either.   Is a WES user's only recourse to not apply patches and risk their device being hacked or infected?

    Will this be the case for Windows Phone 8 when it's released too?

    A fix must simply be found for Dll sprawl.

  4. Anonymous says:

    Drew;

    Boot critical is something we determine in house.  It's not anything you could update offline.

  5. Anonymous says:

    Yes, it sounds like you have more at work than just the directory size.  Run CheckSUR on the machine and see what it reports (KB947821)

  6. Anonymous says:

    No worries, I totally understand that.  I have a couple pieces of content on FoD in Win8/2012:

    blogs.technet.com/…/features-on-demand-in-windows-8-and-windows-server-2012.aspx

    blogs.technet.com/…/understanding-features-on-demand-and-role-persistence-in-windows-server-2012.aspx

    I'd like to assume you've read them but then I never assume anything 🙂

    –Joseph

  7. Anonymous says:

    In addition, there are other things, like Features on Demand which allow you to reclaim space in Windows 8.

  8. Anonymous says:

    Sure, send it to me via the contact link in the blog.

  9. Anonymous says:

    Correct 🙂

  10. Anonymous says:

    @fluffy;

    Thanks again for the well written comment.  I would love to say "we can agree to disagree" but we cant in this instance :).

    The information I have regarding how hardlinks work IS how they work.  I read your comments a couple of times to try and understand the differences we're having between what I am saying and what you're reading it as.  So, here goes:

    First, I'm not saying DU.exe isnt correct, just that we dont have ANY tool that accurately reports the usage of the component store.  You'll get ballpark figures, buts thats all they will be.  I can talk to Mark about DU offline and see what his opinion of this is.

    Second, you said: "If you're trying to tell me that a), the /winsxs directory is hardlinked to corresponding files in /winsxs and that b), these files can be altered in /windows but not /winsxs by affeting the same file record albeit through a different hardlink, then I am forced to disagree with you…"

    Actually, thats not what I am saying at all.  While you could change the file that lives in the Windows directory with a different version than the projected version of the file, it wouldnt impact the hardlinking of the original file.  For example, let's say I have FILEA.SYS which was installed during a clean installation.  Initially, if its a protected file, it will have two links, one in Winsxs and one somewhere in Windows.  To explorer.exe, this file will get counted twice and take up (file size * 2) in your view of disk space usage.  If you were to take ownership of the Windows directory, mount the VHD, whatever and then delete FILEA.SYS and relace the file in Windows to FILEB.SYS, you would end up with the following:

    FILEA.SYS is still hardlinked because it retains its own record in the MFT

    FILEB.SYS is NOT hardlinked and contains its own record in the MFT

    So, now we have these two files, each accounting for their (size *1) in terms of disk space usage.  Even at this point, the ability ot affect the servicing mechanisms on the machine is limited because I could run SFC /SCANFILE against FILEA.SYS and we would reproject it via its hardlink back to the Windows directory.  

    Where you break servicing in these cases is when you replace the files in Winsxs and Windows with different versions.  This affects us because we cant patch the file moving forward, it would report to the fix being installed that its parent files are absent.  Which in this case would be true because you've removed them.

    Lastly, I'm not trying to justify the size of the component store.  What I am trying to do is let people know why it appears to take up the space it does (which isnt accurately reported) and what folks should and should not do to alleviate the pressure they might see as a result of the component store.

    Let me know if that makes things any clearer than mud 🙂

    –Joseph

  11. Anonymous says:

    That's true Andre, and those we don't always need for servicing the operating system.  However the entire component store should never be compressed, that was the point I was trying to make.

  12. Anonymous says:

    Doug,

    Your complaint is not uncommon, it's one of the reasons I started this blog in the first place, to gather information that we could use to make Windows better.  Now I know that I am going to say may sound like the company man here, but for the most part, I like the way servicing is done in the OS now versus what we did in 2003 and earlier.  For me, its mostly because I get to deal with the aftermath, good or bad, of a servicing operation failures for the OS.  I cant tell you how many calls we used to get in NT-2000-2003 about someone applying a patch and a single binary failing to install bringing a server down.  For certain files, the only recourse was a rebuild because of the way the files had to "marry" together.  Add to that problems with recovery console, updates failing because of catalog issues, etc, and all in all, I think we're on the right track with what we're doing.

    Now thats not to say that the new servicing mechanisms are perfect, they arent.  I do know that a lot of the current mechanisms are in place because the storage issues of the past arent as relevant as they are today.  I know that certain configurations still have issues, but overall, its not the same problem as in the past.  Additionally, the new issues tend to be harder to troubleshoot because in the old days it was easier to just replace a binary and be done with it for a lot of cases (as long as you knew the binary).

    However with suggestions like those that we get here, we're looking at ways of making things better.  Developers on the teams read this blog and its comments for ways to make Windows better for everyone, so dont feel the need to not "shoot the messenger".  By contrast, fire away!  It's how things are made better and I welcome the chance to be that sounding board for you all.

    –Joseph

  13. Anonymous says:

    Thanks for deleting that comment and sorting out this commenting thing.

    Alright, you're saying that DU is incorrect. You know what? I'll buy that. At face value DU seems to be the easy way to verify physical disk usage versus logical disk usage but it is a Microsoft product and may not be compatible with another Microsoft product/feature. I've used hardlinks and symlinks for over a decade now and have come up with some tools that make managing very large volumes with a high incident of duplicate files a simple task.

    First let me explain a few details about the example system I'm using to try and make sense of what you're saying. This laptop was new in February 2008 and has the original CPU, one damaged RAM slot but the other is occupied with 2 GB DDR2 , an upgraded SATA I 250 GB drive (in case I have to say it, the formatted usable capacity is 232 GiB) and somehow it's still going strong as a development testing machine. I'm currently testing a several month old in-house OEM packaging of Windows 7 which is actually doing quite well.

    Now let me go on to say that on this 250 billion byte drive there are 287 billion logical bytes and change with 247 billion physical bytes which puts a rough figure of 114% disk usage without factoring in free-space and without any NTFS compression. To say I use heavy NTFS hardlinking is an understatement. If you read my forum post on running Duplicate Cleaner against /windows you might get the false impression that I do this on production systems; I don't and wouldn't under most circumstances. When I've tested this method on VMs, however, the results directly contradict your statements. Here's a simple test I invite you to perform if you have any questions.

    • Install Windows 7 of any 64 bit pre-service pack SKU on any VM platform with dynamic expanding disk image support; under Hyper-V this is a simple matter although VirtualBox and VMware Player both support this and are freely available.

    • Set the sparse flag on the VM disk image file: `fsutil sparse setflag vm_test.vhd`

    • Zero the VM's free-space. This can be accomplished using a zero device driver and a batch script ( http://goo.gl/TYRFc ) or a free tool ( http://goo.gl/V2yeE ). These last two steps are best practices for VMs and should be automated on production systems, anyway.

    • Measure the VM disk image file size using DU or the Windows GUI "size on disk" value from the host OS as well as reported by the pie-chart in the volume properties within the VM.

    • Run Windows Update until the system is completely up-to-date.

    • Without running any post-update cleanup, re-zero the VM free-space.

    • Measure the VM disk image again, same as the first time.

    • Take the VM offline and attach the VM disk image to another running Windows instance.

    • Run Duplicate Cleaner with all protections off and on only the /windows directory and hardlink the results as per my forum post in March 2010 ( http://goo.gl/6U9pE ).

    • Zero the free-space a last time.

    • Measure the VM disk image once more, specifically taking note of the volume usage as reported from within the VM.

    I have performed this test with many different conditions since the idea first came to me over a year ago and the results are consistent and verify that the /winsxs directory is not hardlinked as you suggest and that it is possible to determine the actual disk usage of the /windows and /winsxs directories.

    I further want to echo the sentiment of Dean from his comment here: http://goo.gl/rZ4u6

    A hardlink as you explain it and I understand it and as it appears to work based on rigorous testing does not seem to allow any deviance between the data in any two hardlinks of a single file. If you're trying to tell me that a), the /winsxs directory is hardlinked to corresponding files in /winsxs and that b), these files can be altered in /windows but not /winsxs by affeting the same file record albeit through a different hardlink, then I am forced to disagree with you based on the verifiable evidence I have presented in both my comments here and your own explanations of the NTFS hardlinking feature.

    Again, what you are suggesting does not add up. I support the /winsxs directory and understand its necessity and function but it's too big and does take up the space you say it doesn't. Running cleanup routines and forcibly hardlinking the files that are bit-wise duplicates will neuter the /winsxs directory and still allow proper function of windows update with the side effect of disabling Windows self-healing features which can be supplemented with proper backup. This is a tested and verifiable fact, it is not in dispute.

    Your #3 bullet would appear correct at first glance if you stay within the scope of a single running instance of Windows but that is not the case. I've tested this previously using external methods both Windows and non-Windows based which have verified my findings. Windows has some quirks in file system accounting for the inexperienced user unfamiliar with the logical/physical volume disparities but again I'm not such a user.

    As to #4 I quite agree, and was able to bring that down substantially but the user still complained and the only option I could offer was a fresh install. This was in the Conficker heyday and the laptop in question was running Vista as installed with a "designed for Windows XP; Vista compatible" sticker on it.

    Finally: the point is that the information you present to justify the size of /winsxs is inaccurate, not the use nor abuse of the files themselves which is a choice to be left to user discretion.

  14. Anonymous says:

    I'm not sure what NESSUS uses to check the validity of files.  Date/timestamp has never been a reliable way of checking files if that's what it's using.  If it's using the file version, which would be the best way to query them, then I would be more concerned.  When you look at the files being reported, how does the version information map to the latest updates for the files?

  15. Anonymous says:

    To be honest, I'm not sure on Windows Embedded, it's built differently than retail Windows.  I cant comment on Windows Phone 8 as its under development.

  16. Anonymous says:

    @Paul,

    run TreeSizeFree (http://www.jam-software.com/treesize_free) and look which other folders use a lot of space and look if you can delete or move some data.

  17. Anonymous says:

    @fluffy;

    1.  Yes, the files are protected by Trusted Installer.  Unless you explicitly take ownership of a file, this is pretty much taken care of.

