Windows Enterprise Desktop


August 4, 2017  1:19 PM

Win10 Post-Repair-Install Issues Appear

Ed Tittel Ed Tittel Profile: Ed Tittel
Microsoft Windows Installer, Windows 10, windows installer

Earlier this week, I reported on my experiences in performing a repair install on my production PC. To recap: in the wake of installing KB4032188 on that machine, I couldn’t enter a pin or password to login after the reboot. Eventually, I did get that PC started. Because those boot issues kept re-appearing intermittently, I ran an upgrade/repair install to fix them. The good news is that this approach worked. But there have been some consequences, as Win10 post-repair-install issues appear. Let me elaborate…

Win10 Post-Repair-Install Issues Appear

A repair/upgrade install fixes many Windows ills, but it only mostly leaves the prior install intact. What falls outside the “mostly” can get interesting…

Details When Win10 Post-Repair-Install Issues Appear

The appeal of the upgrade (re)install is that this OS repair leaves an existing Windows installation mostly intact. Over the past couple of days, I’ve been learning what falls outside that “mostly” umbrella. Here’s my list of observed items so far. Future experience may cause me to expand as new items make themselves felt or known:

8GadgetPack: Yeah, I know I’m not supposed to run gadgets any more. But they’re so darned handy I do it anyway. Each time an upgrade runs on a Win10 machine, it disables gadgets. Fortunately, Helmut Buhler’s run-time notices this, and offers a repair shortcut on the desktop. A quick double-click on same and gadgets are back at work.

System Restore disabled by default: upgrades and clean installs start up with restore points disabled, no matter the prior state of the OS beforehand. One must remember to visit the System Properties window to turn restore points back on for the boot/system drive (if they’re wanted).

Windows 7 Games: I’m still hooked on Freecell, Solitaire and Hearts. Something about upgrade or clean install kills the ability to run those old games on new Windows versions. A reinstall turns out to be required, but neither terribly difficult nor time-consuming. Prior to repair, the icons still show up (in generic form) but nothing runs; after repair: game on!

Norton Identity Safe: I use Norton Internet Security on my production PC. Norton Identity Safe is my password store on that machine. Also, a Web-based version lets me use it on any machine with Internet access. Although I disabled Norton during the upgrade process, and re-enabled it afterward, Identity Safe wouldn’t run. I ended up downloading and using the Norton Remove and Reinstall tool to fix this.

People: I don’t use the People feature in Windows 10.  (Instead, I use Outlook contacts in various versions of Office 365). People still shows up by default on my Taskbar. Thus, I have to unlock the taskbar, then turn off People in Taskbar settings. Finally, I re-lock the taskbar to keep from changing it by accident.

Nvidia GeForce Experience: the first time I fired it up, post-upgrade, it re-installed itself and informed me I needed a new GeForce driver. Looks like something about the upgrade stymies the operation of and automatic update check here.

Anything else?

That’s it so far. The great joy of Windows is that you often don’t recognize a problem until it hits you over the head. I’ll keep adding to this list of items as they do that to me. Stay tuned! If any new Win10 post-repair-install issues appear, I’ll let you know here.

August 3, 2017  1:26 PM

MVA Offers Free Win10 Security Course

Ed Tittel Ed Tittel Profile: Ed Tittel
FREE, Security training, Windows 10

Every month, like clockwork, I get an email blast named “MCP Monthly” from Microsoft Learning. In fact, anybody who’s ever passed any MCP exam can sign up for and receive this newsletter. This latest issue includes an item entitled “Windows 10 Security in Real Life.” As it happens, this points to an MVA (Microsoft Virtual Academy) course of the same name. The featured instructors are Erdal Ozkaya, MS Cyber Security Architect, and Raymond Comvalius, an independent IT architect. The course includes 6 modules from 8 to 45 minutes or so in length, with total playing time of 2:46, as shown in Table 1. Because MVA offers free Win10 security course to all, it makes sense for interested parties to give it a try.

