Low disk space after filling up C:\Windows\Temp with .evtx and .txt files

12

I've been using my new Windows 10 PC for about one week and have recently started getting this warning:

Low disk space warning

This does not appear every reboot. Checking C:\ properties, 212MB was reported free...and after a reboot Windows now claims that 0MB is free! I was not able to capture that image because Windows refused to save the file with a message that the "disk is full".

I realise this question has been asked before (for example here) but none of the answers there helped. I've carefully checked every folder on my system, and the total disk size is 236.31GB and actual "Size on disk" space is only 51.09GB.

I've tried:

  • Clearing the Recycle Bin
  • Clearing out all Windows Event Logs
  • Deleting all system restore points
  • Rebooted multiple times

What on earth is going on here?

UPDATE 1

After a reboot I now have 24MB free (on a 236GB disk!) and managed to install WinDirStat (from a suggestion I found in web search). After analysing the entire system, it identifies 92,798 files in the folder C:\Windows\Temp which add up to 183.7GB.

In this folder there are 61,510 files with the extension .evtx, identified as Event Log by Windows. They are typically a few MB in size and have names like AppXDeploymentServer_4A4B3E10-6F81-0000-1A5D-4C4A816FD401.evtx.

There are also 30,795 files with the extension .txt, identified as Text Document by Windows.

Why are these files not reported in Properties and can I safely delete these files? Or maybe permanently disable the associated event log? Is there a way to stop Windows crapping on my hard disk so I can just use the PC?

UPDATE 2

I have now manually deleted ~30k .txt files and anything else older than 24 hours from that folder (~62k other files totalling ~182GB). After a reboot, Windows now reports 183GB of free space.

OK, that sounds good...except that I'm now looking at this C:\Windows\Temp folder. When I first entered the folder, there were 446 items...and now 5 minutes later there are 667 items!

How can I stop Windows writing files here!

EDIT: The number of files has now jumped to 712 after writing the above comment. WTF??

UPDATE 3

The problem is definitely related to the C:\Windows\Temp filling up with (mainly) .evtx files. These usually have a size of 5,188KB. Following from one of the comments, I loaded one of the .evtx files (the random one I selected had 4,108 events in it). There are hundreds of Information, Error, Verbose and Warning messages. Here is an example screenshot with one of the errors highlighted.

Example event log

Here is a sample from one of the thousands of .txt files written to this folder:

Package full name = Microsoft.SkypeApp_14.33.41.0_neutral_~_kzf8qxf38zg5c
AppXDeploymentServer version = 10.0.17134.320
Result code = 0x80073CF6
Component failure code = 0x80070422
ETW Event ID = 310
Deployment Operation = 4294967294
Package Manager State = 19
OSIM state = 1
Failed component name = windows.capability

Since writing the above update, over 2000 files have been written to C:\Windows\Temp. Is there any way to stop Windows writing these files altogether?

windows
windows-10
hard-drive
asked on Super User Oct 30, 2018 by AlainD • edited May 3, 2019 by Jan Doggen

3 Answers

9

This solution described here has worked for me (tested after several reboots). However, I should stress that a web search reveals that hundreds are having problems with C:\Windows\Temp filling up with garbage, especially with Windows 10 v1803. Exact causes appear to be variable so my solution will only apply in some cases. Feel free to add additional solutions...but keep them related specifically to C:\Windows\Temp.

My problem appears to be related to the in-built Windows Store app and the AppX Deployment Service. I disabled both as follows:

Disable the Store application using Group Policy Editor

Note: You may need Administrative privileges for this.

  • WIN+R and type gpedit.msc
  • User Configuration > Administrative Templates > Windows Components > Store
  • Enable Turn off the Store application

Disable the AppX Deployment Service using Registry Editor

Note: Usual proviso here is to be careful when editing the registry! Changing this manually using services.msc does not work (Windows resets it to Manual or does not allow you to change it at all)

  • WIN+R and type regedit.exe
  • Navigate to HKLM\SYSTEM\CurrentControlSet\Services\AppXSvc
  • Change Start to 4
  • This sets the service to Disabled

Reboot Windows and clear out C:\Windows\Temp

  • Reboot Windows
  • Open File Explorer and navigate to C:\Windows\Temp
  • You may be asked for Administrative consent to enter this folder, agree to this
  • Select all and choose Delete
  • If Windows cannot delete a file because it is in use, just skip

The above steps worked for me and so far no new files have been added to C:\Windows\Temp.

answered on Super User Oct 30, 2018 by AlainD • edited Nov 12, 2019 by Community
0

Caveat: the solution in this answer does not solve the problem, it just makes the symptom go away. If you don't like the approaches using the Group Editor or changing settings, or if those approaches don't completely make the problem disapper, you can try my hack:

I created a new task using Task Schedulertask scheduler. It runs this script, which I call cleanup_evtx.bat:

del c:\windows\temp\AppXDeploymentServer_*.evtx c:\windows\temp\AppXPackaging_*.evtx

FWIW I believe that the Hex code that follows the AppXDeploymentServer_ is always the same. Someone could probably map that to the specific Windows Store app causing the problem. I could not find the answer to that part of the puzzle, thus the hack above.

answered on Super User May 3, 2019 by Leo
0

I was having an issue with my Windows Store applications refusing to update and the only clue I got was the error code 0x80070005.

I fixed it by updating Windows 10 to version 1903. After doing that not only do my Windows Store applications update fine but it also got rid of the issue with my Windows temporary directory filling up with EVTX files.

answered on Super User Jul 13, 2019 by Simon Morgan

User contributions licensed under CC BY-SA 3.0