    2.  Correct, thats another reason for the component store and the backup folder within it.  While its not a sure fire way to stop disk corruption, it helps.  But, to your point, I have seen issues where the component store has been severely corrupted due to disk block issues and it's irrecoverable in most cases.  The machine is still bootable most of the time because the files in use (in Windows) arent affected.  But the machine isnt servicable because of the corruption.

    3.  Interesting test.  The accounting isnt so much that we cant do it, its that the way its displayed to the user isnt an easy fix (read: explorer.exe).  Like I said in the prior comment, we've batted around the idea of a tool that would allow for this information to be more readily available but I'm honestly not sure where that stands now.  I'll have to fire off some mails internally and check.

    –Joseph

  18. Anonymous says:

    Jim;

    Thanks for the question, and its a good one.  The quick answer is no, you shouldnt delete the files that are there.  Do you need them all?  No, you probably dont but they are there in the event that you add a feature at some point that does require those files.  On the other hand, if you know you wont ever use a feature, you could, in theory, walk through all of the manifests for that feature and ensure that there arent any other components that rely on the components of that feature and then delete them to reclaim some space.  In the end, you'll find that its not really worth the effort I would imagine, but it can be done.

    –Joseph

  19. Anonymous says:

    @Will,

    What operating system and service pack are you running?

  20. Anonymous says:

    Sebastien,

    What did you use to determine your size on disk?

  21. Anonymous says:

    @Bear;  Leho is correct, your machine will not be in a servicable state and may fail to function properly if you delete the directory.  What else do you have on the system drive that is taking up the other 10GB?  It might be better to move some of it to another drive (your 1TB) if is not needed.

  22. Anonymous says:

    @Alireza this only works if you have installed the Sp1 😉

    In WIndows 8 run this:

    DISM.exe /Online /Disable-Feature /Featurename:<name> /Remove

    Run this to get the features: DISM.exe /Online /English /Get-Features /Format:Table

    Next run this command with the featurename:

    DISM.exe /Online /Disable-Feature /Featurename:SimpleTCP /Remove

    this disables the feature and removes the files from WinSxS.

  23. Anonymous says:

    ok.

  24. Anonymous says:

    The supported methods are:

    1) Pin SP1 using /spsuperseded

    2) Force scavenging using Disk Cleanup Wizard or by adding/removing a component

  25. Anonymous says:

    Tim;

    If you read some of the other things I have written about this, the component store isnt actually that large.  Its the way explorer.exe accounts for the hardlinks (it has to count each link as its own file) that makes it appear that the store is that large.

    –Joseph

  26. Anonymous says:

    @Bearxor

    16GB is too small, get at least a 32-60GB drive. You can run TreeSizeFree to see which other folders take space and use http://www.bitsum.com/MoveAndLink.php to move some data to your 1TB drive.

  27. Anonymous says:

    Ken;

    Good question.  Basically the way we look at things is by architecture type for that particular file. AMD64 has commonly been confused since the release of x64 operating systems but internally that refers to any processor that is x64 capable.  It does not refer specifically to AMD processors.  

    x86 files are usually native files for backwards compatibility for some of the older code that still exists in the OS which hasnt been removed completely, thats usually a small number of files.  wow64 is exactly what you said, they assist in a shimming capacity for 32bit apps for x64 OS but it might also be a 32bit file thats been recompiled.

    But to answer your last question, yes, every x64 installation will include all of the files above and its completely normal.  Let me know if you have more questions.

    –Joseph

  28. Anonymous says:

    Sure, I can clarify that.  The component store is comprised of all of the files he has marked in the Infrastructure section of his image.  This would be roughly 800MB or so, once you add in additional roles, features, etc and then hardlinking it grows to the size you're seeing on disk.

    I've asked that we look into a tool that would allow those interested in seeing the component store size footprint, we'll see what happens there.

  29. Anonymous says:

    The technical constraint is the way we link them.  Hardlinks by nature cannot traverse volume boundaries.  So, you cant move them and expect the restoration processes to work.  Adding the administrative partition would only add overhead to the system in my mind.  You can move your pagefile and use dedicated dump files for memory.dmps.  You can also change the location of the winre.wim file for recovery and you can even prune the driver store to an extent, so a lot of those options already exist.

  30. Anonymous says:

    Thanks for the comments Pete.

    I understand what you're saying but I will disagree with you in that its the servicing mechanisms keeping Windows from smaller form factor devices.  While it might be a small portion of the portability problem to those form factors, the very existence of the servicing mechanisms is what makes porting to different classes of devices easier in the long run for us.  Because we're componentized we have the ability to generate new SKUs more readily than we did in the past.  

    From an I/O perspective, the servicing mechanisms arent much different than it was in XP.  We still have a pendingfilerename type operation that happens on boot, just like we did in XP, its just that you now have an indicator telling you that it happens rather than not.  The file copy on boot is still about the same.

    However, all that being said, I can tell you that this feedback is given directly to the product teams and they take the feedback seriously.  What that means for future products I'm not at liberty to tell you, but this does get to their ears, so feel free to keep it coming.

  31. Anonymous says:

    Are you installing SP1 as part of your Windows Updates?  That's going to increase the size on disk.  This can be paired down using the DISM command in my blog (/spsuperseded).  I have other blogs about why the directory is the size that it is.

  32. Anonymous says:

    Thanks Andre, I've added an update.  I appreciate the comment.

  33. Anonymous says:

    Have you used COMPCLN to make SP2 permanent?  Another thing, install and uninstall a feature you dont need and reboot the system to see if you need a lot of things scavenged out.

  34. Anonymous says:

    I've written numerous blogs about the specifics of the space usage, in your case you can use the COMPCLN tool to pin SP2 and reclaim some of your used space.

  35. Anonymous says:

    (Reposting this since the first one failed for whatever reason.)

    I'm going to beat a dead horse but first I want to say that I've read your two posts on hardlinks, this post, all comments on all three posts, the Disk Space article by Steven Sinofsky and I myself am very familiar with both NTFS hardlinking and how Windows occupies a disk. I'm going to refer to the following tools: Disk Usage or DU ( http://goo.gl/xUunj ) and Duplicate Cleaner ( http://goo.gl/Ly9OY ). I'm going to write this as if I'm performing a proof of concept.

    The concept is that during initial installation of Windows (7 Ultimate 64bit in this example) the /winsxs directory is "projected" file-by-file into the install directory we'll call /windows for simplicity by way of hardlinks. You further explain that files residing in /winsxs remain hardlinked to their respective "projections" in /windows after installation. I'm going to make the assumption that subsequent updates add a new file to /winsxs and the "projection" in /windows is changed to reflect the new file.

    I'm further going to assume that your explanation is that while the operational files in /windows are hardlinks of the up-to-date versions in /winsxs the old files may remain causing the bloat you attempt to address in this article. Your proposed reasoning is that Windows and its services use the /winsxs directory as the authoritative source for the files in /windows directory and without these files there are Windows functions that will fail.

    You explain what a hardlink is accurately and correctly. You give examples of the Windows GUI showing /winsxs directories in excess of 10 GiB. You explain the structure of /winsxs and I'll take you at your word. You don't show the actual usage of the /winsxs directory compared to /windows. Allow me to provide an example in the following set of screen-shots:

    http://goo.gl/Zak5k DU on both /windows and /winsxs

    http://goo.gl/nIui8 Duplicate Cleaner results on /windows

    http://goo.gl/uzmcV Duplicate Cleaner results on /windows with /winsxs excluded

    Now due to technical limitations (I'm using this Windows installation to present this information) there may be discrepancies in the exact byte numbers in any two counts and I'll assume this number not to exceed 1% in either direction between any two counts after repeated testing (three runs of each) to ensure consistency. I'll also admit that MD5 hashing can produce collisions and a more scientific proving should use SHA-256 for best results.

    The Duplicate Cleaner results show that indeed /winsxs holds files that are MD5 duplicates of at least some percentage of the files in /windows and the DU results show that this percentage is not hardlinked. Please verify these results if you find any error in my methodologies. I'm not going to argue that these files are useless nor will I recommend any user delete them. In fact these files are very important if any user should intend to uninstall any Windows update, although I will point out that there are updates that can't be uninstalled.

    My point in this is that /winsxs really is too big. While the typical size is between 3 and 8 GiB for moderate aged installations I've seen it as large as 30 GiB as reported by DU and this is an unacceptable size; there is no logic to /winsxs growing to three times the size of a "clean" install for any reason, even backup. My only safe solution for these unfortunate users that experience this bloat is re-installing Windows which is often a massive undertaking for the average Windows user. While There are tools and options to reclaim portions of this bloat, there remains a forever lost, sizable amount of valuable disk space especially in mobile solutions or when a single SSD is the Windows boot device.

    Now this isn't the first time I've been compelled to write about this ( http://goo.gl/6U9pE ) and I see the same misinformation being spread; it needs to stop.

  36. Anonymous says:

    Deneen;

    Thanks for the comment.  The purpose of this directory is to serve as a temporary storage location for any servicing operations that need to be performed on a reboot.  When a machine has a pended reboot, it will populate this area with its payload as well as a file called pending.xml.  When the machine reboots, it checks to see if it has any operations that had something pended for it to finish installing/cleaning up.  We utilize the payload, registry and pending.xml to make all of this happen.  

    You could delete the pending.xml file and see if that helps with whatever particular problem you are seeing.  However, you would not want to delete the directories because they contain payload files for a specific use.

    –Joseph

  37. Anonymous says:

    I wouldn't expect Winsxs to change, the files there aren't application related, they're Windows. I would expect your Installer directory to be smaller (assuming the software removed itself properly)

  38. Anonymous says:

    @V,

    I understand the frustration, though I'm curious about the black box comment as I've done the best I can to take the mystery out of this portion of the OS via this blog.  BTW, XP had its own issues, we didn't prune directories and that caused bloat.  Also, XP doesn't handle the operations as gracefully as Vista++ operating systems.  I've said here many times that I've seen a lot more issues with servicing in XP than I have since Vista release.

