Demystifying the WinSxS directory in Windows XP, Vista and Server 2003/2008

A coworker recently received his every two year work laptop refresh and was in the middle of loading his new laptop with Vista. For some reason, his hard drive C: was partitioned to only 25GB and the rest of the space reserved for a much larger drive D:.

Anyway, after loading many Windows Updates, he was left with hardly any drive space left on C:, and for some reason, the WinSxS directory had ballooned to over 8GB.

While I knew what the WinSxS (Windows Side-by-Side) directory was for, I wasn't quite sure why that directory would explode in size so fast with normal operating system updates.

A little digging and I think I have part of the answer, based on two different postings from MS's jonwin's blog. You can read the WinSxS specific posts here and here.

The most interesting and/or relevant sections of those posts, which explains quite a bit about the WinSxS directory:

Content is added to this directory in response to installing applications, enabling packages in the add-remove-programs UI, and installing Windows Out-of-Band releases. Content is removed from this directory as a result of uninstall + scavenging - a topic for another time. One important note - uninstalling your application or Windows app will not necessarily remove the physical bits from the system. The servicing stack marks the bits as unusable and prevents their use through "normal" means. Files and directories will be removed over time as the servicing system cleans up after itself. Administrators should not, for any reason, take it upon themselves to clean out the directory - doing so may prevent Windows Update and MSI from functioning properly afterwards. Preventing accidental deletion from the directory is accomplished by putting a strong security descriptor on the directory that inherits to its children.

In Windows Vista, the directory %windir%\WinSxS has much stronger protection on it than it did in Windows XP and Server 2003. The owner/group is now a SID named "Trusted Installer", a service SID used to start the TrustedInstaller service. Users other than the trusted installer are granted only generic-read/generic-execute by default. This increased protection ensures that only the trusted installer service is allowed to modify the servicing-related metadata and files. If a limited user could modify a file in the directory, for example, they could convince the servicing stack to overwrite one binary with another when the next administrator comes along to enable the Games for Windows package.

You may or may not have ever peeked into the %windir%\winsxs directory on your system. If you haven't, now would be a good time. First thing you'll notice is that there are a lot of those funkily-named directories. You might further notice that there seem to be several that differ only by what looks like a version number and some random-looking eight characters on the end of the name. Next you might see that some of them differ only by the second-to-last stringish thing. Lastly, note that mostly, the strings can be deciphered with a little help.

Each shared component (in the winsxs directory) gets its own directory into which its payload bits are placed. Somehow, we have to generate (mostly) unique & repeatable directory names for this purpose. The requirements of directory names are reasonably simple - can't overall be more than MAX_PATH (260) characters, can't contain certain characters, etc. Given the naming requirement, it was impossible to use the entire identity as the name of the directory, as someone could name their component "foo\bar" and mess things up. With the extensibility requirement for identities themselves, we couldn't possibly use the entire identity, as the set of tuples would end up being far longer than MAX_PATH. Most importantly, we wanted the directory names to be readable to your average administrator or PSS representative. Finally, generation of the keyform from an identity had to be fast.

My take on all of this:
There should be a way to move this directory out of the %windir% directory structure. This directory has a potential to grow pretty much unchecked over time. As it stands right now, it is a huge hard drive space hog on any default Vista install.

Posted by Aaron Tiensivu in Microsoft, Server, Vista, Windows OS, XP at 16:55 | Comments (42) | Trackbacks (0)

451306 hits

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

One important thing I forgot to note in those two articles... When the servicing stack installs a component (during setup, optional component install, OOB install, whatever), it must project (our term) the files of that component out into the system so they can be used. Consider a clean install of Vista. The component carrying kernel32.dll appears in the WinSxS store, as does the file itself. On Vista, an optimization for projection is done by creating a hard link from the winsxs\[..]\kernel32.dll file to windows\system32\kernel32.dll. Hard links are a functionality of NTFS by which two files in the filesystem point at the same blob of bits on the physical volume. (Note: hardlinking of files is only an optimization - there are times when files must be projected by copying them.)