Modules from

Win10Security in Real Life

Module Title Time
1 Security Landscape 0:42:26
2 Device Protection 0:13:26
3 Threat Resistance 0:07:48
4 Identity Protection 0:43:19
5 Information Protection 0:19:55
6 Breach Detection 0:41:28
Total 2:48:22

So MVA Offers Free Win10 Security Course:
Where Do I Find It?

Sign-up is easy at the Microsoft Virtual Academy. You’ll use your Microsoft Account to login directly to the course at MVA. Then, simply work your way through the six modules in sequence. Along the way, you’ll hear from your friendly and voluble instructors. It’s interesting stuff and worth digging into for those charged with managing and maintaining security for Win10 PCs on organizational networks. You’ll definitely want to check it out.

MVA Offers Free Win10 Security Course

The content is useful and interest, the topic timely, and the price entirely right. What more could you want?

If you’ve been itching to learn about new MS security technologies such as Windows Hello and Credential guard, you’ll find them covered here. Same goes for data protection using Windows Information Protection (WIP) and Conditional Access. Likewise for Windows Defender’s Advanced Threat Protection. It can help detect, diagnose, investigate and respond to so-called Advanced Persistent Threats (APTs). Good stuff, all the way around. Please dig in at your convenience!


August 2, 2017  5:24 PM

KB4032188 Causes Win10 Confusion

Ed Tittel Ed Tittel Profile: Ed Tittel
Troubleshooting, Windows 10

Microsoft released a new Current Branch cumulate update earlier today. Alas, the update known as KB4032188 causes Win10 confusion — at least, on one of my PCs. After the mandatory restart to fully install it, I found myself in the vexing position of being unable to login. On one PC, the update apparently knocked out access to both mouse and keyboard (which speaks to a potential USB driver gotcha). It’s impossible to login to Windows if you can’t key in a PIN or password, nor use the mouse to do likewise with an on-screen keyboard equivalent. Sigh.

KB4032188 Causes Win10 Confusion

When you see the login screen but can’t use a mouse or keyboard, then what? Think fast!

When KB4032188 Causes Win10 Confusion, What to Do?

I keep a small bin full of USB flash drives on my desk. It numbers the Macrium Rescue Media, Kyhi’s Bootable PE Rescue Disk, and an installable UFD with Windows 10 Pro 15063 among its contents. First, I booted up using the Macrium item to roll back to last night’s image capture. No dice: the boot issue continued unabated. Second, I booted into Macrium again, and ran its Windows boot repair utility. Again: no dice. Finally, I used the Win10 15063 UFD to perform an in-place upgrade/repair install (I did manage to get Win10 to boot to make this happen) to rewrite my Windows files. That almost did the trick, though some post-(re)install cleanup also proved necessary…

Where Did Those &*(% Drivers Go?

Following the repair install, the machine booted just fine. I was (mostly) back in business. Upon closer inspection, I observed that my Intel I211 GbE NIC had gone south. So I switched to my handy Startech USB 3.0 to GbE dongle to regain network access immediately, then uninstalled the wonky driver in Device Manager. A quick “Scan for hardware changes” later, and MS automatically downloaded a working driver for that NIC without difficulty or demur. Although I’m not using the 2nd NIC on my mobo (an Intel I219-V) the same maneuver worked to restore its driver to working when I switched my RJ-45 cable from one built-in NIC to the other.

One problem I couldn’t solve quickly, and don’t want to troubleshoot to completion, is that my Asrock Extreme7+ motherboard has stopped recognizing 4TB drives. They worked on it before, and still work just fine on my Asrock Z97 Fatal1ty gaming board. Thus, I’ve still got some lingering device issues there. I plan to perform a clean install of Win10 Pro on the production machine later this month, after I come back from a road trip to Fairfax County next week. I’ll perform a manual disk partition to put the recovery partition at the end of the drive where it rightfully belongs, using SysPrep to create a custom Windows image for regular re-use. I just don’t want to take the time to figure out what’s up with the big drives right now.