  39. Anonymous says:

    @Doug;

    If you've installed SP1, you can remove its payload, otherwise, no there isnt any other mechanism for automating cleanup.  We actively scavenge the component store already.

  40. Anonymous says:

    Dean;

    Again, maybe some bad wording on my part.  However, there is no REAL file in a hardlinked system.  When the file is created all of the links point back to one file record segment in the MFT, once there are no longer any references to that segment, the link is considered broken and it cant be effectively recreated.  

    The mechanic works as described though, we check for the version of the file in the component store to determine if its the same as the projected file and if its not, we reproject it.  I guess it could work the other way, from system32 to winsxs but I've never really tried to mess with it in that manner.

    –Joseph

  41. Anonymous says:

    Run one of the online programs that gives you an output by directory.  I've used Tree Size in the past to get a quick view: http://www.jam-software.com/…/index.shtml  there are others out there as well

  42. Anonymous says:

    No, the Office files are application files (similar to other apps) and aren't part of a servicing operation.

  43. Anonymous says:

    @VgerNYC

    uninstall updates which are replaced by newer one (like the monthly IE updates). This can save a lot of disk space. Sadly MSFT is ignorant to this act and still doesn't provide a script/tool to detect and remove such useless installed updates.

    Also uninstall features you don't need. Becasue Embedded is an unstaged build the files are removed from WinSxS.

  44. Anonymous says:

    Mike;

    Check out the post on how hard links work for more information (blogs.technet.com/…/how-hard-links-work.aspx) but to answer your questions:

    1. Yes there is only one file record segement in the MFT per file

    2. Yes, projection = reference in the verbiage above.  We call it a projection in terms of CBS.  Reference is the proper NTFS term

    3.  No,  if a projection becomes corrupted, then it can be reprojected so long as the file record segment is not corrupted.  Remember its a reference to the file record segement, not the file record segment itself.

    4.  False, you can recover a corrupted projection using either SFC or CHKDSK, depending on if the link is broken or the file record segment itself is corrupted.  

    If the file record segement faces true file system corruption that cannot be fixed, then you would need to replace the file manually.

    As for your point about space in WINSXS, there is a good blog written by one of the Windows PMs that references this: blogs.msdn.com/…/disk-space.aspx

    The portion of this that answers your question most directly is as follows:

    While it’s true that WinSxS does consume some disk space by simply existing, and there are a number of metadata files, folders, manifests, and catalogs in it, it’s significantly smaller than reported. The actual amount of storage consumed varies, but on a typical system it is about 400MB. While that is not small, we think the robustness provided for servicing is a reasonable tradeoff.

    So why does the shell report hard links the way it does? Hard links work to optimize disk footprint for duplicate files all over the system. Application developers can use this functionality to optimize the disk consumption of their applications as well. It’s critical that any path expected by an application appear as a physical file in the file system to support the appropriate loading of the actual file. In this case, the shell is just another application reporting on the files it sees. As a result of this confusion and a desire to reduce disk footprint, many folks have endeavored to just delete this directory to save space.

    –Joseph

  45. Anonymous says:

    @Bradley;

    It's computed once, if the checksums are different, the file is replaced with the one in the component store and the hardlink for the image is updated accordingly.  That is unless someone has manually moved a file into the component store, which would break the linking for the file (as you correctly stated).  In these cases, SFC would do nothing other than report the error in the CBS.log.

  46. Anonymous says:

    @Kalyan:

    1.  There isnt a 2008 SP1 ;).  2008 already has SP1 integrated so COMPCLN isnt necessary.

    2.  No, the component store cannot be compressed

    3.  I would assume the answers above make this question moot.

    Let me know if you have more questions.

    –Joseph

  47. Anonymous says:

    @troubada

    Thanks for the comments.  I will just say that using tools like vLite is not only unsupported by Microsoft but I have seen it cripple more machines than I care to mention.  If that's the way you'd like to manage your images, just keep this warning in mind.

    Explorer does count hardlinks by a multiplier that's consistent with the number of hardlinks (ie. twice, three times, etc).  DISM doesn't really care about the linking from a count perspective, it just does what its told to do when you give it a command.  It will service all payloads though, so it updates the hardlinks accordingly

  48. Anonymous says:

    @Del,

    A component store of 8GB is perfectly normal.  How large is your operating system drive?

    –Joseph

  49. Anonymous says:

    Sounds like you didn't effectively take ownership of the entire directory.  What are you looking to do with TAKEOWN exactly?  If you manually delete files from the directory, you do so at your own risk as we don't support it officially.

  50. Anonymous says:

    So my current view is that reduction of WinSxS does not cripple the OS as far as every day use goes, and that the only drawback would be file corruption and then Windows' inability to restore these files and put Windows back in working order. I am not sure in my personal usage how many times (if at all) Windows has had to use WinSxS to repair itself and if running an OS with reduced WinSxS would break sooner, etc. I always update/create personal install images every few months or so and rarely run an OS install longer than 3 months, so in that scenario I have not found any detriment. On top of this, I also make complete system backups after I install fresh and set up programs, etc., so a total restore would take only a few minutes. I realize that, given these circumstances, WinSxS would be far less important than with your usual Windows install, which is why I wouldn't recommend it in general.

    But I would say that the hardlink comments in general misrepresent what is going on with WinSxS size — WinSxS is huge in actuality, and explorer's reading of the WinSxS folder size is not the major player where it comes to (perceived and real) WinSxS size. Slimming of WinSxS (when performed on an image) significantly reduces the wim (and thus iso) size.

    With Win8 the situation with updates and image size seems worse than with Win7. We are only a few months into Win8's release and only have around 40 OS updates under our belt and I can't even make an updated Win8 ISO with all updates integrated that would fit on a 4.7gb DVD! With Win7 I was able to integrate 300+ updates and still fit it on DVD easily. This is one thing I hoped Win8 would handle better, install size (on SSD/HDD) and image size, but it seems it has gotten worse when compared to Win7. What is different about Win8's updates is that there have been several major OS updates pushed out (there are currently 3 updates larger than 140mb!) so I considered the increase of image size was partly due to those. Still, I find it a bit puzzling and disappointing how large these images are turning out to be. Install.wim's over 4gb's are bit large, and they will only get larger the more updates come out.

  51. Anonymous says:

    Sure thing Drew….and keep the ideas coming.  I've used a lot of the ideas I get from all of you here and brought them in front of the product group.  It makes our porducts better for you in the long run because while I support them (and you by default), I dont run an organization thats reliant on Microsoft products, so I dont always know what it is that needs to be fixed.

  52. Anonymous says:

    Drew;

    Explorer sees each hard link as an individual reference to that file, so that's why it gets counted twice.  This is probably going to come out the wrong way, but you're thinking to simple when it comes to the code change you're recommending.  Changing code in explorer.exe can have many, many unforseen circumstances, so just adding an attribute would be a major undertaking.  You would most likely need to re-write that entire binary

  53. Anonymous says:

    @Hayden;

    Unless you're drastically undersizing your C: drive, a 10GB component store is normal.  How large are your C: volumes?

  54. Anonymous says:

    How are you determining the component store is taking up the space?  Can you share your output with me in some way.

  55. Anonymous says:

    If you have a 33GB Winsxs directory then you most likely have a problem.  Usually I say anything over 12-15GB would be the maximum I would say is normal.  What's taking up the size in the directory and when was the last time it was rebooted?

  56. Anonymous says:

    @Bearxor: in comparison, a fully functional Gentoo install with full build toolchain and XBMC can be had usually within half a gig. That's 500 MB total. Gentoo just happens to be the one I know deeply, no need to comment about it specifically. I'm sure you can get a pre-built distro like TinyCore in the same or probably even less space.

    Makes one think these days, not even only when your drive constraint is 16GB.

    If purebred HTPC is your goal, I'm not sure at all.. why W7 again?

  57. Anonymous says:

    @fluffy;

    I dont moderate comments but yours was stuck in the TechNet spam filter, sorry about that.  I've had problems posting to comments lately too so maybe its maintenance or something on our end.

    As for your findings, let me just say a couple of things:

    1.  Yes, your comments about how the files are placed during a Windows installation are correct, we project the files to the Windows directory (and subdirectories) as needed to complete the installation

    2.  Older versions of a particular file are left in the component store for rollback capabilities in the event that an older version of a fix is required

    3.  There is no accurate tool out now that can show you the space usage of the component store, we've talked internally about the need for such a tool and it's still under debate.  So, while du.exe does a good job as well as some other third party tools, they arent written specifically with servicing in mind and the results will vary

    4.  A 30GB component store on a Windows 7/R2 installation would be an anomoly and I would want to look over it to see where the bloat is coming from.  The typical store will be between 8-12GB on most installations (depending on SP level and some other stuff). As I have mentioned in prior posts, the store in 2008 can somtimes encounter this due to blobs.bin, that isnt an issue in Win7/R2

    At the end though, the point is still the same, it's not that you as a user cant remove the files in the component store.  You most certainly can.  The point is that you do so at the risk of compromising your machine to the point of it being unbootable.

    –Joseph

  58. Anonymous says:

    Thanks Ed.  What you'd have to do is find the version information for the VC90 files you have installed and compare it against the version(s) of the files included with the patch(es) based on the KB article.  You can start here: technet.microsoft.com/…/ms11-025

    From there, select the versions you have installed for the components.  For example, the VS2010 component KB is this one: http://www.microsoft.com/…/details.aspx  but the actual file listing is this one: support.microsoft.com/…/2565057

    Each file listing is located under the More Information section.  Using that you can see that these files are mostly version 9.0.30729.6161 for VS2008SP1 (listing here: support.microsoft.com/…/2538241) which would seem to indicate that for those two files, they are indeed not updated versions.  From there, you'd have to determine if there is a superseding version of the files installed somewhere else, or if the files are even in use.  In which case, they might be out of date but they don't post a threat because they're simply staged and not actively in use on the system.

  59. Anonymous says:

    Rahul,

    It depends on the situation.  If you're in a no-boot due to an update installation, you can always use the /revertpendingactions flag I speak about in another entry on here.  

