Tuesday, October 4, 2016

Free Up Disk Space on Windows Systems

You start off with a nice large disk to accommodate most of the programs your users need and things are moving along just fine. Then, either you either upgrade to smaller more costly SSD drives to get a boost in performance or the vendor of your common applications increases the size of your image or perhaps another large package is needed. Either way you seem to be approaching the maximum size of your hard drive. To make matters worse each time a new user logs onto the system a local profile is generated taking up a bit more space until the disk is full. You need to find some room and free up precious disk space. Here are the methods we have been using to unlock some extra space.

Method One: Change the page file size.
By default Windows manages your page file size, it may be time to take back control. You can send this script to the systems to set an initial page file size of 2GB and a max of 4GB

wmic computersystem where name="%computername%" set AutomaticManagedPagefile=False

wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=2048,MaximumSize=4096

The page file adjustment will take effect after a reboot.

Method Two: Disable search indexing.
The search index in Windows can take up a bit of space. If you happen to not need it then you can be rid of those indexes with this command.

sc config WSearch start= disabled

Method Three: Empty all recycle bins.

Users may have deleted large files to help you in your quest to keep things clean but they may not realize that files still take up room unless they empty the files from their recycle bins. This will get rid of all the recycle bin contents on a system.

:: Empty all recycle bins on Windows 7 and up
rmdir /s /q %SystemDrive%\$Recycle.Bin 2>NUL

:: This empties all recycle bins on Windows XP and Server 2003
rmdir /s /q %SystemDrive%\RECYCLER 2>NUL

:: Return exit code to calling application
exit /B 0

Method Four: Clean up Windows Update files.
Microsoft doesn't officially condone this activity but it could be handy if you update your systems by re-imaging and don't rely much on automatic updates. Please note that this can break the automatic updates system in some cases. At a minimum, it will cause the update directories to rebuild. Consider making changes to the auto update settings if this change is interfering with updates.

net stop wuauserv
del c:\windows\SoftwareDistribution /q /s
net start wuauserv

Method Five: Turn off hibernation.
Windows keep a large system file (hiberfil.sys) on the system drive to facilitate system hibernation. If your sleep settings are such that you don't need hibernation then you can remove this file by turning it off with this command.

powercfg.exe -h off

Method Six: Clean up temp files.
There are a number of log and cache files you may not need here is an exhaustive script that comes to us via PDQDeploy and reddit.

:: Purpose:       Temp file cleanup
:: Requirements:  Admin access helps but is not required
:: Author:        reddit.com/user/vocatus ( vocatus.gate at gmail ) // PGP key: 0x07d1490f82a211a2
:: Version:       3.5.8 ! Move IE ClearMyTracksByProcess to Vista and up section (does not run on XP/2003)
::                3.5.7 * Add /u/neonicacid's suggestion to purge leftover NVIDIA driver installation files
::                3.5.6 * Merge nemchik's pull request to delete .blf and.regtrans-ms files (ported from Tron project)
::                      * Merge nemchik's pull request to purge Flash and Java temp locations (ported from Tron project)
::                3.5.5 + Add purging of additional old Windows version locations (left in place from Upgrade installations)
::                3.5.4 + Add purging of queued Windows Error Reporting reports. Thanks to /u/neonicacid
::                3.5.3 * Add removal of C:\HP folder
::                3.5.2 * Improve XP/2k3 detection by removing redundant code
::                3.5.1 ! Fix stall error on C:\Windows.old cleanup; was missing /D Y flag to answer "yes" to prompts. Thanks to /u/Roquemore92
::                3.5.0 + Add removal of C:\Windows.old folder if it exists (left over from in-place Windows version upgrades). Thanks to /u/bodkov
::                3.4.5 * Add cleaning of Internet Explorer using Windows built-in method. Thanks to /u/cuddlychops06
::                <-- outdated changelog comments removed -->
::                1.0.0   Initial write

:: VARIABLES :: -------------- These are the defaults. Change them if you so desire. --------- ::
:: Set your paths here. Don't use trailing slashes (\) in directory paths
set LOGPATH=%SystemDrive%\Logs
set LOGFILE=%COMPUTERNAME%_TempFileCleanup.log
:: Max log file size allowed in bytes before rotation and archive. 1048576 bytes is one megabyte
set LOG_MAX_SIZE=104857600

:: --------------------------- Don't edit anything below this line --------------------------- ::