And so it goes, here in Windows world. I’m back to work, updates are applied, and nearly everything is working like it should be. But there are always more updates a’comin’ and more gotchas inevitably along with them. Stay tuned as I recite my adventures and contortions in dealing with them…


August 1, 2017  12:11 PM

Using MS Search Effectively

Ed Tittel Ed Tittel Profile: Ed Tittel
Search Indexing, Windows 10, Windows Search

Because I work as a writer, I often find myself looking for specific references in my previous work. This means I appreciate search tools that offer fast, easy access to document contents, not just filenames. In perusing a TenForums post recently, I learned that Win10’s built-in search function offers content indexing and search. This comes as welcome news to me, because other text search tools I’ve tried out have been none of the following: cheap, fast, and decent performers. But by using MS search effectively, these hurdles may be overcome.

The Secret to Using MS Search Effectively

Turns out you can index file contents as well as filenames in the MS search tool. This requires using the Advanced Options window available in the Control Panel widget named Indexing Options. The keys to success require two things:

  1. Making sure that all relevant file extensions are checked (all are checked by default, so you may decide to prune a bit to speed indexing time if you wish to search content as well as filenames)
  2. Clicking the radio button that reads “Index Properties and File Contents” near the bottom of this window.

You can see this at work in this screen capture of my Advanced Options window here:

Using MS Search Effectively

Click the “file contents” radio button to instruct the built-in search command to report on file and document contents.

The Downside of Using MS Search Effectively

You knew there had to be a gotcha, right? Perhaps there is more than one, in fact. First, you need to review the “Included Locations” list in the Indexing Options window to make sure all volumes and folders in need of indexing appear therein. Second, you must be prepared to pay the time and space penalties involved in creating and maintaining MUCH BIGGER indexes.

Thus, if you decide to index content as well as so-called “index properties” (basically, this means file names and other file meta-data only) you’ll see some big changes. After indexing for content in the Users folder and my “work drive” (where I keep current or recent writing work), the index file jumped from under 33 MB to 2.4 GB. That file is named Windows.edb; its default location is

 C:\ProgramData\Microsoft\Search\Data\Applications\Windows.

Obviously, the bigger file takes more time to create and maintain as well as more storage space. But if you’re willing to bear that burden, you’ll find the built-in search function to be both speedy and useful in chasing down local content references and the files in which they reside. Note: you may also decide to scope your searches by clicking the “Filters” item to focus in on specific volumes or folders (on the C: drive) once your new index is built. I found this to be a great way to search my Documents folder, or my work drive, for example. You may find the same to be true for you, too!


July 31, 2017  10:42 AM

Consult MAP Toolkit for Win10 Deployments

Ed Tittel Ed Tittel Profile: Ed Tittel
Software Deployment Tools, Windows 10, Windows Deployment Services

The free Microsoft Assessment and Planning Toolkit, aka MAP or MAP Toolkit, is available to Windows professionals online. For organizations who’ve not yet succumbed to the allure of Windows 10, it’s probably a good idea to download and consult MAP toolkit. That’s true for all organizations, even those pondering the possibility of a migration (not its eventuality).

Where to Start: Consult MAP Toolkit

It’s easy to grab the MAP toolkit from MSDN. A simple download does the trick. Grab all four of these download files from the preceding Download Center link, please:

  • MAP_Training_Kit.zip: sample database with demo exercises to demonstrate MAP actions and capabilities
  • MAP_Sample_Documents.zip: large library of sample MAP output documents for all kinds of assessments
  • MapSetup.exe: executable file to install MAP on a technician/survey PC (desktop)
  • readme.htm: introductory file (read first and foremost before doing anything else); explains pre-requisites, installation, troublehooting, repair, and upgrades for MAP.

Next, before touching the setup file, you’ll want to consult the MAP Getting Started Guide.  As a further illustration, here’s a diagram of Microsoft’s vision for the proper process of using MAP:

Consult MAP Toolkit

Note: the first 4 steps in the process come from the Getting Starting Guide.
Only the 2 final steps, which may repeat indefinitely, come from MAP itself.
[Click image for full-sized view, please.]