    As for replacing system files, boot off of media and into WinRE and pull them from the DVD or another machine.

  60. Anonymous says:

    @Bearxor

    which Windows 7 Edition/SKU do you use? Lower SKUs have a reduced function set, which results in a lower amount of installed packages and a lower WinSxS usage. Also install a x86/32Bit version to reduce the WinSxS usage (64Bit Windows include a lot of 32Bit DLLs to get 32Bit apps working. This is called WOW64)

  61. Anonymous says:

    @Anonymous

    again, uninstall old updates, this is the only way to reduce the size.

    Open regedit, go to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionComponent Based ServicingComponentDetectamd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_0.0.0.0_none_933ba3cd22b12888

    look which file version has the highest number. This is the latest IE update which you have to keep. remove all other updates in the control panel->programs->uninstal updates.

  62. Anonymous says:

    Joseph

    What is the relationship between Software Distribution (currently 744Mb size on disk) and winsxs (currently 8.12Gb size on disk). I have installed all updates with the exception of SP1 on W7 Home Premium 6.1 7600.

  63. Anonymous says:

    Yup, I published an entry on that a while back.  I also have a KB you can reference in your blog if you like which covers some other stuff you can do: support.microsoft.com/…/EN-US

  64. Anonymous says:

    @Bearxor

    Windows reports the wrong size (MS discussed to fix in Windows 7 but I didn't happen). Most files are hardlinks (1 file linked into several folders). All the Windows DLL/Exe files are stored in the WinSxS folder and linked to C:Windows, C:WindowsSystem32 or C:Program Files.

    Run TreeSize and look for other folders which take space and move them with my linked tool.

  65. Anonymous says:

    Already answered in the blog post:

    So, to answer the question, the answer is simply: No.

  66. Anonymous says:

    A clean install of Win7 is usually between 6-8GB + page file once its completed.  So, you should be looking at 8GB-physical RAM as available free space once everything is patched.  My guess is that this machine has 4-8GB of RAM and that moving the page file to another drive would free up the space you're looking for.

  67. Anonymous says:

    Honestly, unless the tool was from us I wouldnt trust the output.  Explorer doesnt do a good job of reporting actual size on disk.

  68. Anonymous says:

    Thanks, that's what I was "hoping" it would be.  My guess is that your user hit this: blogs.technet.com/…/what-is-blobs-bin-and-why-does-it-grow.aspx

    See if you have a blobs.bin in the ManifestCache, if so, delete it and reboot and you should be fine.

  69. Anonymous says:

    @olivier: compcln isnt a serviced binary so its not linked to anyone.  for all of the files in the OS, you'd either need a fsutil script of some sort or another tool.  What exactly are you looking for?

  70. Anonymous says:

    Glad that worked out for you.  Luckily, this was one we fixed in later versions, it was pretty rare though.

  71. Anonymous says:

    No problem.  The question gets asked a lot.  7.5GB would be within the expected range of tolerance, so you look fine there.  You can mark the service packs permanent on Vista installations which will scavenge some space out for you, just look for COMPCLN.

  72. Anonymous says:

    23.2GB is too large Neil, so in your case, I'd be interested to know where in Winsxs that space is being consumed.  Typically your component store should be in the 8-12GB range with 12GB+ being a rarity.

  73. Anonymous says:

    No, servicing wont work if the folder is compressed.

  74. Anonymous says:

    @Senor

    I will tell you that if you have a 35GB volume then it isnt mostly consumed by the component store, maybe 7GB or so is especially on a clean install.  Unless you installed Win7, installed all of the available fixes, installed SP1, installed all available post SP1 fixes and never cleaned the directory.  Then you're probably looking at 10-12GB.

    That all being said, you have the right to do whatever it is you want to your Windows installation, and there are ways you can delete the component store if thats really what you want to do.  However, I wont be the one giving you that information because I dont want to knowingly put others into an unsupported state.  You should be able to find information on this online though, just use your favorite search engine.

    –Joseph

  75. Anonymous says:

    David;

    You shouldn't have a component store that size unless you have SP1 installed and its never been trimmed.  Can you please confirm for me your version by typing "winver" at a command prompt and telling me what it says.

    How are you determining the size of the component store?  Are you using a tool like DIR or some third party tool?

    Thanks!

    –Joseph

  76. Anonymous says:

    @Paul;

    As Andre says above, you can use some tools to look over the drive and see if there is anything you can move off to save space, however you cannot move the component store (Windowswinsxs) to another volume because hard links do not traverse volume boundaries and this would break the servicing on your system.

    –Joseph

  77. Anonymous says:

    Nope, on Win7 we scavenge automatically, so you're all set.  We'll have a DISM switch for pinning SP1 when it releases though.

  78. Anonymous says:

    In Win8 some files are compressed (Backup and Manifest folders) when you run the DiskCleanup.

  79. Anonymous says:

    @Frank,

    Corruption is what it is, and it can happen to any file regardless of if its part of a servicing operation or not.  As to your other point, we've implemented ways in Win8 for users to reduce footprint even more so than what we've done in the past to address some of the concerns mentioned here.  The Office language updates aren't a part of OS servicing or CBS but because they're held in the installer directory, they shouldn't be removed.

  80. Anonymous says:

    Yes, 17.8GB would be large to me.  What OS is this on and what roles/feature/service pack level are you?

  81. Anonymous says:

    @Jelena;

    No, the folders in the component store (winsxs) should not be deleted.  They actually arent duplicates, they're usually versioning. What operating system are you running?

  82. Anonymous says:

    Anything over 11-12GB would be alarming to me.

  83. Anonymous says:

    Albert;

    Thanks for the feedback.  Unfortunately, this wont work. The servicing stack doesn't allow the component store to traverse volume boundaries.  We've implemented more ways in Win8 for admins to limit the size on disk of an image that allow for the complete removal of unwanted roles/features.  Inbox corruption repair in Win8 works very similar to what you propose though, and it can use an external source for recovery (such as a WIM on a network share or Windows Update)

  84. Anonymous says:

    Note: perhaps what I was saying about explorer and perceived size of WinSxS is in reality another way of saying: "dism is under the same spell as is explorer and is also counting hardlinks into the wim size." If that is the case, something is really wrong here 🙂 But again, I would think that it's possible that hardlinks are not contributing that significantly to size of either the wims or reported folder sizes in explorer. However, it would be fruitful to know if dism is counting hardlinks as real files as well, and thus swelling up the images unnecessarily. What do you think, joscon?

  85. Anonymous says:

    SoftwareDistribution is where we cache downloads coming from Windows Update.  You can rename the directory and we will rebuild it the next time you run Windows Update, but its not something I generally recommend.  If you're confident that all of your updates are installed properly, that will allow you to regain that space.

    –Joseph

  86. Anonymous says:

    I'd like to thank you for taking the time to read my comment and your excellent response to it. I'm still in conflict over certain specific issues so I'll do my best to make this concise.

    1. While delete-write file changes such as overwrites and updates (as exampled by poorly written programs using bad practices) fall within the scope of /winsxs backup use, I imagine there must be some method to prevent open-writes (such as edits) to these files which is a common method for malicious code that doesn't carry a new, corrupt version of the file which can be burdensome; a properly written <300KiB executable should do the job whereas adding the payload of a >300KiB file can be harder to sneak in.

    2. Software protection doesn't explain the potential for physical data corruption by any outside source; platter based drive, improper shutdown, power-spike in read/write head as it parks, it takes out any given critical file hardlinked from /winsxs. The original data is corrupted on the disk, the rollback version is incompatible for any reason, Windows BSoDs at boot time throwing an error and referencing the corrupt file. We've all been here and while chkdsk fixes this 90% of the time it may require some patience and a known good copy of a compatible file replacement.

    3. To verify the hardlinked status of the files as you claim I wrote a batch script to list all files for which two or more hardlinks exist. It's a nifty thing based off a tool I use to populate an SQL DB of existing files in a data pool and audit hardlinks. I should have done this first as the results are honestly fascinating. Allow me to explain.

    DU reported 52 thousand unique files and reports 71 thousand logical files. The results of the hardlink audit report 33 thousand hardlinks to 16 thousand unique files. Further auditing show that among the 69 thousand logical files at current count (update and reboot, c'est la vie) there are 10 thousand files in just under 2 GiB that have duplicates but are not hardlinked, possibly physical backups or the "core" files of Windows, what have you. So what mechanism is preventing these files from being correctly counted and what is causing Windows to allocate this space that's actually empty assuming my hardlink audit tool worked as intended? $MFT or other NTFS control structure reservation in conjunction with the NT 7 kernel's use of NTFS for system drives, perhaps?

    I've typically had protections on /windows and other critical directories so I've never seen audit results on a full drive; I'm very interested to perform these tests and see what's going on at the NTFS level of things. I might setup a test using a read/write logger on a VM to see the data as its written during install and update sequences. I've gone away from Linux in favor of the mature and stable Windows platform (how often do you hear that?) and this is just one of those quirks that doesn't behave the way you'd expect common to all OSes.

    I guess the old adage really is true: if you want something done right, do it yourself.

  87. Anonymous says:

    @Anonymous

    the only way to reduce the size is to remove old updates which are replaced by newer ones (like the old monthly IE updates)

  88. Anonymous says:

    @joscon

    I am aware what the risks of using vLite or reduction scripts (really the same thing) potentially entail where it comes to WinSxS, which is of course why I made the pronounced 'personal use' stipulation. And I do appreciate your concern. However, I have used vLite on Windows 7 images for years now, albeit intermittently, and never had any problem and I run hundreds of applications on my system, many of which intensive.

    I also think that third-party slimming tools would not be used (or at least not as widely and, supposedly, indiscriminately) if people indeed have any alternative at all. If anything, tools like vLite have proven that many features of Windows are quite modular and can be taken out (such as Speech, Natural Language, etc.) and still have an operating system that is fully functional for personal use (given one would not need Accessibility, Speech, etc.). I love to weak and modify my own images, and mostly rely on Microsoft's own deployment tools to do so, but as it is these are quite limited in many ways as far as customization and slimming go. Just as custom PE images can be very useful for certain purposes, so can custom Windows build be for the interested and determined 🙂

    But I understand you work for Microsoft and cannot and would not want to give the impression that using slimming scripts or tools is OK, and personally I would not recommend just anyone using them either. I have also seen many problems happen to people who indiscriminately used such tools. Then again, I would not want regular users to be messing with WADK either 🙂 So I cordially take your words in that light, if not in any other.

