Who ate my disk ?????????????????????????????

It’s that folder which resides in C:\Windows and takes up a lot of space on your Windows Server 2008 machine and which didn’t used to do that in Windows Server 2003. What does it contain?, can we delete it?, can we move it to a different drive?, can we delete something that’s under it? Are the questions that, almost, all of my team members have asked me over the recent past and my short answer to them has been ‘NO’. Explaining all about this folder (I know, geeks are supposed to call a folder as “Directory” as the word ‘folder’ sounds a bit too laymanish but I like to call it a folder) during work hours and that too separately to every individual, demands a lot of time, and time is at a premium at work as I try to finish all of my day’s tasks before the day ends (this line is for my manager, might just be useful during my next appraisal). This was not a problem for my team at my previous organization, as I used to have whiteboard sessions (which later on turned into “Glassboard” sessions as I started using a glass wall partition for my illustrations instead of the usual whiteboard. Now, that’s what I call being innovative ;)) for them after work hours or sometimes, even during weekends. I must also admit for a fact that they are the only ones in the entire world who read my blog ;). For my current team, I thought about sending an email to the team DL. So, that they get their answers pertaining to the WINSXS folder and then I thought, why can’t it be my next blog? So, here’s my blog entry for the WINSXS folder.

WINSXS refers to’ Windows Side by Side’ which refers to the concept of hosting different versions of the same file. Side-by-side technology is a standard for executable files in Microsoft Windows that attempts to reduce DLL hell. DLL hell designates a group of problems that arise from the use of dynamic-link libraries in Microsoft Windows. Problems include version conflicts, missing DLLs, duplicate DLLs, and incorrect or missing registration. In SxS, Windows stores multiple versions of a DLL in the WinSXS subdirectory of the Windows directory, and loads them on demand. This reduces dependency problems for applications that include an SxS manifest.

To start with, this folder takes up a LOT of space on the C: drive and keeps growing over time. The normal size is around 6-7 GB but I’ve even seen them as big as 15 GB. One of the major differences between W2K8 and the previous versions is the move from INF described OS to ‘componentization’. A component in Windows is one or more binaries, a catalog file, and an XML file that describes everything about how the files should be installed. From associated registry keys and services to the kind of security permissions the files should have. Components are grouped into logical units, and these units are used to build the different Windows editions.

Now, let us look at the folders that reside within the WINSXS folder
1. \Winsxs\Catalogs: Contains security catalogs for each manifest on the system
2. \Winsxs\InstallTemp: Temporary location for install events
3. \Winsxs\Manifests: Component manifest for a specific component, used during operations to make sure files end up where they should
4. \Winsxs\Temp: Temp directory used for various operations, you’ll find pending renames here
5. \Winsxs\Backup: Backups of the manifest files in case the copy in \Winsxs\Manifests becomes corrupted
6. \Winsxs\Filemaps: File system mapping to a file location
7. \Winsxs\: The payload of the specific component, typically you will see the binaries here.

WINSXS folder contains all of the OS components; it is called the component store. Each component has a unique name that includes the version, language, and processor architecture that it was built for. So, calling the WINSXS folder the entirety of the whole OS won’t be all that wrong. This folder is also the reason why Windows 2008 doesn’t ask for the Installation DVD while installing additional features and roles or while running SFC, like it used to happen with the previous versions of Windows. Windows 2008 copies the entire media content to the installed server with all components placed in the Single Instance Storage folder (SIS), C:\Windows\winsxs. When a feature or role is installed on the server, the required files are either copied or linked from the SIS folder so no media is needed.

But why does this folder get bigger and bigger? – Answer is ‘servicing’ (patches and service packs). In previous versions of Windows the atomic unit of servicing was the file, in Windows Server 2008 it’s the component. When we update a particular binary we release a new version of the whole component, and that new version is stored alongside the original one in the component store. The higher version of the component is used in the system, but the older version in the store isn’t deleted. The reason for that is the third part of why the component store gets so large.

Not every component in the component store is applicable, For example, on systems where IIS is available but has not been installed, the IIS components are present in the store, but not installed into any location on the system where they might be used. If you’re familiar with how multi-branch servicing works in previous versions of Windows then it’ll make sense to you that we have a different version of the component for each distribution branch and service pack level, and that all these different versions are also stored in the WINSXS folder, even if they’re not immediately applicable. So a single package that contains an update to one component will end up installing four versions of that component in the WINSXS folder – double that on a 64 bit operating system for some components.