Using "dir /s" to compute the size of the winsxs directory will report every file and its size. Unfortunately, "dir" doesn't know how to deal with hard links, so it reports the total file size by summing the size of each name, not summing the size of the used disk space. This isn't a bug in dir, per-se. In NTFS, there is no such thing as the "first" link to a file, so there's no way to determine whether or not a file's size should be included in a scan. Dir (and other tools that use FindFirstFile/FindNextFile and sum the returned file sizes) err on the side of caution.

Using Explorer (open explorer on "Computer", right-click the system volume, choose properties, go get some coffee while it scans) should make this better, as it's aware of things like hard links, symbolic links, reparse points, etc.

One of these days I'll write this up in a post as well. Alternatively, you can use "chkdsk" to compute the difference between your volume's total size and its free space.

On the "move it out of windir" point - the stuff in there that's part of Windows should stay in %windir%. The stuff that's not in-the-box (out-of-band releases, 3rd-party side-by-side components, IHV-delivered drivers) /could/ move out, but then the question is where should it go?

#1 Jon Wiswall (Homepage) on 2007-09-30 17:57 (Reply)

That's all great information! It clears up a couple of questions I was tempted to ask you at some point.

As for "move it out", I guess I really don't have a good answer for that one. It is a complex issue if you want to draw the line in the sand on what is application and what is operating system inside the folder. I'm mainly interested in redirecting the folder much like you can redirect MSOCache and CSC files, but I understand the rationale behind keeping it in %windir%.

#1.1 Aaron Tiensivu (Homepage) on 2007-09-30 20:29 (Reply)

Where to move it to?

I'd suggest a relocatable shell folder, similar to the way Documents, Pictures, Music etc. are managed.

My own practice is to keep material that has to be retained, but is seldom if ever accessed, in a distant (as in, physically at the "far" end of physical drive) logical volume.

As it is, these updates etc. really clobber C: performance; for every one active file, there may be 2 or 3 inactive files over which the heads have to move. I can't imagine such inefficiency being tolerated elsewhere in the system, e.g. RAM or CPU cycle usage.

As to "disks are cheap", that's not the point - yes, we have large physical hard drives, but we may want to leverage that in less obvious ways than dumping everything in one big C:. You may want a small C: so that it's more practical to perform partition image backups, or simply to concentrate most head travel within a small part of the disk, no matter how much other clutter you leave lying around.

So, back to my original point; IMO, the Windows Installer, updaters, etc. should dump their inactive stuff to a shell location defined by CLSID or whatever, that may be located on any permanently-available storage device (i.e. not including network shares or removable storage).

#1.1.1 Chris Quirke (Homepage) on 2009-09-09 07:54 (Reply)

Windows explorer even in Vista SP1 isn't aware of ntfs hard links. Symbolic links yes, but not hard links. So if MS really uses hard links in the windows dir, the explorer properties window will show more space consumption then there is.

#1.2 Ronny Heuschkel on 2008-03-07 04:55 (Reply)

Just like Ninho, this folder is now on my XP machine and appeared with the Service Package #3. Is there any reason
to keep this item on an XP machine?

#1.3 Robert Jacobs on 2008-08-27 10:51 (Reply)

Can i move this folder to another drive and leave a Junction Point instead of it after modyfing the registry ?
(I've done this with "Program Files" Folder)

And also, i'm getting an error when adding Features to vista (Like Telnet support) could it be a corruption in the winsxs folder ?

Or

#2 Or Tsemah on 2007-11-20 09:15 (Reply)

I have found that a user can move the winsxs directory (do a google search for EEEpc move winsxs directory to find a tutorial.) I have tried it myself and it seems to work on any non sp1 vista install. there are 2 issues. 1. Updates will NOT work on the machine as they are hard coded to the directory in a way that the junction stops. and 2. Vista SP1 wont install if the winsxs dir is moved, but if you move the winsxs folder on vista that already has SP1, it will blue screen as there is a direct link to the winsxs dir as well.

You can try this and your case may be different, just make a ghost or backup of your machine first!

#2.1 Rustifer on 2008-03-28 00:45 (Reply)

Great blog, thank you ! A question, if you will :

I've gotten this folder and contents on a *Windows 2000* SP4 !

Is it any use on this OS, or may I zap it altogether in order to recover space ?