Truly, MAP can be a useful tool for those considering Windows deployments of many kinds. These include Windows Server 2016, plus various Windows Server-based platforms and services. (Common examples: SharePoint, SQL Server, Lync, ForeFront Endpoint Protection, and so forth). Of course, my focus here is on desktop OS deployments, particularly Windows 10. But IT professionals, upon inspecting the documentation and exploring MAP capabilities, will soon appreciate that it can do quite a bit more than that.

MAP runs on a single PC with access to the network(s) to be inventoried and assessed. Users may opt into the Customer Experience Improvement Program (CEIP) when running MAP. If so, the toolkit collects anonymized information from its use and ships the data off to MS. MAP creates and uses a SQL Server 2012 Express LocalDB as part of its operation. See the readme.htm file and the Getting Started Guide for more information and further details.


July 19, 2017  3:59 PM

Add Custom Drivers to WinRE

Ed Tittel Ed Tittel Profile: Ed Tittel
Device drivers, Windows 10, Windows RE

The Windows Recovery Environment (aka Windows or RE or WinRE) is a valuable tool for system recovery. But on some PCs, the standard collection of device drivers packaged with Windows itself may not cover your needs. You’ll know if this means you when you find you must add device drivers after completing a clean Windows install or an upgrade install. That’s when it make sense to add custom drivers to WinRE as well. If your regular runtime needs them, your recovery runtime will probably need them also. This turns out to be a simple task.

Add Custom Drivers to WinRE

By default, WinRE.wim resides inside the Windows Recovery partition. Shown using Partition Explorer in MiniTool Partition Wizard.
[Click image for full-sized view]

How to Add Custom Drivers to WinRE

The secret lies to using the Deployment Image Servicing and Management, or DISM, command built into modern Windows versions. That means Windows 7 and newer on the desktop, Windows Server 2008 and newer on the server side of things. Windows 10 users can run some specific PowerShell cmdlets instead to get the job done. Because this involves working on an image file, the basic process works like this:

  1. Mount the Windows image (.wim) file you wish to operate upon
  2. Add the device drivers needed to that image
  3. Dismount the mounted Windows image so it may then be used

For more information on this, please consult the MS Hardware Dev Center document “WinPE: Mount and Customize.” It’s very helpful.

A Script to Add Custom Drivers to WinRE

The operation of the PowerShell script provided here depends on a crafty trick to simplify adding drivers. That trick involves copying all the necessary driver files into a single directory, from which DISM will then add them to the mounted image. For the purposes of this script, I put them into a directory named C:\temp\Drivers. You can put them wherever you want, but that’s where you’ll have to reference them in the command script in place of that reference.

The script also references the version of WinRE that’s included with Macrium Reflect Free, a free and capable backup and restore program. Reflect includes a nice recovery environment, boot repair tools, and more. If you’d rather use a plain-vanilla WinRE image instead, you can. You may find the file named WinRE.wim in C:\Windows\Recovery. Otherwise, if you have access to a recovery partition on one of your disks, you’ll find it at: <DL>:\Recovery\WindowsRE. Of course, <DL> stands for Drive Letter, which means you’ll need to assign a drive letter to the recovery partition (at least temporarily), then use that letter to see (and grab) the WinRE.wim file.

Here’s the script:

# Mount WIM (remove linefeeds following comments # here)
# Each of the mount, add, and unmount commands go on one line
Mount-WindowsImage -ImagePath 
"C:\boot\macrium\WA10KFiles\media\sources\boot.wim" 
-index 1 -Path "C:\temp\mount"

# Add any device drivers (.inf files)
Add-WindowsDriver -Path "C:\temp\mount" 
-Driver "C:\temp\Drivers\" -recurse

# Unmount the WinPE image
Get-WindowsImage -Mounted -ErrorAction Stop 
| ForEach-Object { Dismount-WindowsImage -Path 
$_.Path -Save -ErrorAction Stop }

Capturing Drivers for Use with WinRE Customization

The every-handy DISM command also captures drivers, too. Once you get your current Windows installation set up the way you want it, with all drivers up-to-date, it will take a snapshot for you. You can use DISM to populate the afore-cited C:\temp\Drivers directory by entering:

dism /online /export-driver /destination:C:\temp\Drivers

at an administrative command prompt, or in PowerShell (admin). Then, you can run the foregoing script, secure in the knowledge that all the drivers you need will be added therein.

