Windows 7 WinSxS folder problem.

Discussion in 'Windows 7' started by inteliboy, Jun 10, 2014.

  1. inteliboy

    inteliboy MDL Novice

    Mar 9, 2010
    17
    11
    0
    #1 inteliboy, Jun 10, 2014
    Last edited: Jun 10, 2014
    Hi,

    I use Komm's Update Checker to update my WIM image and I only use one image, that I would update once new KUC version would appear and it would always seem to remove unused updates.
    However I noticed that that my WinSxS grows bigger and bigger each time, even after superseded updates are being removed.
    So decided to make an experiment and removed ALL the updates except like 4 permanent ones to the servicing stack.
    And it worked.... superficially as all files used by the OS that is system32 files and sysWoW64 files were reset to what they were in a clean SP1 WIM but all the deleted updates with various file versions still reside in WinSxS folder. What is the point of removing superseded updates when they get stuck in there forever?
    This behaviour isn't KUC related as even by using windows update and removing the updates afterwards they are still occupying space in WinSxS folder.
    I provided an example for multiple versions of ntoskrnl:
    VjWFwLK.jpg
    A total of 11 ntoskrnl.exe versions in WIM that had all updates removed!? sick!
    Then i thought, OK maybe I could install KB2852386 that would clean the old updates but no, it didn't work.
    So tell me, is this behaviour by design? Is the only way to have cleaner WinSxS is to take a clean WIM, update it and then when we want updated version, take a clean WIM again so that old updates wouldn't pile up there?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,197
    84,751
    340
    Offline image cannot be updated regulary like online system
    yes, most of the removed updates do not get removed until you boot and install that image
     
  3. inteliboy

    inteliboy MDL Novice

    Mar 9, 2010
    17
    11
    0
    I'm not updating WIM offline. I do it online and then sysprep the image and still the issue persists.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,197
    84,751
    340
    I see
    after checking some removed superseded updates, i see that there folders still present in winsxs
    never noticed or crossed my mind to check it before

    frustrating
     
  5. inteliboy

    inteliboy MDL Novice

    Mar 9, 2010
    17
    11
    0
    #5 inteliboy, Jul 12, 2014
    Last edited: Jul 12, 2014
    (OP)
    I managed to successfully resolve this issue.
    So the problem was that even after packages were removed by DISM of via Control Panel GUI, they stayed in WinSxS folder.
    But there is a way to get rid of them.
    I found out that after a package is removed a new registry key appears under:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
    It's called CatalogsToUninstall and it will have listed catalogs from packages that we removed.
    I spent few days working out the issue based on what I know and the soultion is as follows:

    1. Package is being removed via DISM or any other way. It dissapears from from DISM packages listing via /get-packages, but stays in WinSxS folder.
    2.To properly clean it we must use Windows 7 Disk Cleanup (cleanmgr.exe) along with KB2852386 installed.
    However this will work in one case only. If Windows 7 Disk Cleanup detects superseded updates. Because if it won't then CatalogsToUninstall key will remain in registry and also files will remain in WinSxS folder.
    3. Disk Cleanup has a tendency of removing packages that are in fact not superseded so they will need to be re-added.
    4. After Cleanup restart is needed for changes to take place. //EDIT
    5. After those steps the old/removed/superseded packages are gone from the OS.

    One important thing to mention is that it does not work on original system components. For example even though we remove IE8 packages via DISM or Windows 7 Disk Cleanup,it only flags them as superseded and removes from /get-pacjages listing but they will always stay in WinSxS folder.
    But as far as I noticed it only applies to packages that were original system components (not installed updates to those components). That seems to be by design as once removed, there would be no way to add those system components back as IE8 comes built-in with Windows 7 and there is no separate msu package.

    Another interesting thing is that the log file created under %systemroot%\logs\cbs called DeepClean does detect and flags for removal superseded packages but not those old/removed ones, but it does delete them anyway. So it would seem this feature is somewhat hidden. So the important thing to remember is to always have at least one package that is superseded to get rid of all those removed by DISM or whatever.

    Everything was tested on a live system in Audit Mode.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,197
    84,751
    340
    Code:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing]
    "Clean"=dword:00000001
    
    adding this value will make it perform a scavenge of superseded (orphan) components
    but not immediatley, a restart or running any other servicing operation will be needed
    the value will be deleted afterwards

    the key of course, is TrustedInstaller protected, so you need NSudo or similar apps