#3 Ninho on 2008-05-21 13:18 (Reply)

Interesting post. I would like to find out more about this 'scavenging' technique. Is it a service or can I trigger it manually ? Some quick googling didn't turn up any results yet. Greetz !

#4 GeKKo on 2008-08-03 18:10 (Reply)

A coulple of Q's

Many of the directories/DLL's in here seem to be microsoft ones. Does this mean that different components of the OS need different versions of the same library?

Also, is Explorer aware of hardlinks or does it count the links as two files? If many of the DLL's are hardlinks, but Explorer treats them as multiple files, then the ACTUAL space these are taking up would be much less wouldn't it?

By moving this folder to another partition, do you not give up the hard-link optimisation?

#5 Andre E on 2008-08-28 14:30 (Reply)

My winsxs contains a file called winsatencode.wmv with duration 666, pretty weird huh?

It's in the x86_microsoft-windows-winsatmediasamples (yada yada...) directory.

Think it has something to do with windows experience rating, but still it's nice to know there are some hackers over at Microsoft still.

#6 Roden J. on 2008-08-31 19:24 (Reply)

Simply outstanding article. I've been telling people the same thing(s) since long before Vista actually hit store shelves but not many people listen. Now I've got a published article to point them to and say "See, I was telling you this stuff long ago, now go read what another smart fella says..."

Thanks...

#7 Joe Average on 2008-09-02 03:21 (Reply)

Thought i would ask the question, but i see that many have already asked why the winsxs is so large.

mines gone upto 7.56 GB with recent installs etc

Although i have free space between 8 and 11 GB free on the C drive.

If or when it fills up my C drive, would it just be easier to re-install vista as new.

#8 Welshtiger on 2008-09-04 17:38 (Reply)

Okay, WinSxS is space consumpting but nowadays hard disk space is cheap.

If you know WinSxS will grow to gigs you can make a system partition who covers that.

Moving data files to another place will lead to an instable system, investigation(s) according to application errors will get harder.

#9 genuvine on 2008-09-14 05:42 (Reply)

Harddisk space is cheap - yeah in Wall-Mart. We use a dual redundant approach to all our backend-storage which include dual SAN-disks, dual fiberswitch, dual everything else.

With VMware Infrastrucure 3 and about 50 Windows servers times 10+ GB extra space on system partitions ... add backup, handling ... it all amounts a lot of extra $'s or €'s

If you are serious you would have to put that into your calculations when upgrading from i.e. W2003 -> W2008.

#9.1 Bjarke Emborg Kragelund (Homepage) on 2008-11-14 06:39 (Reply)

Many of the files contained in winsxs are smaller than the standard HD cluster size, especially for partitons large enough to contain Vista. Hence my query, why did MS not compress this folder?
What would be the implications for linked file and running system files directly from the folder?
After getting rid of the trusted installer and taking control I tried this on a test rig, only to find several files in use, so I gave up, I do not wish to call down upon my head the performance limiting gremlins of compression.
If there were a list of non-essentials, these could maybe be compressed?

#10 Rob on 2008-10-10 15:54 (Reply)

What I don't understand is just why this folder has to get so big? On a fresh install of Vista Premium with updates and sp1 added, but no other s/w at all, I was up to over 7GB! Running vsp1cln.exe cut this back to 6GB. I see that there are 5 separate folders for different versions of the natural language 'tool', consuming 1.5GB alone - and I don't even have the nat-lan search turned on!

Surely there must be some way I can remove unwanted elements? Or at least throw all but the latest away?

On top of that (although relatively small beer at only 200MB), the unwanted media files I already deleted from 'public videos' are also in the winsxs folder, and of course I can't remove them. Now why on earth do they need protecting?

I have seen references to 'scavenging' which may eventually remove unwanted files, but when might that occur? Is it that hard to provide a tool to remove unwanted items?

#11 Martin on 2008-10-14 19:56 (Reply)

One aspect I didn't know until recently was that most of the files in WinSXS are hardlinked to each other, which means Explorer.exe is rather 'dumb' when it comes to calculating actual hard drive space used.