@echo off
%SystemDrive% && cls
set SCRIPT_UPDATED=2015-09-22
:: Get the date into ISO 8601 standard format (yyyy-mm-dd) so we can use it
FOR /f %%a in ('WMIC OS GET LocalDateTime ^| find "."') DO set DTS=%%a
set CUR_DATE=%DTS:~0,4%-%DTS:~4,2%-%DTS:~6,2%

title [TempFileCleanup v%SCRIPT_VERSION%]

:: Make the logfile if it doesn't exist
if not exist %LOGPATH% mkdir %LOGPATH%
if not exist %LOGPATH%\%LOGFILE% echo. > %LOGPATH%\%LOGFILE%

:: Check log size. If it's less than our max, then jump to the cleanup section
for %%R in (%LOGPATH%\%LOGFILE%) do IF %%~zR LSS %LOG_MAX_SIZE% goto os_version_detection

:: If the log was too big, go ahead and rotate it.
pushd %LOGPATH%
del %LOGFILE%.ancient 2>NUL
rename %LOGFILE%.oldest %LOGFILE%.ancient 2>NUL
rename %LOGFILE%.older %LOGFILE%.oldest 2>NUL
rename %LOGFILE%.old %LOGFILE%.older 2>NUL
rename %LOGFILE% %LOGFILE%.old 2>NUL

:: Detect the version of Windows we're on. This determines a few things later in the script
set WIN_VER=undetected
for /f "tokens=3*" %%i IN ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName ^| Find "ProductName"') DO set WIN_VER=%%i %%j

:: USER CLEANUP SECTION :: -- Most stuff in here doesn't require Admin rights
:: Create the log header for this job
echo -------------------------------------------------------------------------------------------->> %LOGPATH%\%LOGFILE%
echo  %CUR_DATE% %TIME%  TempFileCleanup v%SCRIPT_VERSION%, executing as %USERDOMAIN%\%USERNAME%>> %LOGPATH%\%LOGFILE%
echo -------------------------------------------------------------------------------------------->> %LOGPATH%\%LOGFILE%
echo  Starting temp file cleanup
echo  --------------------------
echo   Cleaning USER temp files...

:: Version-agnostic :: (these jobs run regardless of OS version)
:: Create log line
echo. >> %LOGPATH%\%LOGFILE% %% echo  ! Cleaning USER temp files...>> %LOGPATH%\%LOGFILE% %% echo. >> %LOGPATH%\%LOGFILE%

:: User temp files, history, and random My Documents stuff
del /F /S /Q "%TEMP%" >> %LOGPATH%\%LOGFILE% 2>NUL

:: Previous Windows versions cleanup. These are left behind after upgrading an installation from XP/Vista/7/8 to a higher version. Thanks to /u/bodkov and others
if exist %SystemDrive%\Windows.old\ (
    takeown /F %SystemDrive%\Windows.old\* /R /A /D Y
    echo y| cacls %SystemDrive%\Windows.old\*.* /C /T /grant administrators:F
    rmdir /S /Q %SystemDrive%\Windows.old\
if exist %SystemDrive%\$Windows.~BT\ (
    takeown /F %SystemDrive%\$Windows.~BT\* /R /A
    icacls %SystemDrive%\$Windows.~BT\*.* /T /grant administrators:F
    rmdir /S /Q %SystemDrive%\$Windows.~BT\
if exist %SystemDrive%\$Windows.~WS (
    takeown /F %SystemDrive%\$Windows.~WS\* /R /A
    icacls %SystemDrive%\$Windows.~WS\*.* /T /grant administrators:F
    rmdir /S /Q %SystemDrive%\$Windows.~WS\

