80 GB suddenly added to C:\Window\TEMP

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.

FWIW in Services I found AppX Deployment Service (AppXSVC) is enabled
and set to Manual.
"Provides infrastructure support for deploying Store applications. This
service is started on demand and if disabled Store applications will not
be deployed to the system, and may not function properly."

Presumably connected with last night's WU to 1803 (OS Build 17134.407)

Any idea what they are and why they appeared please?

I haven't yet rebooted and after seeing this thread
https://www.reddit.com/r/windows/com...lling_up_with/
I suspect they may reappear.
(Interesting to see that thread associates the issue to the Microsoft
Store, and its Apps, another recent problem I had.)


Terry Pinnell, East Grinstead, UK

On 11/14/2018 10:57 PM, Wolf K wrote:
On 2018-11-14 09:37, Terry Pinnell wrote:
I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.
....
Should you care? Dunno, I would just shrug and let it go, since I get
very, very few apps from any sources (and only on the phone, not the
PC). Sure, it's wasted space, but only my external backup drives are
over 50% capacity, so it doesn't matter to me. It's like stuff stored in
the attic. :-)

It's just a TEMP folder. Just delete everything TEMPORARY there whenever
possible.

--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
¤£Â*ɶU! ¤£¶BÄF! ¤£½ä¿ú! ¤£´©¥æ! ¤£¥´¥æ! ¤£¥´§T! ¤£¦Û±þ! ¤£¨D¯«!
½�¦Ò¼{ºî´© (CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

On 11/14/2018 10:44 AM, Mr. Man-wai Chang wrote:
On 11/14/2018 10:57 PM, Wolf K wrote:
On 2018-11-14 09:37, Terry Pinnell wrote:
I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.
Â*....
Should you care? Dunno, I would just shrug and let it go, since I get
very, very few apps from any sources (and only on the phone, not the
PC). Sure, it's wasted space, but only my external backup drives are
over 50% capacity, so it doesn't matter to me. It's like stuff stored in
the attic. :-)

It's just a TEMP folder. Just delete everything TEMPORARY there whenever
possible.

Terry: That is my policy also if it is in a \temp folder or is a *.tmp
file then it gets deleted. If the file is in use (ie needed) you will
not be able to delete it.

If you are have space problems you may also check the \temp folders in

C:\Users\user_id\AppData. There is one in Local and in LowLocal.

Make sure you clear the caches on your browsers. Also I found that
Firefox and Thunderbird were keeping archive files for some functions,
ie address book, bookmarks etc. You don't need to archive many years of
these backup files.

Another place you can gain space is in \windows\softwaredistribution. If
you have ever had a update failure you may have literally thousands of
filed filling up these folders. You can delete all of the files in
these folders. If they are needed the system will not allow deletion,
or they will be recreated. Note: if you do have thousands of files, I
usually run the troubleshooting routine in Settings, Update&Security,
Troubleshooting, Windows Update. This is usually not necessary, but it
is just a precaution. Also it there are thousands of files, change the
settings on the properties of the Recycle folder to delete files with
out holding them. With a thousand files it goes easier.

Hope this helps



--
2018: The year we learn to play the great game of Euchre

Terry Pinnell posted this:

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three


That is so unfair!

My Windows 10 Pro station updated to Build 17763.134 last night as I was
trying to shut down...

And it didn't leave me any presents at all but a delayed startup and a new
background picture that is NOWHERE on my hard drive...

Alas, some people have all the luck.

Terry Pinnell wrote:

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.

FWIW in Services I found AppX Deployment Service (AppXSVC) is enabled
and set to Manual.
"Provides infrastructure support for deploying Store applications. This
service is started on demand and if disabled Store applications will not
be deployed to the system, and may not function properly."

Presumably connected with last night's WU to 1803 (OS Build 17134.407)

Any idea what they are and why they appeared please?

I haven't yet rebooted and after seeing this thread
https://www.reddit.com/r/windows/com...lling_up_with/
I suspect they may reappear.
(Interesting to see that thread associates the issue to the Microsoft
Store, and its Apps, another recent problem I had.)

A service set to Manual startup means it does not run until called by
another process. It is ready to run but not yet running. When it is in
Started state is when it is running.

I use CCleaner and have "ccleaner.exe /a" scheduled in Task Scheduler to
run each night. That does the cleanup but without any prompt (the GUI
doesn't popup asking for user input, just an icon appear in the system
tray). However, just in case an installation was in progress, and since
some installations use the %temp% folder to hold files needed for after
a reboot to complete the installation, CCleaner is configured to delete
%temp% folder only older than 24 hours.