Now that you know why the store can grow to be so large, your next question is probably to ask why we don’t remove the older versions of the components. The reason is reliability. The component store, along with other information on the system, allows us to determine at any given time what the best version of a component to be used is. That means that if you uninstall a security update, we can install the next highest version on the system – we no longer have an “out of order uninstall” problem. It also means that if you decide to install an optional feature, we don’t just choose the RTM version of the component, we’ll look to see what the highest available version on the system is. As each component on the system changes state that may in turn trigger changes in other components, and because the relationships between all the components are described on the system we can respond to those requirements in ways that we couldn’t in previous OS versions.

The only way to safely reduce the size of the WINSXS folder is to reduce the set of possible actions that the system can take – the easiest way to do that is to remove the packages that installed the components in the first place. This can be done by uninstalling superseded versions of packages that are on your system. Windows Vista Service Pack 1 contains a binary called VSP1CLN.EXE, a tool that will make the Service Pack package permanent (not removable) on your system, and remove the RTM versions of all superseded components. This can only be done because by making the Service Pack permanent we can guarantee that we won’t ever need the RTM versions. As far as I know, it only works on Vista and not Windows Server 2008 but haven’t tested it yet.

Here is how to use this tool.
NOTE 1: After you use this cleanup tool, you will no longer be able to remove Service Pack 1, should any problems occur. Make sure that the system is stable before using.
NOTE 2: This tool is a one-time use tool. Once it’s used it will no longer work on the same installation.
Open Windows Explorer and navigate to C:\Windows\System32. Look for the file “vsp1cln.exe.”
Right click this file and select the ‘Run as Administrator’ option.
The Vista Service Pack 1 Cleanup Tool will remove all of the redundant files that it has replaced.
The amount of disk space you gain will depend on the system, what files are installed, etc.

For Windows Vista SP2, Windows Component Cleanup Tool (compcln.exe) located in the system32 folder seems to be the tool that can be used to clear the superseded versions and this can be run even on Windows Server 2008 SP2 machines, The steps to run it on a Vista machine are given below.

Running this compcln.exe tool is pretty simple:
1. Execute the command “Compcln.exe” at the elevated command prompt. The path is “c:\Windows\System32 \compcln.exe”.
3. You will be prompted with a question whether to keep SP2 permanently in the system.
This operation will make all service packs and other packages permanent on this computer.
Upon completion you will not be able to remove any cleaned packages from this system.
Would you like to continue? (Y/N):
4. Once you type “Y” and press enter, the system will start performing the windows components cleanup.

On my test run, it freed up 1 GB of space from the WINSXS folder from a Windows Server 2008 SP2 test box and I know it’s not much.

In short, if you have a dwindling C: drive and the WINSXS folder is the main culprit, sadly enough, you can’t do much about it. I have seen people blaming Microsoft after running into disk space issues with servers where they have installed Windows Server 2008 on 20 GB drives. Their argument is that it was enough for W2K3, yes it was enough for the previous version but skipping due diligence while upgrading to W2K8 or while going for a new server build is the sole reason for their problems. Microsoft came out with this as the solution for the ubiquitous DLL Hell Problem with the previous versions of Windows. Who was not fed up with the missing DLLs ? How many times had you seen something like “A Required DLL File, Z.DLL, was not found” or “The procedure entry point Y couldn’t be located in X.DLL” when you would try to run an application, or during startup. Expecting that your Ferrari would only need the same amount of fuel as your dad’s car is nothing but stupidity. Microsoft recommends a minimum of 32 GB or greater for the OS alone (some application files also go into the C: drive, So, consider that as well) but going by that minimum requirement would be something like housing a family of four in a studio flat, it’s not impossible but obviously full of problems. I have always liked to have at least 50 GB allocated to the C: drive on the servers and the humongous size of the WINSXS folder is something that justifies my liking.

But then, I was wondering, what would happen if we delete WINSXS ? And Yes, I tried deleting the folder from a Windows Server 2008 SP2 test box. First, it won’t let me delete/move/rename it. So, had to mount it’s hard drive on another system and then delete it. But, when I tried to boot up the system again, it didn’t come up. So, DO NOT DELETE/RENAME/MOVE WINSXS.