:: Version-specific :: (these jobs run depending on OS version)
:: First block handles XP/2k3, second block handles Vista and up
:: Read 9 characters into the WIN_VER variable. Only versions of Windows older than Vista had "Microsoft" as the first part of their title,
:: so if we don't find "Microsoft" in the first 9 characters we can safely assume we're not on XP/2k3.
if /i "%WIN_VER:~0,9%"=="Microsoft" (
    for /D %%x in ("%SystemDrive%\Documents and Settings\*") do (
        del /F /Q "%%x\Local Settings\Temp\*" 2>NUL
        del /F /Q "%%x\Recent\*" 2>NUL
        del /F /Q "%%x\Local Settings\Temporary Internet Files\*" 2>NUL
        del /F /Q "%%x\Local Settings\Application Data\ApplicationHistory\*" 2>NUL
        del /F /Q "%%x\My Documents\*.tmp" 2>NUL
        del /F /Q "%%x\Application Data\Sun\Java\*" 2>NUL
        del /F /Q "%%x\Application Data\Adobe\Flash Player\*" 2>NUL
        del /F /Q "%%x\Application Data\Macromedia\Flash Player\*" 2>NUL
) else (
    for /D %%x in ("%SystemDrive%\Users\*") do (
        del /F /Q "%%x\AppData\Local\Temp\*" 2>NUL
        del /F /Q "%%x\AppData\Roaming\Microsoft\Windows\Recent\*" 2>NUL
        del /F /Q "%%x\AppData\Local\Microsoft\Windows\Temporary Internet Files\*" 2>NUL
        del /F /Q "%%x\My Documents\*.tmp" 2>NUL
        del /F /Q "%%x\AppData\LocalLow\Sun\Java\*" 2>NUL
        del /F /Q "%%x\AppData\Roaming\Adobe\Flash Player\*" 2>NUL
        del /F /Q "%%x\AppData\Roaming\Macromedia\Flash Player\*" 2>NUL
        del /F /Q "%%x\AppData\Local\Microsoft\Windows\*.blf" 2>NUL
        del /F /Q "%%x\AppData\Local\Microsoft\Windows\*.regtrans-ms" 2>NUL
        del /F /Q "%%x\*.blf" 2>NUL
        del /F /Q "%%x\*.regtrans-ms" 2>NUL
        :: Internet Explorer cleanup
        rundll32.exe inetcpl.cpl,ClearMyTracksByProcess 4351

echo. && echo   Done. && echo.
echo. >> %LOGPATH%\%LOGFILE% && echo   Done.>> %LOGPATH%\%LOGFILE% && echo. >>%LOGPATH%\%LOGFILE%

:: SYSTEM CLEANUP SECTION :: -- Most stuff here requires Admin rights
echo   Cleaning SYSTEM temp files...
echo   Cleaning SYSTEM temp files... >> %LOGPATH%\%LOGFILE% && echo.>> %LOGPATH%\%LOGFILE%

:: Version-agnostic :: (these jobs run regardless of OS version)
:: JOB: System temp files

:: JOB: Root drive garbage (usually C drive)
rmdir /S /Q %SystemDrive%\Temp >> %LOGPATH%\%LOGFILE% 2>NUL
for %%i in (bat,txt,log,jpg,jpeg,tmp,bak,backup,exe) do (
            del /F /Q "%SystemDrive%\*.%%i">> "%LOGPATH%\%LOGFILE%" 2>NUL

:: JOB: Remove files left over from installing Nvidia/ATI/AMD/Dell/Intel/HP drivers
for %%i in (NVIDIA,ATI,AMD,Dell,Intel,HP) do (
            rmdir /S /Q "%SystemDrive%\%%i" 2>NUL

:: JOB: Clear additional unneeded files from NVIDIA driver installs
if exist "%ProgramFiles%\Nvidia Corporation\Installer2" rmdir /s /q "%ProgramFiles%\Nvidia Corporation\Installer2"
if exist "%ALLUSERSPROFILE%\NVIDIA Corporation\NetService" del /f /q "%ALLUSERSPROFILE%\NVIDIA Corporation\NetService\*.exe"

:: JOB: Remove the Microsoft Office installation cache. Usually around ~1.5 GB
if exist %SystemDrive%\MSOCache rmdir /S /Q %SystemDrive%\MSOCache >> %LOGPATH%\%LOGFILE%

:: JOB: Remove the Microsoft Windows installation cache. Can be up to 1.0 GB
if exist %SystemDrive%\i386 rmdir /S /Q %SystemDrive%\i386 >> %LOGPATH%\%LOGFILE%

:: JOB: Empty all recycle bins on Windows 5.1 (XP/2k3) and 6.x (Vista and up) systems
if exist %SystemDrive%\RECYCLER rmdir /s /q %SystemDrive%\RECYCLER
if exist %SystemDrive%\$Recycle.Bin rmdir /s /q %SystemDrive%\$Recycle.Bin