Note: I stayed back on version 5.46 of CCleaner. Avast acquired
Piriform and Avast likes to use their freeware as an adware platform.
First they added a tracking cookie that CCleaner will delete then then
recreates when loaded again. They they started using their adware
platform to push for purchase of CCleaner (instead of just continuing to
use the banner at the bottom of the GUI as a reminder). Their adware
platform phones home checking if Avast started another marketing
campaign. I use Avast free and, yep, occasionally Avast decides to use
it to shove popups in my face advertising their payware. In Avast
(anti-virus), the popup ads can be disabled but only at the cost of
losing all other popups, like alerting you when Avast blocked the
loading of a suspect page that might be malicious or a suspect download.
As I recall, there is no silence option in Avast's modified CCleaner.
There are other cleanup tools that could be used for scheduled cleaning.
I confinue using the old version because none of the changes since then
apply to me (many are for Windows 10 but my home PC is still Win7) or
are trivial, and some are just due to Avast customizing CCleaner to meet
their own agenda. In fact, in Win7 you can configure the Cleanup Wizard
(cleanmgr.exe) to perform a regular cleanup of your drive(s). However,
to schedule it to run (i.e., without any user prompt), you have to
create a cleanup scheme using a /sagerun command-line switch and then
specify it when running cleanmgr. See:

https://www.google.com/search?q=cleanmgr%20sagerun

However, Windows' Cleanup Wizard doesn't have the option as in CCleaner
to keep %temp% files less than 24 hours old, plus it doesn't have all
the other cleanup options of CCleaner.

I have to wonder if the huge log isn't cumulative. That is, as apps got
installed or updated, more data was added to the log files. The Event
Viewer (eventvwr.msc) lets you view the contents of the various .evtx
logfiles. There are other tools that also let you view the contents of
the .evtx files (e.g., Nirsoft's FullEventLogView). Events accumulate
so the event logfiles will grow. In Event Viewer, you can use the File
- Options menu to delete the logfiles, or you can right-click on a tree
node for an event category and delete its logfiles. You could use
CCleaner to cleanup the event logfiles; however, that should be done
manually instead of during a unprompted scheduled cleanup job since the
logs may be needed to determine the cause of a problem. Unlike with
%temp% files, there is no option in CCleaner to truncate records out of
the .evtx logfiles that are over 24 hours old. There is a registry
setting as to how many records to keep in an event logfile. See:

https://docs.microsoft.com/en-us/win...g/eventlog-key

I remember reading that the email and people apps in Windows 10 had bugs
and would log their errors in an .evtx logfile. The fix back then was
to use PowerShell to remove those apps. Another was to set Disabled the
Appx Deployment Service.

It seems odd that an event log should get stored under the %temp%
folder. Under Windows 7, all the event logs are stored under
C:\Windows\System32\winevt\Logs. For an event logfile to be so huge
(presumably the .evtx file you deleted was the biggest one) means there
are LOTS of app errors. After deleting an event logfile, it will get
recreated when there are more informational, warning, and critical
errors by whatever created them before. Start watching the Event Viewer
to see what is generating all those errors. If you're lucky, they're
all informational events. Warnings you can usually ignore. Critical
errors should be addressed. My guess (without having a Win10 box to
look at right now) is the Appx events are in a category somewhere under
the Applications and Services - Microsoft - Windows tree node in the
Event Viewer. Otherwise, there is a File menu in Nirsoft's
FullEventLogViewer tool to let you select which .evtx logfile to view.
You could then see just what is getting recorded in that event logfile,
like if installers or apps are failing.

Check if any .evtx logfiles are getting recreated in the %temp% folder.
That's not where they should get stored. That's more likely where an
installer stores its logfile.

Terry Pinnell wrote:

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.

FWIW in Services I found AppX Deployment Service (AppXSVC) is enabled
and set to Manual.
"Provides infrastructure support for deploying Store applications. This
service is started on demand and if disabled Store applications will not
be deployed to the system, and may not function properly."

Presumably connected with last night's WU to 1803 (OS Build 17134.407)

Any idea what they are and why they appeared please?

I haven't yet rebooted and after seeing this thread
https://www.reddit.com/r/windows/com...lling_up_with/
I suspect they may reappear.
(Interesting to see that thread associates the issue to the Microsoft
Store, and its Apps, another recent problem I had.)


Terry Pinnell, East Grinstead, UK

Thanks for the replies. But does anyone have any suggestions on how to
fix the issue without major side effects please?

I have since rebooted and as I feared the same files are being
downloaded at a rate of every second or so.

The obvious step doesn't work, as the AppX service cannot be stopped or
disabled, at least without deleting some of its upstream dependencies:
https://www.dropbox.com/s/3argca7843...px-1.jpg?raw=1

Terry, East Grinstead, UK

On 11/15/18 3:31 AM, Terry Pinnell wrote:
Terry Pinnell wrote:

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.

FWIW in Services I found AppX Deployment Service (AppXSVC) is enabled
and set to Manual.
"Provides infrastructure support for deploying Store applications. This
service is started on demand and if disabled Store applications will not
be deployed to the system, and may not function properly."