    The reason the WinSxS situation peaked my interest again lately was due to the fact there are now some additional DISM commands available for Windows Server 2012 editions, letting one remove Features stored (but possibly unused, depending on your usage) in WinSxS. I am still exploring the possibilities of these new DISM features, which, if they work as some have reported, may reduce WinSxS content by 2gb on a live install, which could in turn amount to several hundred mb's (perhaps upto 600-700mb if my calculation is correct) so this is definitely something worth looking into.

  89. Anonymous says:

    @Bearxor: no you won't be able to expect your machine to function normally after that nuke. sane way on a 16gb drive is to go xp or linux. latter only if your hardware components are from a manufacturer known to produce non-windows-only components.

  90. Anonymous says:

    Dean;

    Fair point.  You are correct in that there is a real file there with multiple "references".  I think this would be a good blog entry, let me work something up and I will post it after the new year.  Thanks.

    –Joseph

  91. Anonymous says:

    From personal experience dealing with Windows 7 and 8 installs, working with VM's and performing syspreps and monitoring WinSxS folder sizes, I would say that too much has been made about 'hardlinks' and how they contribute to WinSxS folder size (as reported by exporer). If you use a script or vLite to reduce WinSxS, you will find that it's not just explorer causing WinSxS to appear huge, because when you build images with reduced WinSxS folders you will see that image is significantly reduced in size. The actual install.wim's and or iso's are much, much smaller.

    To give an example: a fully updated Windows 8 x64 iso of 3.4gb will go up to about 4.6gb in size (from the install.wim perspective this means around 1.2gb added). When you perform WinSxS removal with vLite, the install.wim becomes smaller than the original iso install.wim by several 100 mb's. So a fully updated install.wim may end up around 2.8gb in size, compared to the 3gb original install.wim that is not updated.

    In my experience (and currently I am working with Window Server 2012) I have not found any detriment in using vLited installs (or installs with their WInSxS folder reduced). But this, of course, is from a personal computing perspective, and I would not recommend using removal scripts or vLite for any other purpose than a personal one. That is not to say I agree with Microsoft's current approach to WinSxS, but I can't claim to have the oversight and knowledge to determine how it could be done differently in a reliable manner.

    However, I am aware of a tool for Vista that allows for reduction of WinSxS's size, and if it could be done for Vista than I don't understand why it hasn't been done for Win7 and 8 as well. I did read you proposed something like this, joscon, but I'm afraid such a tool will not be made given what I've read.

    vLite, when you select the WinSxS removal option, states that live installation of updates may fail when WinSxS is removed, but that offline integration (via Dism) should not be affected and would still be viable. I haven't been able to fully verify these claims, but can say I have installed updates successfully and have integrated updates successfully, but as yet cannot say with certainty if WinSxS reduction has significantly impacted updating (live or offline). It has been mentioned on various sites that WinSxS reduction would not allow one to uninstall integrated updates when said reduction would be done after installing/integrating those updates. This, of course, would make sense.

  92. André says:

    You should also explain that the WinSxS folder replaces the old $NTUninstall folders from XP. So that the people understand better that it grows after installing Updates.

  93. Pete says:

    But the very core design of the servicing stack is what users don't like. It should be engineered to take this much disk space. The servicing stack is the stumbling block when it comes to putting Windows 7 on small powered devices, slates and tablets. The user should always be able to decide whether he wants to back up files before an update and there should not be so intensive I/O involved in servicng (XP's servicing was so simple). It should not hog logon and logoff ("Please wait while Windows configures updates.." crap) but do all its work in the background. I hope it's completely rewritten in the next major release so that it's engineering for least I/O, least amount of disk space and no slowdown of logoff and logon. Hope this feedback goes loud and clear to the concerned people.

  94. Pete says:

    In my comment above, I meant "It should NOT be engineered to take this much disk space."

  95. Doug says:

    Hi Jascon.  I read the rationalizations for the ever growing winsxs directory and I'm afraid I am a bit angered by them.  (I'm not "shooting the messenger"!  Really!) .  My win7 winsxs, not very old, is >7GB.  Because this was an upgraded machine with smaller original partitions, I'm down to 1GB space and this is after using gparted to resize my disks once before.  (I won't get into the problem of ever growing virtual machines)

    When a program has a memory leak, it is fixed as a Severity 1 issue.  This is a storage leak, and  it is worse than your basic memory leak because it is permanent and designed with the knowledge that it will eventually take down the system and/or require major data movement and application reconfiguration.

    In 33 years of computing, I have never backed out a patch to an OS and on my personal PCs, I have no plans to start.  Thats what I have backups for.   The 1st thing I always did after applying maintenance on my personal machines was run ccleaner and wipe out the backups.  No going back, but I can, and want to live with that.  So the question, as asked before, is why am I forced to give up 7GB+ of space, and more for the future, for essentially no benefit?  You mentioned in another post a program to mark Vista SP1 updates as permanent and clean out the never-to-be-used clutter.  Does such a tool exist in a generalized form?   Can one be made?  (by the way, I have no idea what "multi-point servicing" is, a Google search turned up nothing, so I still don't understand why I might get 8 copies of a whole component for a fix that changed a single line of code). Thanks– sorry for the rant, but I'm off to repartition this box again now.

  96. someone says:

    Should I mention for everyone a cool utility I found (very rare and probably one of its kind) that shws the actual size of any directory minus the special NTFS junction points (hard links, sym links etc). It's called cttruesize and can be downloaded here: http://www.heise.de/…/50272 Even with this utility and correct switches used, the size of WinSxS is unacceptable as a user. Hope this feedback goes to the Windows teams.

  97. JimC says:

    Are there parts of the component store that can be eliminated because they will never be used?  For example I have an Intel i5 based laptop, do I need all of the amd64_… directories in WinSxS?  Is there some way to prune the directories for these unneeded components?

  98. Rahul says:

    Hi,

    You talked abt the difficulties in replacing the binaries in one of the comments above..

    How do we accomplish it in the newer OS, especially when the system does not boot or result in a endless time at applying/configuring updates.

  99. Neil says:

    The WinSxS folder is consuming 35% of my total disk space – 23.2GB and this is by design? This is not acceptable! There should at least be a way for "Power Users" to disable this.

  100. Neil says:

    Somebody should also mention to the servicing team that, as big and inexpensive as my hard disk is, it does not mean that it is intended for the OS to crap all over.

  101. Ken says:

    Thanks for explaining.  

    A Simple question: an enormous number of the 10,000+ files in my WINSXS and the 3,000+ files in WINSXSBACKUP start with "amd64_" and many others start with "wow64_" and with "x86_"

    I looked up "wow64_" and it relates to running 32-bit apps in a 64-bit Windows OS.  Great.

    If know that I have an Intel CPU in my Dell.  

    Is it correct to assume that the "x86_" files apply to that processor?

    I don't know if there is another processor (graphics?) that is related to AMD on this system, but I have an nVidia video card.

    Does Windows 7 64 need the "amd64_" files in WINSXS and WINSXSBACKUP if there's no AMD processor on the system?  Does every Win 7 install have both AMD and x86 files?

    Thanks

  102. Ken says:

    Thanks for the quick and informative reply.

    WINSXS occupies 7.5 GB of my 41 GB partition which is why it drew my attention.   Windows 7 takes about 16 GB, Program Files (x86) 3 GB….so I'm always looking to work on how much space is used.

    I have an SSD and the C: partition can't be extended because the other space on it lies "to the left" of the system partition.

  103. Ken says:

    I think this was a clean install of Windows 7.  So does COMPCLN apply?  Thanks.

  104. Dean says:

    Here is something I don't understand. According to Microsoft documentation "When you create a hard link to a file on an NTFS volume, NTFS adds a directory entry for the hard link without duplicating the original file."

    But you say "Because the component store (Winsxs) is needed to repair the OS binaries in the event that a file becomes corrupted or, in worst case scenarios, compromised……You can see that the NTFS file has a link to the Winsxs directory and if that version of NTFS were to become corrupted, we could go back to the component store and find you a new copy….That’s why the Winsxs directory is so important.  The files there can be seen as the “authoritative” versions on the file system.  When you encounter an issue and that binary needs to be replaced, running an SFC /SCANFILE against it will check the directories above and if the version doesnt match, it will re-project it so that its working"

    So how can there be anything to "replace and fix" when there is only ONE copy of any file to begin with ? If the original file in the Winsxs directory ( which the hard link points to and is the only REAL file ) gets damaged then it seems to me the only way to replace it is to run a repair from the DVD.

  105. Dean says:

    Joseph,

               You still didn't explain this projection stuff. That's what I don't understand. Somewhere there HAS to be a real file otherwise your operating in fantasy land. And if there is only ONE file and the other versions are these so called projections then only the one file can actually get damaged and be replaced. Maybe you can do a seperate blog posting explaining projection. I think we as technical users really need to understand this since it is so fundamental to Windows 7 and Server 2008 R2.

  106. Deneen says:

    Dear Jos-

    I am only just now having issues with this winsxs folder. LogonIU.exe is a 'corrupt file' and supposedly is in the Temp folder of winsxs.All that I have been getting as I read different forums about winsxs is confusion, anger at microsoft and just plain frustrated that I cannot locate an answer to  MY questions in reference to winsxs. Mostly I just found complaints, grumbling and not much in the way of answering all of the issues of the winsxs folder.

    I would like to address specifically the TEMP folder that has not been addressed either by you or anyone else for that matter and I am hoping(since you seem to be the most coherent of anyone so far) that you may be able to give me an answer or try to find an answer if you do not know one.

    winsxstemp :

    contains

    Pending Renames

    Pending Deletes

    If this is a TEMP folder why is it we cannot delete that which is only temporary?

    Why can't we delete the Pending Deletes or Renames?

