Skip to main content

Challenges with WinSXS folder taking more disk space on Windows Server 2008/2008R2 and solution for it in Windows Server 2012/2012 R2 with new "Features on Demand"

I have seen many Systems Administrators having challenges in cleaning up WinSXS folder on system drive of Windows Servers 2008/2008R2. What is this WinSXS folder for? What does it contain within it? Is it safe to clean up those files under this folder by selecting them and pressing Delete button to get rid of them and reclaim disk space on C: drive? I know, you might be having these questions, if you would have come across the incidents where this folder would be taking lot of space of C: drive. I have seen Windows Server 2008 R2 machines where this folder would be taking over 20GB of disk space. Microsoft has released few knowledge-base articles as well showing how you can deal with these kind of situation. Microsoft realized the pain that Systems Administrators have cleaning up this folder and hence, they came up with "Features on Demand" on Windows Server 2012/2012 R2. So, now, you would be curious to know what this "Features on Demand" is and how it can help overcome the WinSXS folder disk over-utilization issue on Windows Server 2012/2012 R2 and later versions of Windows Server.

Features on Demand:
Features on Demand is a great little feature. It is a great feature. And what it allows us to do is reclaim some disk space and make our servers a little leaner. So, you know all of those roles and features that we have bundled in Windows?

In order to install them we just simply turn them on. The reason we don't need any installation media to install those is because those binaries come packaged with your Windows installation, again wasting that precious disk space.

So, Features on Demand gives us an opportunity to save on some disk space and increase security by removing the binaries that make up roles and features. So, here's how this works. The Server 2012 installation media has a directory on it called Sources. And within there is a directory called SXS. That's known as the side by side component store. And Windows stores all of its assemblies in there amongst other things as well as the binaries for all of the roles and features. So, when we installed it onto a machine, it actually copies that into a directory called WinSXS located in the Windows directory on the system drive. Now, the roles and features within this directory take up roughly 7-8 gigabytes of storage. Now, multiply that by the number of servers you have running, and that is a good chunk of wasted space. So, in Server 2012/2012R2, we now have three states for a role or feature. In the past on Windows Server 2008/2008R2, we just had enable or disable. Now, we have disabled with payload removed. So, the actual physical binaries that make up that role or feature is known as the payload. So, we can easily use DISM or PowerShell to remove these roles and features completely off of the system to reclaim all of that disk space, and what happens if we need it in the future? Well, we can still get it back using either the installation media or we can copy that SXS directory from the installation media to a shared folder on the network and reference that. So we only need to store it in one spot, and we can still access it from all of our machines. So, how do we go about removing payloads from the system and then, getting them back on once they've been removed? Let's look at this process. We can use DISM, the Deployment Image Servicing and Management tool to remove them from both online and offline images as well as VHD's, and we can also use PowerShell.

Commands to remove the binaries for Roles and Features:

Deployment Image Servicing and Management (DISM):
dism /online /disable-feature /featurename:<name> /remove

If you do not know the exact name of the feature that you want to remove with its payload, you can use this command to find its name.
dism /online /get-features

This command will list all the windows features. To search for a specific feature(s), you can pipe the output to findstr command as below:

PS C:\WINDOWS\system32> dism /online /get-features | findstr /i "Hyper-V"
Feature Name : Microsoft-Hyper-V-All
Feature Name : Microsoft-Hyper-V
Feature Name : Microsoft-Hyper-V-Tools-All
Feature Name : Microsoft-Hyper-V-Management-PowerShell
Feature Name : Microsoft-Hyper-V-Hypervisor
Feature Name : Microsoft-Hyper-V-Services
Feature Name : Microsoft-Hyper-V-Management-Clients

PowerShell:
Uninstall-WindowsFeature <name> -remove

Now, how do we go about installing a role or feature whose had its payload removed from the system? A couple of ways to do it. We can do it manually here with DISM and PowerShell. Notice that we have a source parameter on these, and that source parameter works in one of two ways.

Commands to install the roles/features back with payload removed:

Deployment Image Servicing and Management:
Dism /online /enable-feature /featurename:<name> /source:<src>

PowerShell:
Install-WindowsFeature <name> -Source <src>

Group Policy:
Computer Configuration\Administrative Templates\System\
Specify settings for optional component installation and component repair

We're either going to reference a file share, which again, you would need to copy this Sources\SXS directory from an Installation Media to a file share somewhere on the network, and then, you'll need to give your server read access to that share, and it will download the payloads from that share. If you're not doing it that way, you'll need to reference a Windows image. Now, a more enterprisey way to do this is to do exactly that. Copy the SXS directory to a file share and then, set up a group policy. Above is where it's located and here is the actual settings. Specify settings for optional component installation and component repair. So you'll point this setting to that share. And then on the server, group policy will create a registry setting and point it right to it. And that's where it will get its payload from. Now, there's one other way. Windows will also-- if you have an internet connected machine, and it can't do any of this stuff-- it will actually go out to Windows Update to download those payloads.