:: JOB: Clear queued and archived Windows Error Reporting (WER) reports
echo. >> %LOGPATH%\%LOGFILE%
if exist "%USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportArchive" rmdir /s /q "%USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportArchive"
if exist "%USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportQueue" rmdir /s /q "%USERPROFILE%\AppData\Local\Microsoft\Windows\WER\ReportQueue"
if exist "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportArchive" rmdir /s /q "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportArchive"
if exist "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue" rmdir /s /q "%ALLUSERSPROFILE%\Microsoft\Windows\WER\ReportQueue"

:: JOB: Windows update logs & built-in backgrounds (space waste)
del /F /Q %WINDIR%\*.log >> %LOGPATH%\%LOGFILE% 2>NUL
del /F /Q %WINDIR%\*.txt >> %LOGPATH%\%LOGFILE% 2>NUL
del /F /Q %WINDIR%\*.bmp >> %LOGPATH%\%LOGFILE% 2>NUL
del /F /Q %WINDIR%\*.tmp >> %LOGPATH%\%LOGFILE% 2>NUL
del /F /Q %WINDIR%\Web\Wallpaper\*.* >> %LOGPATH%\%LOGFILE% 2>NUL
rmdir /S /Q %WINDIR%\Web\Wallpaper\Dell >> %LOGPATH%\%LOGFILE% 2>NUL

:: JOB: Flash cookies (both locations)
rmdir /S /Q "%APPDATA%\Macromedia\Flash Player\#SharedObjects" >> %LOGPATH%\%LOGFILE% 2>NUL
rmdir /S /Q "%APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys" >> %LOGPATH%\%LOGFILE% 2>NUL

:: Version-specific :: (these jobs run depending on OS version)
:: JOB: Windows XP/2k3: "guided tour" annoyance
if /i "%WIN_VER:~0,9%"=="Microsoft" (
    del %WINDIR%\system32\dllcache\tourstrt.exe 2>NUL
    del %WINDIR%\system32\dllcache\tourW.exe 2>NUL
    rmdir /S /Q %WINDIR%\Help\Tours 2>NUL

:: JOB: Windows Server: remove built-in media files (all Server versions)
echo %WIN_VER%  | findstr /i /%SystemDrive%"server" >NUL
if %ERRORLEVEL%==0 (
    echo  ! Server operating system detected.
    echo    Removing built-in media files ^(.wav, .midi, etc^)...
    echo. >> %LOGPATH%\%LOGFILE% && echo  ! Server operating system detected. Removing built-in media files ^(.wave, .midi, etc^)...>> %LOGPATH%\%LOGFILE% && echo. >> %LOGPATH%\%LOGFILE%

    :: 2. Take ownership of the files so we can actually delete them. By default even Administrators have Read-only rights.
    echo    Taking ownership of %WINDIR%\Media in order to delete files... && echo.
    echo    Taking ownership of %WINDIR%\Media in order to delete files... >> %LOGPATH%\%LOGFILE% && echo. >> %LOGPATH%\%LOGFILE%
    if exist %WINDIR%\Media takeown /f %WINDIR%\Media /r /d y >> %LOGPATH%\%LOGFILE% 2>NUL && echo. >> %LOGPATH%\%LOGFILE%
    if exist %WINDIR%\Media icacls %WINDIR%\Media /grant administrators:F /t >> %LOGPATH%\%LOGFILE% && echo. >> %LOGPATH%\%LOGFILE%

    :: 3. Do the cleanup
    rmdir /S /Q %WINDIR%\Media>> %LOGPATH%\%LOGFILE% 2>NUL

    echo    Done.
    echo    Done. >> %LOGPATH%\%LOGFILE%
    echo. >> %LOGPATH%\%LOGFILE%

:: JOB: Windows CBS logs
::      these only exist on Vista and up, so we look for "Microsoft", and assuming we don't find it, clear out the folder
echo %WIN_VER%  | findstr /i /%SystemDrive%"server" >NUL
if not %ERRORLEVEL%==0 del /F /Q %WINDIR%\Logs\CBS\* >> %LOGPATH%\%LOGFILE% 2>NUL

:: JOB: Windows XP/2003: Cleanup hotfix uninstallers. They use a lot of space so removing them is beneficial.
:: Really we should use a tool that deletes their corresponding registry entries, but oh well.