Presumably connected with last night's WU to 1803 (OS Build 17134.407)

Any idea what they are and why they appeared please?

I haven't yet rebooted and after seeing this thread
https://www.reddit.com/r/windows/com...lling_up_with/
I suspect they may reappear.
(Interesting to see that thread associates the issue to the Microsoft
Store, and its Apps, another recent problem I had.)


Terry Pinnell, East Grinstead, UK

Thanks for the replies. But does anyone have any suggestions on how to
fix the issue without major side effects please?

I have since rebooted and as I feared the same files are being
downloaded at a rate of every second or so.

The obvious step doesn't work, as the AppX service cannot be stopped or
disabled, at least without deleting some of its upstream dependencies:
https://www.dropbox.com/s/3argca7843...px-1.jpg?raw=1

Terry, East Grinstead, UK

I don't have the issue and I've got the latest updates to date. I did
read your link above and I see a fix about turning off background apps
and diagnostics. Did you do that? I may have since I usually rummage
through settings now and then and turn off things like that, (automatic
things, or background items).

Terry Pinnell wrote:
Terry Pinnell wrote:

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.

FWIW in Services I found AppX Deployment Service (AppXSVC) is enabled
and set to Manual.
"Provides infrastructure support for deploying Store applications. This
service is started on demand and if disabled Store applications will not
be deployed to the system, and may not function properly."

Presumably connected with last night's WU to 1803 (OS Build 17134.407)

Any idea what they are and why they appeared please?

I haven't yet rebooted and after seeing this thread
https://www.reddit.com/r/windows/com...lling_up_with/
I suspect they may reappear.
(Interesting to see that thread associates the issue to the Microsoft
Store, and its Apps, another recent problem I had.)


Terry Pinnell, East Grinstead, UK

Thanks for the replies. But does anyone have any suggestions on how to
fix the issue without major side effects please?

I have since rebooted and as I feared the same files are being
downloaded at a rate of every second or so.

The obvious step doesn't work, as the AppX service cannot be stopped or
disabled, at least without deleting some of its upstream dependencies:
https://www.dropbox.com/s/3argca7843...px-1.jpg?raw=1

Terry, East Grinstead, UK

Regarding your picture, you *cannot* disable RPC on a modern
Windows OS. *Everything* uses it. Kill RPC by deleting it from Linux,
would be a death sentence for the OS. RPC is Remote Procedure Call,
which unfortunately is also used to resolve Local Procedure
Calls, and every thing talking to every other thing, needs
that capability at some point.

*******

I would be checking Event Viewer, for a happy happy breadcrumb.

Maybe it's trying to repair a Store App with bad signing,
and doesn't have write permission or something.

Using the error message, you might get some idea about why
it's doing that.

Or, you might need to find some log file. Perhaps the file
in your %temp% *is* a log file.

Use the information sources you've got, the logs, as your
first step. You might find a better point of leverage that way.

*******

You can delete stuff from Linux. But... it's not as easy as
it looks, as you need to do

administrator command prompt...

compact /compactos:never

as your first step, plus make sure the $MFTMIRR is repaired
and fully functional in NTFS (Win10 makes bad NTFS partitions
with damaged $MFTMIRR). Fast Boot must be turned off. The partition
cannot be in a hibernation state, as Linux won't mount an NTFS
volume it finds like that. After you've done that, you can
find the AppX service, and introduce it to your trash can :-)

*******

OK, so what can we do with this ?

AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt

1) If it is less than 1GB in size, open in Notepad.
That's my guess as to the size limit on Notepad.
It now handles bigger files, but not too big.
You still can't drop a 10GB text file on it.

2) This will handle anything. Drop the text file onto this.
This is a hex editor, where the right hand side lists the
text it sees.

https://mh-nexus.de/en/hxd/

3) See if Command Prompt has the "more" command.

cd /d %temp%
more AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt

use Q to quit

4) The "more" and "less" commands are available in WSL.
I wouldn't bother with this, except to keep in mind you
have additional commands available in this environment.
With your luck, since this package is delivered via the
Windows Store, it might not be working right now.

https://en.wikipedia.org/wiki/Window...stem_for_Linux

5) Use Notepad++ ?

The AppxErrorReport probably repeats the same error over
and over again, so you'll be able to copy and paste one
instance into a message for the group.

Some reports in Windows now, are made by collecting events
in the ETX (tracing) subsystem, and only converting to text
much later. This generally leads to unavailable text versions
and an inability for users to debug stuff. I hope the above
file is not a "dud". Microsoft isn't the best at making
logs, in any case. But, ya gotta work with what you're
given.

HTH,
Paul

Terry Pinnell wrote:

I have since rebooted and as I feared the same files are being
downloaded at a rate of every second or so.