If we want to get information about any Windows Feature using DISM, for example, for Windows Backup Feature, we will use the following command:

dism /online /get-featureinfo /featurename:windowsserverbackup

We can use the PowerShell command as well, alternatively:

Get-WindowsFeature Windows-Server-Backup

Now, if we want to remove the Windows Backup Feature with Payload removed, we can use the following commands:

DISM Command:
Dism /online /disable-feature /featurename:windowsserverbackup /remove

PowerShell Command:
Uninstall-WindowsFeature Windows-Server-Backup -Remove

PowerShell Command to find the Windows Server Edition:
Get-WindowsEdition -Online

If you want to install the feature back from Windows Image on the Installation Media, you need to make sure that you are installing the feature back from the Windows Image which is for your Windows Edition.

For example, you have an installation media, you can find the Install Image under D:\Sources\Install.wim

To find out how many editions the Windows Image is for, you can use the following command:
Get-WindowsImage -ImagePath D:\Sources\Install.wim

This will give us all the OSes with their index numbers in that image.

Following is the command to find the same info using the DISM command:
Dism /get-wiminfo /wimfile:D:\sources\install.wim

Now, assume that we have Windows Server 2012 R2 Standard install, so we have to use the index number 2 to install the feature back from the Install image.

PowerShell Command to install the Windows Feature back:
Install-WindowsFeature Windows-Server-Backup -Source wim:D:\sources\install.wim:2

DISM command to install the Windows Feature back:
Dism /online /enable-feature /featurename:windowsserverbackup /source:wim:d:\sources\install.wim:2

Now, we will have lot of Roles and Features that we won’t be using. So, how to get rid of those roles and features with their payloads in one shot.

PowerShell command to do this is:
Get-WindowsFeature | where-object {$._Installed -eq $false} | Uninstall-WindowsFeature -Remove


Thank you,
Nirav Soni

Comments

Popular posts from this blog

Microsoft Azure Administrator (AZ-104) Course in Hindi

 Below in the link for the YouTube Video series for the Microsoft Azure Administrator (AZ-104) course in Hindi. https://www.youtube.com/watch?v=fqnsqJoWyjM This video is the first video in this series teaching you the Microsoft Azure Administrator (AZ-104) course in Hindi. I hope, you will enjoy this series, and I am sure that it will help you prepare for your Microsoft Azure Administrator (AZ-104) certification.  If you are enjoying my videos, please like and share them. Please also subscribe to my channel to get notified about the new videos that I publish. Thank you, Nirav Soni

Working with Server Core machine

Before I talk about the Server Core, I would, first of all, list the editions of Windows Server 2012 R2. There are 4 editions in Windows Server 2012 R2. Data Center Standard Essentials Foundation They can be installed with two states - either GUI or without GUI i.e. Server Core. Actually, there's also a third state here and it's kind of the middle ground between Server Core and Server with the GUI and that is the Minimal Server Interface. Server Core is being installed mostly for Domain Controllers, DHCP, Hyper-V and DNS. Server Core only has Command Line and PowerShell. All of those user interface elements that you're used to in Server with GUI like the Microsoft Management Console, Server Manager, Explorer, all of those things are gone. The whole idea here is that it contains a much smaller footprint. It's actually four gigabytes smaller than server with a GUI. This is going to reduce the potential attack surface too. So, it's smaller and more secure....

Setup Wireshark capturing for a remote Windows server

Many times, while working as a Systems Administrator providing support for the Windows or Linux Infrastructure, you come across some issues where you may suspect that those issues might be causing on some server(s) due to network related issues. It might be a DNS related issues where DNS queries do not resolve some times for some unknown reason or it could be a case where remote user who establishes a VPN connection and assume that his/her domain user password is about to expire soon and he or she needs to reset the password over VPN connection, but password cannot be reset because the TCP port 464 is blocked. These are just some examples of the incidents when you would think to capture network traffic on some servers to find the root cause. Below, you will find the step-by-step instructions showing you how you can use the Wireshark to capture the network traffic for a remote server. You can capture the network traffic from within the server too on which you have issues, but some t...