Hi, I use Komm's Update Checker to update my WIM image and I only use one image, that I would update once new KUC version would appear and it would always seem to remove unused updates. However I noticed that that my WinSxS grows bigger and bigger each time, even after superseded updates are being removed. So decided to make an experiment and removed ALL the updates except like 4 permanent ones to the servicing stack. And it worked.... superficially as all files used by the OS that is system32 files and sysWoW64 files were reset to what they were in a clean SP1 WIM but all the deleted updates with various file versions still reside in WinSxS folder. What is the point of removing superseded updates when they get stuck in there forever? This behaviour isn't KUC related as even by using windows update and removing the updates afterwards they are still occupying space in WinSxS folder. I provided an example for multiple versions of ntoskrnl: A total of 11 ntoskrnl.exe versions in WIM that had all updates removed!? sick! Then i thought, OK maybe I could install KB2852386 that would clean the old updates but no, it didn't work. So tell me, is this behaviour by design? Is the only way to have cleaner WinSxS is to take a clean WIM, update it and then when we want updated version, take a clean WIM again so that old updates wouldn't pile up there?
Offline image cannot be updated regulary like online system yes, most of the removed updates do not get removed until you boot and install that image
I'm not updating WIM offline. I do it online and then sysprep the image and still the issue persists.
I see after checking some removed superseded updates, i see that there folders still present in winsxs never noticed or crossed my mind to check it before frustrating
I managed to successfully resolve this issue. So the problem was that even after packages were removed by DISM of via Control Panel GUI, they stayed in WinSxS folder. But there is a way to get rid of them. I found out that after a package is removed a new registry key appears under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing It's called CatalogsToUninstall and it will have listed catalogs from packages that we removed. I spent few days working out the issue based on what I know and the soultion is as follows: 1. Package is being removed via DISM or any other way. It dissapears from from DISM packages listing via /get-packages, but stays in WinSxS folder. 2.To properly clean it we must use Windows 7 Disk Cleanup (cleanmgr.exe) along with KB2852386 installed. However this will work in one case only. If Windows 7 Disk Cleanup detects superseded updates. Because if it won't then CatalogsToUninstall key will remain in registry and also files will remain in WinSxS folder. 3. Disk Cleanup has a tendency of removing packages that are in fact not superseded so they will need to be re-added. 4. After Cleanup restart is needed for changes to take place. //EDIT 5. After those steps the old/removed/superseded packages are gone from the OS. One important thing to mention is that it does not work on original system components. For example even though we remove IE8 packages via DISM or Windows 7 Disk Cleanup,it only flags them as superseded and removes from /get-pacjages listing but they will always stay in WinSxS folder. But as far as I noticed it only applies to packages that were original system components (not installed updates to those components). That seems to be by design as once removed, there would be no way to add those system components back as IE8 comes built-in with Windows 7 and there is no separate msu package. Another interesting thing is that the log file created under %systemroot%\logs\cbs called DeepClean does detect and flags for removal superseded packages but not those old/removed ones, but it does delete them anyway. So it would seem this feature is somewhat hidden. So the important thing to remember is to always have at least one package that is superseded to get rid of all those removed by DISM or whatever. Everything was tested on a live system in Audit Mode.
Code: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing] "Clean"=dword:00000001 adding this value will make it perform a scavenge of superseded (orphan) components but not immediatley, a restart or running any other servicing operation will be needed the value will be deleted afterwards the key of course, is TrustedInstaller protected, so you need NSudo or similar apps