html

During routine server maintenance checks, we've identified an unusual behavior on two recently rebuilt Windows Server 2008 R2 SP1 instances. The system generates excessive cab_XXXX_X files (e.g., cab_5328_2) in the Windows\Temp directory at an alarming rate - sometimes multiple times per day. These files consume several gigabytes of disk space, triggering low disk space warnings on system drives.

After analyzing affected systems, we determined this occurs specifically during Windows Update operations. The pattern suggests:

// Typical file generation sequence observed
1. cab_1_1.cab (48MB)
2. cab_2_1.cab (112MB)
3. cab_3_1.cab (64MB)
...
n. cab_n_1.cab (various sizes)

The issue stems from Windows Update's internal cab file extraction process failing to properly clean up temporary files. This manifests when:

• Servers have pending updates requiring multiple reboots
• The Windows Update Agent encounters errors during installation
• Custom update deployment tools interact with WSUS

Instead of simply deleting files, implement this PowerShell cleanup script with automatic logging:

# Cleanup script with logging
$logPath = "C:\Admin\CleanupLogs\CabCleanup_$(Get-Date -Format 'yyyyMMdd').log"
$tempPath = "$env:windir\Temp"

Get-ChildItem -Path $tempPath -Filter "cab_*" | ForEach-Object {
    try {
        Remove-Item $_.FullName -Force
        "$(Get-Date -Format 'o') - Deleted: $($_.Name)" | Out-File $logPath -Append
    }
    catch {
        "$(Get-Date -Format 'o') - Error deleting $($_.Name): $_" | Out-File $logPath -Append
    }
}

# Register as scheduled task to run daily
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\CleanCabFiles.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At 3am
Register-ScheduledTask -TaskName "CabFileCleanup" -Action $action -Trigger $trigger

To stop the file generation at its source:

1. Rebuild the Windows Update components:

   net stop wuauserv
   net stop cryptSvc
   net stop bits
   net stop msiserver
   ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
   ren C:\Windows\System32\catroot2 catroot2.old
   net start wuauserv
   net start cryptSvc
   net start bits
   net start msiserver

2. Apply the latest servicing stack update (KB4490628 for Server 2008 R2 SP1)
3. Configure WSUS to use delta updates instead of full packages

Implement this WMI query to track cab file generation in real-time:

SELECT * FROM __InstanceCreationEvent WITHIN 10 
WHERE TargetInstance ISA 'CIM_DataFile' 
AND TargetInstance.Drive = 'C:' 
AND TargetInstance.Path = '\\windows\\temp\\' 
AND TargetInstance.Extension = 'cab' 
AND TargetInstance.FileName LIKE 'cab[_]%'

The continuous creation/deletion cycle affects:

During routine server maintenance, I noticed multiple Windows Server 2008 R2 SP1 systems (specifically recently rebuilt instances) were generating GBs of temporary CAB files in the Windows\\Temp directory. The files follow the pattern cab_XXXX_X (e.g., cab_5328_2) and reappear shortly after deletion.

After investigating Windows Update logs (C:\\Windows\\WindowsUpdate.log) and Process Monitor traces, I discovered these files are created during the Windows Update process. The CAB files contain update payloads that fail to self-clean due to:

• Incomplete update installations
• Permission issues in the Temp directory
• Interrupted update cycles during server rebuilds

To confirm Windows Update as the culprit, run this PowerShell command to check recent update activity:

Get-WinEvent -LogName "System" | Where-Object {$_.ProviderName -match "WindowsUpdateClient"} | Select-Object TimeCreated, Message | Format-Table -AutoSize

1. Cleanup Automation Script

Create a scheduled task that runs this PowerShell script daily:

# Delete old CAB files but preserve active update processes
$tempPath = "$env:windir\\Temp"
$cutoffDate = (Get-Date).AddDays(-1)
Get-ChildItem -Path $tempPath -Filter "cab_*_*" | 
Where-Object { $_.CreationTime -lt $cutoffDate -and $_.Name -notmatch "_\d{1}$" } | 
Remove-Item -Force

2. Fix Update Components

Reset Windows Update components completely:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\\Windows\\SoftwareDistribution SoftwareDistribution.old
ren C:\\Windows\\System32\\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver

3. Registry Modification

For servers not needing frequent updates, limit temp file retention:

reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate" /v TempDirExpirationDays /t REG_DWORD /d 1 /f

• Configure Group Policy to specify a different temp directory for Windows Update
• Monitor disk space with performance counters for early detection
• Consider upgrading to newer Windows Server versions where this behavior is less prevalent

After implementing these changes, monitor the temp directory size with:

Get-ChildItem $env:windir\\Temp -Recurse | Measure-Object -Property Length -Sum | Select-Object Sum