[Note: my thanks to user Lx07 at TenForums.com, who posted the original of this script in the message thread entitled “How do I make Wifi work in PE?” on 10/9/2015. I’ll observe that the directory spec for the Macrium boot.wim has changed since then, too. My pointer as referenced in the preceding script is correct for versions 9 and 10. For the record, for a Windows Recovery partition on drive L:, the file specification would be L:\Recovery\WindowsRE\WinRE.wim.]


July 18, 2017  2:11 PM

Periodic Win10 Disk Cleanup Checklist

Ed Tittel Ed Tittel Profile: Ed Tittel
Disk cleanup, Windows 10

Over the years, I’ve developed a drill to keep the trash on my Windows disks under control. For Windows 10, that involves an interesting mix of tools and utilities to get rid of unwanted and unneeded files. Forgive me in advance for dragging in lots of stuff. That said, a genuine periodic Win10 disk cleanup checklist covers many bases. Thus, it should come as no surprise that numerous tools are needed. Here goes!

Periodic Win10 Disk Cleanup Checklist

Right-click and run this tool as administrator to clean up system files automatically.

Populating the Periodic Win10 Disk Cleanup Checklist

What’s the period? Up to you to decide. I try to hit every item on the list at least once every three months (or after a Windows Upgrade) but some of them I repeat weekly or more often. Those looking for guidance can consider my suggested frequency entries in the following table.

Tool Description Suggested Frequency
Disk Cleanup Run as admin or choose “Clean up system files” Weekly
CCleaner Read over cleanup options carefully! Weekly
Uncleaner Temporary/working file cleanup only Weekly
WizTree Shows disk space consumption, biggest consumers Monthly
WinDirStat Shows disk space consumption, biggest consumers Monthly
DISM Various options clean up files (see notes) Monthly/Quarterly
PatchCleaner Cleans up orphaned WinSxS entries Quarterly
Fsutil See Fsutil 7/17/17 blog post Quarterly
RAPR.exe Use it to prune duplicate/obsolete device drivers Quarterly

Because WordPress won’t let me easily include hyperlinks inside a table, here are links to 3rd-party items:

CCleaner (Piriform)
Uncleaner (Josh Cell Softwares)
WizTree (Antibody Software)
WinDirStat (Sourceforge)
PatchCleaner (homedev)
RAPR.exe (aka Driver Store Explorer, GitHub)

And likewise, here are some relevant links to built-in Windows utilities also referenced in the table:

Disk Cleanup: Disk Cleanup Beats CCleaner Post-Win10-Upgrade
DISM: see information on startcomponentcleanup and resetbase on TechNet as in “Clean Up the WinSxS Folder
Fsutil: Fsutil Cleans Up Excess Old Transactions

I’m sure this doesn’t exhaust the possibilities for a periodic Win10 disk cleanup checklist, but it’s a pretty good start. Please comment here or email me through my Website to suggest additions or substitutions. I still believe that you can’t have too many good tools in the old admin toolbox. The more, the merrier, in fact.