    Thanks a bunch for ANY asistance

    Deneen

  107. Mike says:

    No, this makes no sense.  Re-read Dean's comment.  If hardlinks are used, then there is only one real copy of the file.  True or false?  If there is only one copy of the file, then its "projection" is a reference.  True or false?  If the projection becomes corrupted, and there is only one copy of the file, then all references become corrupted.  True or false?  Therefore if your projection becomes corrupted, you CANNOT restore from winsxs because it's merely a reference to the same file – and it, by extension, is also corrupted.  True or false?

    Now perhaps something more interesting – if the winsxs folders are full of references, then it stands to reason that those references are not actually taking up any ADDITIONAL space.  So when I see that my winsxs folder is 8GB, does that INCLUDE the space used by the hardlinked files?  I'm guessing it DOES, because although they're hardlinks, they do refer to files that take up space.  *nix would work the same way.  So what I'm saying is – users can PROBABLY add up all of the space used by "Winsxs<big_long_file_name>", and DEDUCT it from the amount of space used by the Winsxs folder itself, since those GB's are just references to the same GB's in use by the OS.  How much space does that save everybody?

  108. Tim says:

    Joseph:

    I understand how hard links work, but they aren't the problem:

    Win7 Explorer reports that winsxs is 7.2 GB.  After reading this post and your previous comments, I decided to see how much of that 7.2 GB was really erroneously counted hard links.  The answer: a whopping 189 MB.  Based on this information, I'm a bit confused as to why I need 7GB worth of file record segments.  Especially since, if I understood what you've been trying to say, the 189 MB of files that have hard links are probably the most important (or at least the most-used) files on my system.  

    If I were talking about a server installation, I would completely agree with the logic of "disk storage is cheap, so throw in everything, plus the kitchen sink."  Nearly every production server I've dealt with has had the OS installed on a dedicated RAID 1(or 10) disk that was at least 2/3 empty.  Given the cost of downtime vs storage, choosing a "belts and braces" approach makes complete sense.

    When it comes to my single disk notebook, however, I have a different set of priorities…especially considering I have a 58GB partition for the OS (and some programs – I've had to install others to my data partition).  In any case, 7GB is ridiculous for data that *might* (but probably won't) be used on my system.  Maybe I can see it for a certain amount of time post-install, but there needs to be a tool that we can run once the system has been operating long enough to mostly separate the wheat from the chaff.

  109. someone says:

    What is the expected range of tolerance for WinSxS size on Windows 7?

  110. someone says:

    Using cttruesize (ctts.exe) and excluding redundant hard links (ctts.exe -s:99 -la -a -l <dirpath>), size of my C:WindowsWinSxS Windows 7 is 7.13 GB (Explorer shows it as 9.19 GB because it doesn't exclude redundant hard links ) I had installed some non-security hotfixes and all security hotfixes since RTM. Now I ran out of disk space on this 40 GB partition (I have apps installed as well) so I will repartition it to 80 GB and install SP1 integrated image. Windows 7 disk space consumption was NOT my idea. Also, can you please clarify where is the 400 MB that Steven Sinofsky arrives at in this blog entry?: blogs.msdn.com/…/disk-space.aspx He says the real size of WinSxS upon clean install is 400 MB which I find is blatantly false. It's in GBs, not MBs. If that's a typo, it's misleading.

  111. someone says:

    But ctts excludes hard links if told to do so. Can you please try it : ) and explain how or why the size reported then is so large yet less than what Explorer reports? What matters is the size of WinSxS, not just the component store. Why does ctts not show 800 MB or whatever close to it if it has the ability to exclude all sorts of NTFS junction points including hard links etc.

  112. someone says:

    Lastly, how is the total free disk space calculated? Whatever size the CBS store takes, why does the total free disk space reported in the volume's properties keep on decreasing? There is some underestimation or misinterpretation of disk space consumed by WinSxS.

  113. someone says:

    It's certainly trustworthy as for a folder without junction points like any system folder from XP, the sizes reported by ctts and explorer exactly match. The "Brutto" (German for "Gross" size matches Explorer's Size in Properties and the one called "Total" in ctts matches Size on disk of Explorer. I am merely trying to verify from Microsoft the true and exact actual size of WinSxS on a clean Windows 7 install.

  114. Drewfus says:

    Joseph, reflecting on the comments for this post and others on your blog regarding the size of WinSxS and other folders like "Driver Store", could you explain why folders such as these are currently 'hardwired' to locations like %windir%winsxs ? Why, for example, can't this folder be relocated to D:WinSxS ? What's so important about having this folder on %systemdrive% ?

    Ideally, Windows setup might allow the creation of a separate partition, let's call it the Administrative partition, that contained, for example;

    • WinSxS

    • hiberfil.sys

    • pagefile.sys

    • Driver Store

    • Recoveryinstall.wim

    • System Volume InformationVolume{GUIDs(allOnDisk)}

    Presumably, the reasons these files and folders (except the paging file) could not be moved to a separate partition would be several and varied, but it would be interesting to know what the technical constraints are in each case.

  115. Drewfus says:

    Yes, of course hardlinks are specific to a volume. I should have remembered that. 🙂

  116. Stefan says:

    Is there a road-map for solving the problem "Explorer doesnt do a good job of reporting actual size on disk"? Its the central file-manager for all current windows-versions, maybe thats reason enough to work on it ?

    At the moment the output of any 3rd party tool (like cttruesize) is more trustworthy than the Explorer-output unless it written in the same bad way.

  117. Olivier says:

    CompCln.exe doesn't has links in winSxs on my system

     fsutil hardlink list compcln.exe

    How can I list other files which have not their backup in WinSxs?

  118. Drewfus says:

    Joseph,

    how is the file set WinsxsBackup determined? How does the servicing stack know if a file is boot-critical, and should be copied to this folder? Is 'boot-critical' flagged in the manifest files? Does the list of files in this folder exist anywhere on the system, in an XML file, for example? I'm wondering if it would ever be possible to update this folder offline, if required, using a known good list, and the product DVD.

  119. Drewfus says:

    Thanks Joseph. Just to be sure by "update offline", i meant fix if corrupted, not change the definition of.

  120. Patrick says:

    So what should I do if I have a virtual machine (Windows Server 2008 Sp1) with a 40GB C:/ partition with a WinSXS folder that is 33.1Gb's?

  121. Drewfus says:

    @joscon "It’s critical that any path expected by an application appear as a physical file in the file system to support the appropriate loading of the actual file. In this case, the shell is just another application reporting on the files it sees."

    Do you mean that applications like Explorer really don't know anything about hardlinks, and that all hardlinked files appear as 'real' files to all user mode applications? That would make sense, but does it also mean that it is inherently difficult to get Explorer reporting correct folder sizes for folders containing hardlinks?

    Explorer understands old-style file attributes (i call them FAT attributes), so is it conceivable that adding a new FAT attribute "L" on files that are hardlinks could allow Explorer and other apps to report folder sizes correctly?

    If paths appear as physical files to applications then it raises the issue as to what happens when an app wants to *write* to a file that is actually a hardlink. How will it be made to appear to the app that the data was written to a physical object in the expected path? I can think of two possibilities. Either the app has no real knowledge of the physical location or extents of the data it reads/writes to/from disk, it just accepts everything the I/O system tells it, and therefore the 'appearing phyical' requirement is essentially a moot point – or – the app can write to the expected location so that the $Data attribute for expected location can *exist independently* and be *different* from the $Data attribute of the original file from which the hardlink to expected location was created. I'm trying to work out how this would work in the NTFS structure, but it does superficiallly explain why files in system32 can become corrupt and need replacing with the 'authoritive' versions in winsxs, *even though these files have been projected*.

  122. Drewfus says:

    Understood. It wasn't so much a recommendation as a hypothetical. I realize that even a small change anywhere in Windows can have many known and unknown consequences. In fact i would suggest to any non-Microsofty that given the size, complexity, and number of subsystems within Windows, the fact that it even works, let alone very reliably in most cases, is one of the greater achievements of modern civilization.

    I'm all for hearing that any suggestion or comment i make here is simplistic or silly, if that's the case, just as much as if i come up with something useful. The point is to learn as much as it is to post bright ideas, and i've learn't a lot from reading your blog. Much appreciated Joseph.

  123. Drewfus says:

    A Microsoft product group meeting. Now there's something i'd like to go to!

    Speaking of ideas, i've got a note on my phone called 'Windows feature wish list' that i add to occasionally and is now quite long. Perhaps i could email it to you? Looking through it just now i noticed a section i wrote a while back about adding a new file system attribute U, for User defined, that would allow marking specific files or folders in a tree, so that utilities like Robocopy could effectively copy from, for example, sales*april , by copying from sales with switch /IA:U , by prior marking all april folders with attrib U. What a great idea! <G>

  124. DocDelete says:

    Anything over >12gb a problem? Mine is 17.8gb. Manifest kicks in at 750mb, backup 502mb, a dozen or so folder come down at 295mb each, then most fall off to 33mb and lower. A total of nearly 20,000 folders!!

  125. DocDelete says:

    Vista64, Ultimate, SP2

  126. DocDelete says:

    Hi, I'm on Vista64 Ultimate, SP2. Desktop use only, single user, homeworker – AMD Athlon Dual Core – nothing exotic.

  127. DocDelete says:

    Thanks for advice so far. COMPCLN executes and terminates nearly instantly – so I'm guessing my install of SP2 is already 'flattened'. Trying to add a feature (Telnet and Solitaire!) just now, the 'please wait' dialogue is hanging open, no progress. Tried a restart, no luck.

    I think I'm glimpsing deep problems. 🙁

  128. DocDelete says:

    Thanks so far. Ran CheckSUR, but log shows no errors.

  129. Hayden says:

    I'm running windows 2008 R2 SP1 and the only software installed is WSUS and its prerequisites. The winsxs folder is over 10GB in size and has consumed the remainder of the C: causing WSUS to fail.

    i find it very odd that Microsoft would create a folder that can grow to such a large extent yet not build in a way to keep it under control, or to clean out items no longer needed. The only folders contained in there are amd64_, wow64_ and x86 folders. Is WSUS using this as a staging area? Can I safely clean these out?