#11.1 Aaron Tiensivu (Homepage) on 2008-10-14 20:02 (Reply)

I found it frustrating that MS (well, XP or Vista) apparently give no way to identify hard links. I found NTFS link at http://elsdoerfer.name/=ntfslink worked a treat (when installed on XP, don't yet know if it works on vista, I am dual booting the two) to identify hard links with a different icon. But I wanted to see which files linked to each other, and it didn't help. I failed to find a utility to do this, apart from hlscan.exe, found (ironically) within the Win2000 support tools, freely downloadable from MS, and install fine on XP (for some reason this is less readily available if one searches for it under XP support).

This will perform a full recursive scan of the requested drive/folder, and can print out to a log file. This helped me confirm which of the vista natural language folders in winsxs were links.

I had intended just brutally removing the unwanted nat-lan rubbish, but decided to see if I could identify which updates had caused them to download. I don't know how i found it, (since in Vista one can list the updates installed, but no further info is available about them except by searching for info on the KB number, so its not clear which of the many updates are the bif ones causing bloat), but something pointed me to KB955020.

According to many reports, this is a (shock, horror!) 50MB download - but on my PC the download was 1.2GB (as found in the Vista software distribution/download folder). I had already removed the download install files (It seems vista doesn't tidy this area up, or if it does, its very slow off the mark), but the junk was still in winsxs. Now 955020 was hardly essential, even though MS identified it as 'important' - you can read lots of amusing stuff on the web about how important it is - I had blindly allowed it as I was trying to get my PC to a state where SP1 would be offered, and it wasn't happening.

Uninstalling released about 80MB initially, but later on (without my doing anything), Vista silently tidied up the garbage in winsxs, and I was 1.5GB better off (although some of this was hard links, of course). As my concern is getting my Ghost image down to a manageable size, hard linked files don't 'cost' anything, but i did want to get rid of as much as possible.

I am planning on looking into which other Vista updates are redundant, and removing them. However, my winsxs folder is down to under 4GB, and the Ghost image fits on a single DVD, which was my goal.

#11.1.1 Martin Gerhold on 2008-11-01 08:26 (Reply)

Excellent review and information. Saved me from making a huge mistake in deleting the folders I know I uninstalled... Is there any way to force a cleanup?

#12 Pr0x1 (Homepage) on 2008-10-31 09:47 (Reply)

Well, after reading the several posts here, I decided to be brave and remove a lot of these directories. The easiest way to clear some of the space out is to use the drive clean up tool. My excess size went from 25 gig to 10 gig after doing that. And yes, I have ran update since then with NO isues. I hope this helps you.

#13 Charles Bundy on 2008-12-06 16:11 (Reply)

Drive clean up tool huh... hhmmm... can you repost in about a week and let us know if you still haven't seen any issues? for some reason, I'm still not confident, and I'm being a pessimistic wuss when it comes to my work laptop. I also just got a new puter (AMD Quad Phenom), so I don't have those issues yet on the new one. Still, it would save a ton of space and defrag time.

#13.1 Pr0x1 (Homepage) on 2008-12-06 21:39 (Reply)

Well, firstly, this is really bad, no absolutely awfull programming. Whatever group of school leavers wrote vista should really take some other YTS job scheem....

I read here about 8gigs, I would feel lucky! Mine at one point was 30gig of a 40gb OS partition. I think 40gb just for the OS was plenty, apparently M$ disagree.

My vista is soon to be removed and XP re-installed.

What a waste of everyones time and money....

#14 James Wilkinson on 2008-12-22 16:04 (Reply)

No one has so far mentioned they'd ran into problem, even though some winsxs seem to be bigger than others free disk space.
Could it be they let this one grow to almost fill the disk, and then start cleaning it out as more disk space is needed. Hence shrinking the size of the winsxs depending on how much other files there it?
Extremely stupid and narrow minding thinking then. Especially in a world of virtualization where you might define a disk as quite big, and let it physically grow as it fills up. Vista will do it's best to waste your physical space, just because it "thinks" you have plenty to waste.

#14.1 r2d2 on 2009-02-06 13:11 (Reply)

Listen,
I see NO reason whatsoever why portions of this folder can not be deleted.
Looking at some of the files. Some haven't been accessed in over 6 months. I see absolutly no data supporting any problems with the removal of these items.
I think I'm just going to delete them.