July 17, 2017  12:16 PM

Fsutil Cleans Up Excess Old Transactions

Ed Tittel Ed Tittel Profile: Ed Tittel
Command line, Disk cleanup, Windows 10

In reading over TenForums this weekend, I came across a new potential source of disk space consumption in Windows. It turns out that NTFS can sometimes allocate lots of space for transactions. It uses a built-in facility called the Kernel Transaction Manager (KTM), along with the Common Log File System to implement transactional NTFS, aka TxF. Potential pathologies can result, and consume 100s of MBs or even GBs of disk space. I learned all this, and more, from Chapter 12 of Windows Internals, Part 2, 6th Edition (pp. 469-477). Fortunately, the “file system utility” command, fsutil cleans up excess old transactions. It can also easily report on what’s up with TxF. Here’s a screen cap of one particularly useful such command:

Fsutil Cleans Up Excess Old Transactions

The “resource info \” parameters for fsutil describe transaction space and data for the boot/system drive.
[Click image to see full-sized view.]

Details: How Fsutil Cleans Up Excess Old Transactions

Just to be clear, the info shown in the preceding screen shot shows what a typical Windows 10 desktop looks like (based on my local sample of 7 physical machines, and 4 VMs). The TenForums message thread I saw voiced a desire to identify and repair the cause of 28GB of “missing” disk space on an SSD (see item#8 for details). It runs out that the poster’s system had been writing huge volumes of transaction logs and data that weren’t getting cleaned up. Running a specific fsutil command cleaned up and reclaimed the excess disk space consumed thereby:

fsutil resource setautoreset true <drive-spec>

There <drive-spec> is the volume ID for the volume you wish to clean up (such as C:\ or D:\). The poster also reported that this took upwards of 30 minutes to complete. Thus, for systems with lots of space consumed by TOPS, be prepared to spend some time to reclaim such space.

A Few Explanatory Notes on FSUTIL Output

TOPS stands for TxF Old Page Stream. It maintains a default data stream in the $Tops file, along with an alternate data stream called $T. Windows Internals says this about the function of the $T stream:

The $T stream contains file data that is partially overwritten by a transactional writer (as opposed to a full overwrite, which would move the file into the $TxT directory). NTFS keeps a structure in memory that keeps  track of which parts of a file are being modified under a transaction so that nontransacted readers can still access the noncommitted data by have their reads forwarded to $Tops:$T. When the transaction is committed or aborted, the pages are … moved from the $T stream into the original file …” [pg. 474].

In a subsequent paragraph, the authors go onto observe that the TxF log files reside in a hidden directory named $Extend. To find his problem, the Tenforums poster used a file analysis program called WizTree. Turns out it’s adept at displaying both hidden files and on-disk space consumption. This combination is particularly important when detecting TxF related space consumption issues. In the poster’s case, WizTree showed space consumption of 34GB in the $Extend directory tree. Of course, you can always use fsutil to look for such issues explicitly. Because Fsutil cleans up excess old transactions, I’ve added it to my quarterly disk space inspection and cleanup routine.

More Info on the Fsutil Command

For more information on the fsutil command, see its Windows Server Command-Line Reference entry. There, you’ll find examples of proper syntax and usage. It’s worth consulting before putting this useful and informative tool to work.

[Note: The 7th edition of Volume 1 of Windows Internals is currently available, but the 7th edition of Volume 2 isn’t scheduled for release until late 2017 or early 2018. That’s why I had to consult the previous edition, instead of the current one, for the fsutil information cited here. The newest version of that coverage is apparently still in development!]


July 14, 2017  5:55 PM

Free Microsoft Press eBooks July 2017

Ed Tittel Ed Tittel Profile: Ed Tittel
eBooks, Windows 10

From time to time, Microsoft Press offers free eBooks to interested readers for their download and use. Recently, Sales Director Eric Ligman posted a whopper of an offer. It appears in an MSDN blog entitled “Free! Multi-Million eBook Giveaway!” I count a total of 252 titles in this list of free Microsoft Press eBooks July 2017. That’s a LOT of free books, perhaps enough to justify two exclamation points in Ligman’s title.

ebook-1707

Perhaps this isn’t pure hyperbole: lots of interesting stuff for FREE!