The obvious step doesn't work, as the AppX service cannot be stopped or
disabled, at least without deleting some of its upstream dependencies:
https://www.dropbox.com/s/3argca7843...px-1.jpg?raw=1

So, are the newly created logfiles listed in Event Viewer so you can see
what is generating all the entries? If not, use the suggested Nirsoft
tool to open the .evtx file to see what is getting recorded in there.
The huge logfile is the effect. Need to see if the event logfile points
at the cause.

Paul wrote:

Terry Pinnell wrote:
Terry Pinnell wrote:

I found my C: drive had suddenly filled up. A brief examination showed
it was due to 80 GB appearing in C:\Window\TEMP today. There were three
types of files and 13,308 of each of them.

AppXDeploymentServer_B1874DF3-7BCE-0006-9D58-88B1CE7BD401
AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt
AppXPackaging_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.evtx

I've deleted all of them.

FWIW in Services I found AppX Deployment Service (AppXSVC) is enabled
and set to Manual.
"Provides infrastructure support for deploying Store applications. This
service is started on demand and if disabled Store applications will not
be deployed to the system, and may not function properly."

Presumably connected with last night's WU to 1803 (OS Build 17134.407)

Any idea what they are and why they appeared please?

I haven't yet rebooted and after seeing this thread
https://www.reddit.com/r/windows/com...lling_up_with/
I suspect they may reappear.
(Interesting to see that thread associates the issue to the Microsoft
Store, and its Apps, another recent problem I had.)


Terry Pinnell, East Grinstead, UK

Thanks for the replies. But does anyone have any suggestions on how to
fix the issue without major side effects please?

I have since rebooted and as I feared the same files are being
downloaded at a rate of every second or so.

The obvious step doesn't work, as the AppX service cannot be stopped or
disabled, at least without deleting some of its upstream dependencies:
https://www.dropbox.com/s/3argca7843...px-1.jpg?raw=1

Terry, East Grinstead, UK

Regarding your picture, you *cannot* disable RPC on a modern
Windows OS. *Everything* uses it. Kill RPC by deleting it from Linux,
would be a death sentence for the OS. RPC is Remote Procedure Call,
which unfortunately is also used to resolve Local Procedure
Calls, and every thing talking to every other thing, needs
that capability at some point.

*******

I would be checking Event Viewer, for a happy happy breadcrumb.

Maybe it's trying to repair a Store App with bad signing,
and doesn't have write permission or something.

Using the error message, you might get some idea about why
it's doing that.

Or, you might need to find some log file. Perhaps the file
in your %temp% *is* a log file.

Use the information sources you've got, the logs, as your
first step. You might find a better point of leverage that way.

*******

You can delete stuff from Linux. But... it's not as easy as
it looks, as you need to do

administrator command prompt...

compact /compactos:never

as your first step, plus make sure the $MFTMIRR is repaired
and fully functional in NTFS (Win10 makes bad NTFS partitions
with damaged $MFTMIRR). Fast Boot must be turned off. The partition
cannot be in a hibernation state, as Linux won't mount an NTFS
volume it finds like that. After you've done that, you can
find the AppX service, and introduce it to your trash can :-)

*******

OK, so what can we do with this ?

AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt

1) If it is less than 1GB in size, open in Notepad.
That's my guess as to the size limit on Notepad.
It now handles bigger files, but not too big.
You still can't drop a 10GB text file on it.

2) This will handle anything. Drop the text file onto this.
This is a hex editor, where the right hand side lists the
text it sees.

https://mh-nexus.de/en/hxd/

3) See if Command Prompt has the "more" command.

cd /d %temp%
more AppxErrorReport_B1874DF3-7BCE-0007-FF72-88B1CE7BD401.txt

use Q to quit

4) The "more" and "less" commands are available in WSL.
I wouldn't bother with this, except to keep in mind you
have additional commands available in this environment.
With your luck, since this package is delivered via the
Windows Store, it might not be working right now.

https://en.wikipedia.org/wiki/Window...stem_for_Linux

5) Use Notepad++ ?

The AppxErrorReport probably repeats the same error over
and over again, so you'll be able to copy and paste one
instance into a message for the group.

Some reports in Windows now, are made by collecting events
in the ETX (tracing) subsystem, and only converting to text
much later. This generally leads to unavailable text versions
and an inability for users to debug stuff. I hope the above
file is not a "dud". Microsoft isn't the best at making
logs, in any case. But, ya gotta work with what you're
given.

HTH,
Paul

Thanks for the follow-ups.

One or other of the various steps I tried seems to have stopped the
avalanche. Probably using Settings Privacy as suggested here and
elsewhe
https://www.cnet.com/forums/discussi...ep-filling-up/
I disabled about 90% of the apps there.

Of course, a reboot might re-trigger the issue.

Terry, East Grinstead, UK