I keep seeing "hard drive space is cheap"
that isn't the point. I'm looking at performance here. Saying "hard drive space is cheap" is like saying the child molester only molested my neighbors kids..it doesn't really matter to me.
Get real. I've deleted any file not accessed within the past month..down to 500MB

Good Luck

#15 Frank Parker on 2008-12-31 08:56 (Reply)

I think Frank's approach is quite interesting. My winsxs folder is 16Gb. More than 10Gb has not been accessed in the last year.

Has anyone else tried deleting old folders?

#15.1 Nicolas G on 2010-08-10 06:45 (Reply)

TreeSize Free reports my OS partition as 31.7GB. Windows reports it (right-click the drive --> Properties) as 27.6GB.

TreeSize tells me that the winsxs folder represents 17.6GB or 63% of my used space. This is after running Disk Cleanup (which saved me about 8GB but not from the winsxs folder).

My Sys32 and SysWOW folders total 5.3GB and my two Program folders total less than 800MB (64bit Vista w/ SP1).

Clearly the winsxs folder is disproportional even making the assumption that ALL its contents are hardlinked to other locations.

#16 JamesIsIn (Homepage) on 2009-01-21 16:42 (Reply)

Well heres my report on this folder size it is over 500 gigs... Now... what the heck do one do about it being so big... I've lucky not had to redo my pc since vista came out... I do love vista for it makes windows xp crash prone days gone.. However its taking up 534 GBS rights right this winsxs folder is taking up half of one of my hard drives I have 7 TB total but this is nuts... come on... also thank you for telling what this folder is.

#17 Joshua on 2009-03-09 21:46 (Reply)

I've worked with MSFT stuff since 1981. The winsxs design is one of the worst I have ever seen come out of Microsoft. Mine is 14G and has numerous redundancies and there is no way to clean it up. I'm almost positive it also prevented me from switching from an nVidia based graphics adpater to an ATI based adapter due to residual crap left over in winsxs that I could not clean out. What a total piece of garbage design!!!

#18 Dave on 2009-03-27 13:51 (Reply)

I like XP and have used it well enough for years. To me Vsta is not an improvement in any obvious way and has many draw backs such as the winsxs madness.

Without wanting to start a huge debate I'd like to give a friendly reminding nudge to try Ubuntu Linux. I've used it full time at home since version 7.04 and am currently loving 8.10 the install was month and Adobe even has Linux Flash installers now.

I run MS Office 2007 through Crossover office and Photoshop CS2 through wine both installs as easy as in windows. All my other software is Open Source and works great.

If you download and burn a CD it'll run without affecting your system. You can partition your drive and run windows dual boot (defrag windows first). Or install a virtual to run one in the other and see how you do with it.

Yes there's a learning curve but it's nothing compared to office 2007 and Vista!

Please understand I'm not a Linux zealot, I'm a windows user who is just sick of the crapness that windows is becoming and loving Ubuntu. Linux isn't some god like system that will be issue free and fixing issues is a pain in either system.

So please no flaming for my suggestion. I sincerely would like to make your computing experience fun and pain free again!

My PC history use

Windows
------------
Windows 95
Windows 98
Windows ME
Windows XP
Windows Vista Business

Linux
-------
Mandrake - circa 2000 (major PITA)
Ununtu 7.04 (After Windows failed and I needed HP CDs)
Ubuntu 7.10 (issuses with HP laptop)
Ubuntu 8.10 - smooth install and use. Issue free.

#19 Simon (Homepage) on 2009-04-02 13:10 (Reply)

13GB winsxs.

#20 DreamHack497 (Homepage) on 2009-04-23 21:45 (Reply)

8 GBytes? Nice! My sxs folder contains 100.000 files that take about 27 GByte! This is such a crap. I run a 75 GByte system partition that is full! And you cant resize partitions on Vista64 that easy.

#21 Dixus on 2009-05-07 05:39 (Reply)

Aaron,

Fantastic discussion. I'm going to bookmark it and subscribe. This is an ongoing concern as Win 7 RC is being installed all around the globe. Can you get any further on this question within MS, particularly in regards to

1) keeping the hardlink redundancies from mushrooming from uninstallations and hotfix installations

2) whether Windows 7 handles hardlinking any more frugally -- and if not, WHY NOT?