::  0. Check Windows version.
::    We simply look for "Microsoft" in the version name, because only versions prior to Vista had the word "Microsoft" as part of their version name
::    Everything after XP/2k3 drops the "Microsoft" prefix
echo %WIN_VER%  | findstr /i /%SystemDrive%"Microsoft" >NUL
if %ERRORLEVEL%==0 (
    :: 1. If we made it here we're doing the cleanup. Notify user and log it.
    echo  ! Windows XP/2003 detected.
    echo    Removing hotfix uninstallers...
    echo. >> %LOGPATH%\%LOGFILE% && echo  ! Windows XP/2003 detected. Removing hotfix uninstallers...>> %LOGPATH%\%LOGFILE%

    :: 2. Build the list of hotfix folders. They always have "$" signs around their name, e.g. "$NtUninstall092330$" or "$hf_mg$"
    pushd %WINDIR%
    dir /A:D /B $*$ > %TEMP%\hotfix_nuke_list.txt 2>NUL

    :: 3. Do the hotfix clean up
    for /f %%i in (%TEMP%\hotfix_nuke_list.txt) do (
        echo Deleting %%i...
        echo Deleted folder %%i >> %LOGPATH%\%LOGFILE%
        rmdir /S /Q %%i >> %LOGPATH%\%LOGFILE% 2>NUL

    :: 4. Log that we are done with hotfix cleanup and leave the Windows directory
    echo    Done. >> %LOGPATH%\%LOGFILE% && echo.>> %LOGPATH%\%LOGFILE%
    echo    Done.
    del %TEMP%\hotfix_nuke_list.txt>> %LOGPATH%\%LOGFILE%

echo   Done. && echo.
echo   Done.>> %LOGPATH%\%LOGFILE% && echo. >>%LOGPATH%\%LOGFILE%

:: Cleanup and complete ::
@echo off
echo -------------------------------------------------------------------------------------------->> %LOGPATH%\%LOGFILE%
echo  %CUR_DATE% %TIME%  TempFileCleanup v%SCRIPT_VERSION%, finished. Executed as %USERDOMAIN%\%USERNAME%>> %LOGPATH%\%LOGFILE%>> %LOGPATH%\%LOGFILE%
echo -------------------------------------------------------------------------------------------->> %LOGPATH%\%LOGFILE%
echo  Cleanup complete.
echo  Log saved at: %LOGPATH%\%LOGFILE%

Method Seven: Set a logout policy to clear the downloads folder. 
You might consider setting either an AD based group policy or a local logout policy to run the following script:

Option Explicit ' Script to clean up FOLDERID_Downloads. ' Version 1.0.0 ' 2016-02-05 ' Cactus Data. Gustav Brock Const USERPROFILE = &H28 Const FolderDownloads = "Downloads" Dim objFSO Dim objAppShell Dim objDownloadsFolder Dim strDownloadsFolder Dim strUserProfilerFolder ' Enable simple error handling. On Error Resume Next ' Find user's Downloads folder. Set objAppShell = CreateObject("Shell.Application") Set objDownloadsFolder = objAppShell.Namespace(USERPROFILE) strUserProfilerFolder = objDownloadsFolder.Self.Path strDownloadsFolder = strUserProfilerFolder & "\" & FolderDownloads ' Create the File System Object. Set objFSO = CreateObject("Scripting.FileSystemObject") If Not objFSO.FolderExists(strDownloadsFolder) Then Call ErrorHandler("No access to " & strDownloadsFolder & ".") End If ' Delete files. objFSO.DeleteFile(strDownloadsFolder & "\*.*") Set objDownloadsFolder = Nothing Set objFSO = Nothing Set objAppShell = Nothing WScript.Quit ' Supporting subfunctions ' ----------------------- Sub ErrorHandler(Byval strMessage) Set objRemoteFolder = Nothing Set objLocalFolder = Nothing Set objLocalAppDataFolder = Nothing Set objDesktopFolder = Nothing Set objAppShell = Nothing Set objFSO = Nothing WScript.Echo strMessage WScript.Quit End Sub

Method Seven: Clean out old user profiles.
Lets face it users sometimes put large files in a nonstandard location. Instead of searching through their folders to find those files you may decide it's best just to nuke their local profile if they haven't been using the system for a while. You can get Delprof2.exe from here and run it with the following parameter to remove profiles older than two weeks (14 days). Be sure to exclude any profiles you may not want removed, shown below with the Administrator, Public, and MSSQL profiles excluded.

/d:14 /q /ed:Default* /ed:Administrator* /ed:Public* /ed:MSSQL* /i