    As this is a production server all of the WSUS updates are being downloaded and stored on the D: but with the C: filling up due to this folder that really makes no difference.

    Is there something you can recommend to be done or do I actually need to take this to our Microsoft Account Rep to get something done about this?

  130. Doug says:

    Back again… I just hit 10GB on a win7 system that was installed late last year.  I only size my c drive to around 40GB so this is, again, becoming a problem.  

    Since it has been about 8 months since I asked before, is there any automated tooling to clean up these files?  A monitor that tracks usage and cleans up or maybe something that scans the system for references to these files?  

  131. Doug says:

    joscon,  OK. Thanks. I can't install SP1 because after I installed Win7, I needed partitions for other systems and, not knowing it would be required for service pack installation, I deleted the system maint partition, so SP1 won't install.  I've been considering re-installing from scratch on a new drive but re-installing all my, dev environments, progs, drivers etc is just too daunting a proposition, so I guess I'll be stuck w/o service packs for the life of win7 (or until I get desperate enough).  Thanks though for the update.

  132. Bearxor says:

    So I have a HTPC. That's the sole purpose of my Windows machine. In order to make it fast, I have a 16GB SSD I use as a boot drive and a 1TB drive I use for Recorded TV.

    My WInSxS folder is 6GB, almost half of my drives formatted capacity and I'm down to 500MB free on my OS drive.

    What I didn't quite understand from this is if I could nuke the SxS directory or not. Can I delete it and expect the machine to function rpoperly unless something gets corrupted? In that case, I don't have a problem reinstalling since I don't do any actual work on it. But the whole thing about the hard links are trhowing me off. Is it one copy, is it two copies? Is the one copy stored in SxS so I can't delete it?

  133. Bearxor says:

    There is nothing…

    NOTHING…

    On this drive other than a clean and up to date install of Windows 7. I just redid it Saturday. I've even turned off System Restore and the paging file.

    The thing is, when I first install Windows 7 and turn off the paging file, I have about 6GB free. Then I run Windows Update…

  134. Bearxor says:

    4GB of RAM

    And I disable the page file altogether, as noted in the previous post.

    And yes, that is about the size of my Windows 7 install with the page file turned off (6GB).

    Then, running Windows Update and installing updates basically doubles the install.

    It's not a huge deal. I was just doing some looking because I installed Windows and saw that I had like 6GB free on my drive. Then I ran Windows update and now I'm down to like 700MB. So I went searching for what just ballooned on my hard drive.

    My Windows folder is 12GB. WinSxS is 7GB of that. I didn't know what it was so I went off searching for an answer.

  135. Bearxor says:

    @Leho – Cablecard

    I mean, let's even forget that I only have a 16GB SSD. Just throw it out the window.

    Why does this one folder consume half the space of a Windows 7 install?

    I used to have this 16GB SSD installed in my MBP. Snow Leopard only took up 8GB. Plenty of room left for applications and settings. I kept my home folder on a 500GB secondary drive, of course.

  136. Bearxor says:

    SP1 is not installed.

  137. Bearxor says:

    @Andre

    I can understand that but the problem is that Windows Explorer doesn't.

    So even though I might technically have 6GB free on my drive (physically unused space on the chips), Windows Explorer thinks that the files are in there twice, so it doesn't know that space is unused even if, in reality, it isn't? Right?

    I don't really have any incentive to run any extra software to clear off space. As explained, of my drive's formatted 14.2GB capacity, 12GB of it is in the Windows directory. I've been through it and none of the other folders are significantly larger, they're just kind of scattered and it adds up.

    don't have any temporary files or anything to clear out. I don't have any programs installed outside of what I need installed for HTPC use (Silicon Dust HDHR Drivers, CoreAVC, AC3Filter, SABNZBd, Sickbeard, ATi display drivers).

  138. santosh says:

    I had "explorer reported size" of 10GB in C:WindowsWinSxs folder after Win7 SP1. After removing SP1 backup files (using cleanmgr), it came down to 6.5GB. Also using cleanmgr we can only clean temp files of current user. So I also ran "psexec -sid cleanmgr" to clean up temp files of "system" account. I had cleaned 1.5 GB of space. Hope it helps anyone who want to save some few gigs of space when they need.

  139. SenorHelmut says:

    Ok, so Im used to using LInux, but there is a game that I would like to play and it only runs on windows. I set aside 35gb for Win7. Now it free space is mostly consumed by WinSXS.

    Like I said. Im used to Linux. I don't care wtf it does or how important anyone claims it to be. I want to delete it, because I am only using Windows for ONE application…  and if I crash my windows, that is MY choice. I have tried deleteing it manually, and through console(cmd) functions, and nothing lets me do it.

  140. Alireza says:

    Run Command Prompt AS Administrator

    Type:

    dism /online /cleanup-image /spsuperseded

    Press Enter And Enjoy 😀

  141. Will says:

    mines is 16.6 GB , 82000 files???

  142. Paul says:

    I hope this post is still being monitored.  I've read all the back & forth about winsxs size and reference files and hardlinks and all the rest.  I don't know if my winsxs is ACTUALLY 8 GB or 8 MB and it doesn't really matter to me, Explorer reports it as 8 GB and that's good enough for me.

    But the reason I'm here is my machine is starting to act up, the pointer hangs and lags and is very jerky as if there is some process in the background chewing through the CPU cycles like mad.  So I start looking and my SDD C: partition has 5% free space and the biggest user of diskspace is winsxs.

    So my question is how do I move that rarely used directory to the D: partition of the SDD where there is a lot of room?  That's all I want is to reclaim the space without having to rebuild the machine.

  143. Del says:

    Let me be the next person to chime in. My Windows partition was smaller and I thought it would be big enough initially to last for years.

    However this winsxs folder has continued to grow even tho I install nothing new on that partition. I have removed everything I can think of to save space, but I am still falling short of space.

    Like one of the posters, I find myself in panic mode. I am down to 2GB. Sure, I am okay for now, but  I mean there is literally nothing else I can remove from Windows to shrink this. So as Windows updates, the Windows folders will grow and this crappy partition along with them?!

    Man… This blows.

  144. Del says:

    I forgot to add, my winsxs file is just under 8GB.

    As a backup file, this is overkill.

  145. Davemate says:

    Hello joscon,

    On my work laptop I am running Windows 7 with no service pack installed at the moment. My hard drive is partitioned twice and all my personal/work files are stored on the D drive leaving the C drive to deal with program installations and Windows.

    The C Drive is 49.9GB in size and currently has 693MB remaining.

    When I check the file properties within the C Drive, the Windows folder is hogging approximately 30.5GB. On further inspection of the Windows folder I can see that the winsxs folder is hogging 15.3GB (189,972 files).

    If I can't delete the data in the winsxs folder what can I delete in the Windows folder because I obviously have an issue with storage at the moment and I cannot install additional programs on the C: Drive?

    I am not very technically advanced in relation to the Windows system files so please keep your reply in "layman terms". 😉

    Thanks,

    David

  146. Davemate says:

    Joseph,

    Thanks for the reply.

    Using winver it tells me I have Windows 7 Enterprise V6.1 (Build 7600)

    To determine the size of the Windows folder and the winsxs folder I find the folders on the C Drive, right click, select properties and wait for the "size on disk" to be calculated.

    Thanks,

    David

  147. Kalyan says:

    Joseph,

    I have been looking for a solution to the same old question. Cleanup of C drive (winsxs folder). I am using Win2k8 R2 Sp1 Std version. Couple of questions.

    1. I could not find COMPCLN. Can you please let me know the path of the same.

    2. Can I compress winsxs folder? If I do that, will it effect any of the hardlinks?

    3. I would like to do this on a ESX template. Will it effect anything on the VM's deployed from this template?

    Thank You,

    Kalyan.

  148. Jacob says:

    Hi All,

    I used this article and it helped clean a few gigs.  

    answers.microsoft.com/…/3d83a43c-0af1-448f-8bda-8150ff201d2e

    Hope this will help

    Jacob Ouaknine

    M6iT Consulting | http://www.m6itc.com

  149. Bradley says:

    My post in response to the blog posting at:

    blogs.technet.com/…/should-you-delete-files-in-the-winsxs-directory-and-what-s-the-deal-with-vss.aspx

    This has been a very interesting article read for me. Not only the article itself but the comments that go along with it. The insistence of users to know more which has led to even more detailed blog postings is amazing. Power to the people! 🙂

    I think, after much reading, I have a solid understanding of what a hardlink is. So this leads me to a question about how SFC /SCANNOW works. It's been said in the comments of this discussion that SFC /SCANNOW compares checksums on both files to see if they are the same. But there is something troubling about the wording of this statement. A checksum comparison implies a byte-for-byte comparison of two different files. A hard link is simply a private representative, so to speak, of the exact same file, in two different places.

    I can see the rationale for computing a checksum on the so called parent files in the /windows/winsxs directory to verify that this is the file that should exists in the standard /windows directory. But once you have confirmed a valid checksum exists on whatever file it is that you happen to be checking in the /windows/winsxs directory, it would seem redundant to compute a checksum on the same file in the /windows directory because if it's the same file as the original file in the /windows/winsxs file all you would really need to do is check the SequenceNumber of each file that you are comparing. If the filename sequence numbers are the same for each file then the hardlinks are pointing to the same file.

    If they are different then they are not pointing to the exact same file. No need to compute a checksum for each file.

    Of course, its very possible that someone has copied the exact same filename into the /windows directory and broken the hardlink. In this case the filename SequenceNumbers would be different which wouldn't necessarily mean that your file is corrupt. It would simply mean that both filenames point to a unique copy of the same file versus the single original file.

    In the event that someone has copied an exact duplicate of the parent file in the /windows/winsxs directory to the /windows directory, the SFC could simply delete the file to save space, and re-establish a hardlink in the /windows directory once again.

    To summarize my entire post, since it has been somewhat long winded I would say this.

    1.Computing a checksum should only need to be executed once on the original/master file in the /windows/winsxs folder and never on the file in the /windows directory. If the filename SequenceNumbers for both filenames do not match. You know then, that they are different. Simply delete the filename in the /windows directory and re-establish the hardlink.