Here’s how the total list breaks down by category. After that, I’ll recite the Windows Client (mostly Windows 10-related) books on offer:

July 2017 MS Press eBook Giveaway
Category Name # of Titles Formats available
Azure 12 Some in PDF/MOBI/EPUB; most PDF only
BizTalk 2 1 PDF, 1 DOC
Cloud 2 1 PDF/MOBI/EPUB, 1 PDF only
Developer 14 Some in PDF/MOBI/EPUB; most in PDF only
Dynamics 23 PDF only
General 4 2 PDF, 2 DOC
Licensing 4 PDF only
Office 70 Most PDF only; other miscellany
Power BI 12 PDF or DOC
PowerShell 13 PDF only
SharePoint 11 PDF only
SQL Server 30 Most PDF only; other miscellany
Surface 2 PDF only
System Center 19 some PDF/MOBI/EPUB; rest miscellany
Virtualization 1 XPS/PDF
Windows Client 17 Most PDF/MOBI/EPUB; rest miscellany
Windows Server  14 Most PDF/MOBI/EPUB; rest PDF only

Like I said, that’s a LOT of books. I know those who read this blog are interested in Windows Client. (“Desktop OS” is mostly what that means.) So, here’s a complete list of those items. It’s reproduced verbatim from the MSDN blog post.(Click on any format ID in the right column for a corresponding download link):

Deploying Windows 10: Automating deployment by using System Center Configuration Manager PDF/MOBI/EPUB
Deploying Windows 10: Automating deployment by using System Center Configuration Manager – Mobile PDF
Getting the most out of Microsoft Edge DOC
Introducing Windows 10 for IT Professionals PDF/MOBI/EPUB
Introducing Windows 10 for IT Professionals, Preview Edition PDF/MOBI/EPUB
Introducing Windows 8.1 for IT Professionals PDF/MOBI/EPUB
Introducing Windows 8: An Overview for IT Professionals PDF/MOBI/EPUB
Licensing Windows desktop operating system for use with virtual machines PDF
Protecting your data with Windows 10 BitLocker DOC
RAP as a Service for Windows Desktop PDF
Shortcut Keys for Windows 10 DOC
Use Reset to restore your Windows 10 PC DOC
Volume Licensing Reference Guide Windows 10 Desktop Operating System PDF
Windows 10 IT Pro Essentials Support Secrets PDF/MOBI/EPUB
Windows 10 IT Pro Essentials Top 10 Tools PDF/MOBI/EPUB
Windows 10 IT Pro Essentials Top 10 Tools – Mobile PDF
Work Smart: Windows 8 Shortcut Keys PDF

When facing this kind of largesse, I’m reminded of an old rule for eating in a military cafeteria. It goes like this: “Take all you want, but eat all you take.” Or read, as in this case… Enjoy!


July 13, 2017  1:23 PM

Win10 Volume Shadow Copies May Need Cleanup

Ed Tittel Ed Tittel Profile: Ed Tittel
Disk cleanup, Shadow Copy, VSS Backup, Windows 10

Mostly, the Windows Volume Shadow Copy Service works behind the scenes. This service coordinates among backup tools, applications in need of backup, and OS-provided storage management and hardware. Usually abbreviated VSS, this service enables creation and capture of shadow copies. Helpfully, TechNet defines “a consistent shadow copy” as “a snapshot or a point-in-time copy” of the runtime environment and the data it uses. Shadow copies let the OS and applications keep running and changing, even while backup is underway. Over time, shadow copies can accumulate, sometimes alarmingly. And that, dear readers, is why Win10 volume shadow copies may need cleanup or occasional pruning.

VSSadmin Helps When Win10 Volume Shadow Copies May Need Cleanup

Use the VSSadmin command to grapple with VSS and the shadow copies it creates and stores. Thus, you can (and should) consult the TechNet Command Line Reference for all the details on VSSadmin. For now, here’s an overview:

Vssadmin Command Description
delete shadows Deletes volume shadow copies.
list providers Lists registered volume shadow copy providers.
list shadows Lists existing volume shadow copies.
list shadowstorage Lists all shadow copy storage associations on the system.
list volumes Lists volumes that are eligible for shadow copies.
list writers Lists all subscribed volume shadow copy writers on the system.
resize shadowstorage Resizes the maximum size for a shadow copy storage association.