3) guidelines on using MS tools like hlscan.exe (mentioned by Martin Gerhold) (even if 'unsupported')

4) how to detect the origins of the bloat (as pointed out, again, by Martin Gerhold)

5) more broadly, whether WIM backup images can be modified to reinstall an OS in a more space-efficient way (at least in terms of hardlinks).

Five considerations is perhaps ambitious for one comment.

Yet they're all significant, when MS is trying to shed the reputation for OS bloat with 7.

#22 Martin Stein on 2009-05-10 12:54 (Reply)

ehmmm... let me ask a stupid question:
Did any of you contact MS and whine about it to them?
(and assuming someone did; what was their response?)

#23 J.Watler on 2009-05-21 04:30 (Reply)

Yes... to no avail or response via multiple channels

#23.1 Pr0x1 on 2009-05-29 14:30 (Reply)

Sorry if my points have been made before – but this is a long thread.
I have an Acer 7520 laptop and did not install vista myself. I do not have original Vista dvds but only what Tesco supplied when I bought the laptop.
I do have extended warranty and am not sure if I am covered if I try and replace/or repartition the 32.5 GB partition with a new bigger disk or partition
Unfortunately 9.48 of that partition is winsxs almost a third of my disk space and so I am spending an inordinate amount of time trying to clean up everything else.
One problem that I seem to have is that trying to install software [such as vb express] on another drive seems to require quite a it of free space on c: are there any walk-rounds of this?

Thanks
Alfred

#24 Alfred Vella on 2009-05-25 18:17 (Reply)

Just ran into these threads - interesting. Where my heartburn lies is in the inordinate amount of disk access going on involving these files. Task Manager gives access to Resource Monitor, and the amount of disk I/O involving files in this sxs folder is gigantic and seems way out of proportion on a machine sitting around doing (next to) nothing. Just what's going on here???

#25 Paul on 2010-01-25 20:15 (Reply)

Does anyone know if cleaning out via disk cleanup>more options>System Restore and Shadow Copies will reduce the clutter in the WINSXS folder?

I have a Dell company laptop and WINSXS is over 14 gig!

Just because it's a work machine, I'm too weak to try and clear the files under Disk Cleanup first. Better to ask some questions lest I mess something up.

Thanks.

#26 A Watson on 2010-04-15 17:23 (Reply)

Recently I tried to use this virus removal tool and i ended up realizing that having to spend 4 hours scanning that folder was far more annoying than the virus itself... so as i don't need no fancy games, i'm changing to Ubuntu, no folders like that and works safer.
Every new release of windows i expect it to be better but after a while i always end up thinking the same: windows works great but only if you reinstall it every month... My windows vista takes about 5 minutes to load... windows 7 boots way faster but, then again, it was installed recently.

#27 Joca on 2010-04-26 03:31 (Reply)

Particularly those with crazy large WinSxS sizes (> 50 GB), check to see how much of that is from the following folder:

\Windows\winsxs\ManifestCache

If this represents a significant chunk of it, you can use the following steps to release that space:

1. Open an elevated command prompt
2. NET STOP trustedinstaller
3. Takeown /f %windir%\winsxs\ManifestCache\*
4. Icacls %windir%\winsxs\ManifestCache\* /GRANT administrators:F
5. Del /q %windir%\winsxs\ManifestCache\*
6. NET START trustedinstaller

#27.1 John Sanz on 2010-06-16 13:20 (Reply)

Has anyone thought about running a 'find duplicate files' program on this folder??

#28 PAul on 2010-07-23 23:49 (Reply)

On my partners laptop the winsxs foler is 11GB.
80gb hdd, 12gb for hidden factory restore image, windows uses 50%, hiberbation is about 2gb, system restore is over 10gb and that doesn't leave much for general apps etc, I know a 500gb laptop hdd is only about $55AU but we dont have that free.
This to me doesn't seem to be a very slip streamed operating system so to speak.
I have tweaked system restore and hiberbation etc, is there a way to cut this folder down or loose it all together, her laptop only has about 20 small things installed, itunes, firefox, office (word, excel) and that is about it..

#29 Jason Saggers (Homepage) on 2010-09-21 23:02 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. Standard emoticons like :-) and ;-) are converted to images.
	Remember Information? Subscribe to this entry