    All this writing to ask one question. Does SFC /SCANNOW compute 2 checkums or only 1 for each file that it checks?

  150. Jelena says:

    Dear Joseph,

    I have been reading the comments for more than 15 minutes, but I really don't understand most of it. So I apologize if this question has already been answered – May I delete the duplicate folders? Those created the same day, at the same time, with the same content… my winsxs is 18GB.

    Thanks!

  151. Anonymous says:

    Hi,

    my winsxs takes 22gb out of my 40gb partition. Winver says I have: vista home premium: version 6.0 build 6002 service pack 2. According to explorer winsxs has 79680 files, 20150 folders. I have installed it on fall 2008 and have kept it updated since. Next you want to know what takes that much space in there, what is the tool to use to find out? I cant manually go and check them all.

  152. Anonymous says:

    I had already used COMPCLN and size is still 22 gb. In previous comments you have been curious as to what possibly could take such amount of space so how do I find out what sort of things take the most space?

  153. Sebastien says:

    The problem is not only winsxs,

    I have a 128GB SSD drive, after formating only 114GB based on explorer but on this 114GB I use :

    – winsxs : 9.1 GB (real not with the fake hardlink count and SP1 file already removed)

    – Installer: 5.9GB

    – MSOCache: 3.4GB

    Total :

    18.4GB I cannot touch, shrink or modify or it can break my Windows 7…

    It seems there is no solution to fix the problem, and Microsoft doesn't consider that to be a problem….

  154. Sebastien says:

    WinDirStat

  155. Sebastien says:

    As a test, I uninstalled all softwares I didn't need (around 5 or 6), including the full Adobe photoshop suite.

    The folder winsxs didnt move at all, not a single file removed.

    Neither the installer folder.

    Regards

  156. Sebastien says:

    I saw some advice you can uninstall path/update and that will reduce the size as far you keep the last rollup patch.

    Does that apply also to Office patch  ?

  157. Frank Provasek says:

    If a disk error or deliberate exploit  can corrupt a system file, it's just as possible to corrupt the backup or the 10 old versions stored on the disc.   Backups should not be stored on the same computer. If a file gets messed up, a confirmed good file should be downloaded from Microsoft.  The idea of keeping MULTIPLE old versions just in case someone wants to go back 6 versions??  That's very rare with higher level code, libraries and executables.  It was important 40 years ago when raw machine code pushed popped and moved hex numbers into absolute memory locations.  If you changed anything, you likely broke it for anyone else using that module.  But Microsoft doesn't care, their MVPs for YEARS just say "get a bigger hard drive" when the old one is perfectly adequate if not for useless files that Microsoft installs and makes harder and harder to  remove.  I have a laptop with Windows 7 and it has several GB of Asian fonts, Korean gramma checkers, Japanese tablet handwriting recognition. AND SXS Updates..(and I have no touch pad hardware!) It apparently came with the 30 day  trial version of Office 2007.  Microsoft update adds a NON REMOVABLE update to the Asian character support, and when you uninstall the Office trial, the Asian stuff stays — there is no uninstaller in add/remove programs, and trying to delete the fonts through control panel gives TWO nag screens that ask "are you sure" "are you really really sure"  yes  yes   then a message they are protected system fonts and cannot be removed,.

  158. Albert says:

    Joscon,

    I do see my winsxs growing beyond GBs and frankly speaking i am also angry on the fact that we cannot clean it up and make sure our systems run ok in case of any corruption. However being an engineer, I do have a solution which may be helpful for enterprises.

    Let us assume all enterprises are having NAS/external storage.

    How about providing the administrator to store the winsxs files (since it is mostly backups of patches that MS releases) in the external repository ( a common store). Whenever a machine is patched stored winsxs folder will be updated in the common store.

    When a component is corrupted, Windows servicing component will look into this external storage for the proper version. Since it is externally stored (and only one copy of the patch) administrators might not be saddened.

    This will ultimately bring down the requirement of storage and we have one common repository for entire network. The model i am explaining is similar to WSUS. Also you can softlink from local store to the common store.

    In case of home users, we can have the folders in external disks (most times our external disks are always connected.).

  159. Clean up WinSXS says:

    There is a command that we can run to make it smaller. http://www.productiveorganizer.com/…/how-to-clean-up-winsxs-directory-that-is-growing-too-big

    however, it does shrink mine down 2.7 GB but i expected more. One of the reasons windows can be a frustrating installation is due to this.

  160. MPF says:

    I began reading this article hoping to identify some additional drive space to complete the ghosting of a 300GB hard drive. After reading through this article I can safely say that many of you need to reach in to your penny jars and purchase some new hard drives. Many or you would live a much happier existence.

    A 300GB drive is arround 60 dollars. Windows 7 should have spit the disk back out at 140GB.

  161. V. says:

    As if the registry wasn't bad enough, now we get another mysterious bloated black box of a 'feature' that noone asked for. I'm stuck with Win7 for the moment, but I'll be going back to XP as soon as possible, which handles this issue the sane way. If I had only known this back then I guess I would have been creating placeholder manifests for all programs on XP to prevent them from storing data without my permission.

  162. Anonymous_one says:

    I have been drawn into this winsxs discussion following my last month's discovery that my Win-7 partition was 21Gb at that time on my SSD partition. I had originally created a 30Gb partition for it thinking it would be plenty. But now that I discovered that out of that 21Gb I have a 9Gb winsxs folder to which Microsoft is saying it is very important but is not coming up with a solution that would take in account that no HD change or HD space increase in looked at.  I installed Win-7 12 months ago and rarely installs softwares on it. I mainly use my Win-7's boot for games and building 3d stuffs.

    I have read about half of the threads in here and got fed up. So I went straight to the end but only to find out that after 3 years the situation has not changed. We are still stuck with this problem and even if some glimps of solutions were found here and there, they are still considered not safe but with the exceptions of DISM and TAKEOWN which Microsoft has recommended.

    I have not tried TAKEOWN but will in a few minutes. I have 250Mb of files in that Manifests folder. Even if this works out it is still not enough.

    However when I tried the DISM way, I got a message (don't recall exactly) saying something like it could not find or locate the SP1 files ?  I have not figured it out yet but then I did not concentrate my free time on this.

    One thing I found interesting in this thread.  If that winsxs folder is to act as a somewhat of a backup folder and we may find multiple versions of the same patch, then why isn't someone (ex: Microsoft) coming up with a software or KB to remove all those previous versions ?  Why keep 20 different versions of the same software if only the last one is used (unless someone does a restore and then the N-1 or N-x version will be the one used).

    Can someone do a summary of all the mentioned solutions and say which ones are safe, which ones save significant HD space, ….  This is just to avoid anyone having to painfully go through all these threads.  We need a summary !!!

  163. Anonymous_one says:

    I tried the DISM and TAKEOWN methodes and both did not work :

    1) DISM with administrative rights

    C:Windowswinsxs>dism.exe /online /Cleanup-Image /spsuperseded

    Outil Gestion et maintenance des images de déploiement

    Version : 6.1.7600.16385

    Version de l’image : 6.1.7600.16385

    Le nettoyage du Service Pack ne peut pas se poursuivre : les fichiers de sauvegarde du Service Pack sont introuvable

    L’opération a réussi.

    This roughly translates to it could not do it because it could not find the Service Pack backups.

    2) The TAKEOWN method, I successfully stopped the process and did the takeown. But when it was time to delete the folder's content (juste on 250Mb file), it told me access refused.

    What do I do now ?

  164. Lalala says:

    So much BULLSHIT… aaaaaaaaaaaaaaaaa…

    YES OR NO????

    Delete trillion giga winxs folder or not??

    This is the SIMPLE question!!!!

  165. anonymous_one says:

    How about simply converting that folder into a compressed folder ?

    At least there would be some space saving in doing that.

  166. NewEvolution says:

    I work at a computer repair shop and have a Vista machine that just showed up for servicing.  It has its original 160 GB HDD and Vista, without SP1.  I cannot install SP1, as the hard drive is entirely full, with only 2.6 GB free.  The user's data on the machine consists entirely of 2 JPEGs.  Winsxs is taking up 128 GB of space, a full 80% of the drive.  I'm being led to believe that the only solution for this issue is a complete format & reinstallation?  Windows never ceases to amaze me with how utterly awful it is at being an OS.

  167. NewEvolution says:

    Not sure if my last post got eaten due to the imgur link I stuck in it, but I actually pulled the drive to hook it up to a linux machine to analyze the drive with Baobob.  Here's the breakdown: http://imgur.com/8yas3hl

  168. NewEvolution says:

    Welp, one 116 GB blobs.bin file deleted and we're back in business.  Thanks for sharing your knowledge.  Going to file this one in the "WTF Windows" folder along with the machine from Tuesday that absolutely refused to try and boot from anything but the attached USB printer regardless of what I told BIOS.  Always an adventure.

  169. Jordan says:

    So i obviously haven't read every comment above lol, but from what ive slightly understood is this correct……….. the folder keeps getting bigger?? is this folder really meant to be 12.2gb?? this laptop only has a small hard drive so 12gbs taken out is a huge deal to us as we cant afford to just go out and buy an external :/

  170. Ed says:

    I am fighting with my security folks who use NESSUS to scan our network.  NESSUS is reporting that the VC90 versions are out of date in the WINSXS folder.  Does this translate to the actual files being out of date.  Are these files vulnerable?  Specifically the software is reporting MS11-025 as missing.  (Thanks for keeping this comment section alive for so long, it has helped.)

  171. Ed says:

    WSUS/SCCM report the machine as being compliant with MS11-025 installed (sometimes multiple installations due to multiple versions of C++ Redistrib).  But NESSUS is showing the following with file versions.

    SMB/FileVersions/windows/winsxs/amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_04480933ab2137b1/mfc90.dll=9.0.30729.4148

    SMB/FileVersions/windows/winsxs/x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7/mfc90.dll=9.0.30729.4148

  172. Ed says:

    It may have cut off my file versions which are both 9.0.30729.4148