Source: TechNet Command Line Reference: Vssadmin page. All links are live to command options and details.
[Note: Command options not shown in this table are not supported in Windows 10.]

Getting a Handle on Volume Shadow Storage Consumption

By no coincidence, Vssadmin helps you explore shadow copy storage consumption in Windows 10. First, for an overview of which volumes use VSS, and how it lays out, the “list shadowstorage” option is handy. [Note: for Vssadmin, either PowerShell (Admin) or cmd.exe (“Run as administrator”) works equally well. I prefer PowerShell, because it is more powerful and responsive, and supports simpler cut’n’paste operations.]

Here’s a screen cap of the output for this command from my Lenovo T520 laptop:

t520-shadowstorage

Three of the five volumes available to the T520 currently support VSS storage.
[Click image to see full-sized version, please.]

Decoding Vssadmin Shadowstorage Info

Here’s some discussion to illuminate shadowstorage data:

  • The C: drive is the boot/system drive, a 250 GB (nominal, actual 237 GB) SSD. It has a relatively low maximum allocation of 9.5 GB to VSS. 6.04 GB of copy storage space is currently allocated, and 5.58 GB is currently used. On a smaller, faster SSD, this is just the way I like it.
  • The D: drive is an internal data and backup storage drive. Nominally 1 TB (931 GB actual) it has a maximum allocation of 179 GB. 172 GB is currently allocated, and 163 GB is currently used. This drive is my built-in backup storage. It handles Macrium Reflect and the built-in Backup and Restore (Windows 7) utility, too. I’m OK with a big allocation and usage load because it provides insurance. But 172 GB is a lot of storage!
  • The E: drive is an external, USB-attached data and backup storage drive. Nominally 2 TB (1.81 GB actual) it has a maximum allocation of 279 GB, of which only 13 GB is currently allocated and used. It’s my remote or “extra” backup, and provides coverage in case the laptop gets lost, stolen, or becomes unusable.

Pruning Shadow Copies Using Vssadmin

Current consumption and allocation numbers for D: are kind of high. Thus, I use the Vssadmin list shadows /for=D: command to show them to me. Indeed, I count 27 separate shadow copies in total, dated back as far as Christmas day, 2016. I don’t need this many, so I will do some pruning.

Sure, you can prune using delete shadows, with any of a variety of options. I prefer to resize shadowstorage instead. It automatically prunes shadow copies as the allocation for shadow copy storage is reduced. Pruning starts with the oldest shadow copy, and works up to the most recent shadow. Accordingly, I reset the maximum allocation to 50% of its current value (179 GB goes down to 85 GB). As expected, that cuts the number of shadow copies to 13. Of those copies, the oldest is now dated April 16, 2017. The syntax for that command is:

vssadmin resize shadowstorage /for=D: /on=D: /maxsize=85GB

Dealing with “Foreign Shadow Copies”

The resize shadowstorage option also offers another useful benefit. As I look at what’s on my E: drive, I see that its shadows come from an obsolete PC.  That is, they come from a previous incarnation of my production PC named “ETprodPC.” Notice what happens when I try to delete one of those shadow copies, as shown in this screen capture:

t520-eshadows

If your PC didn’t create a shadow copy, Vssadmin won’t let you delete it directly. But there’s a trick…

Because the running OS didn’t create that shadow copy, Vssadmin won’t let you delete it. But if you can use resize shadowstorage with /maxsize set to a low number. 400MB works fine, because it’s less than what most shadow copies consume. And that gets rid of foreign shadow copies when executed. Afterward, you can re-run the resize command to upsize your storage allocation.

I’d recommend checking shadow copies no less frequently than twice a year. You can prune excess copies quickly and easily and save big on disk space consumption. This is especially helpful on tablets and laptops, where storage space is usually at a premium.


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: