From 70a93d54b221c03a4f41413ce318026950ab5a16 Mon Sep 17 00:00:00 2001 From: DistractADD Date: Thu, 23 Apr 2026 09:59:45 +1000 Subject: [PATCH] Update Powershell/README.md --- Powershell/README.md | 132 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 132 insertions(+) diff --git a/Powershell/README.md b/Powershell/README.md index aaf9704..e894291 100644 --- a/Powershell/README.md +++ b/Powershell/README.md @@ -19,6 +19,138 @@ Launch the menu on local machine: You’ll be prompted step-by-step to list or create tasks, including remote targeting. +--- +--- + +

Invoke-DiskCleanupScan.ps1

+`Invoke-DiskCleanupScan.ps1` is a PowerShell script for recovering disk space on Windows Server 2016 through current versions. It performs a full scan of the C: drive across all known bloat sources, presents a grouped findings report with sizes, then requires explicit user confirmation before touching anything. + +Supports: **Windows Server 2016, 2019, 2022, 2025** +Requires: **Run as Administrator** + +--- + +## Features + +- Full pre/post drive capacity reporting +- Grouped scan results with colour-coded size indicators +- Interactive cleanup mode — clean all, pick individually, or exit +- **Event log backup to Zipline (pebkac.pro) before any wipe** +- IIS log cleanup scoped to files older than 30 days +- Delivery Optimisation cache cleanup with safe service stop/start +- PS 5.1 compatible — no PowerShell 7 required + +--- + +## What It Scans + +| Category | Target | +|---|---| +| Temp Files | `C:\Windows\Temp`, `$env:TEMP`, User AppData Temp | +| Windows Update | `SoftwareDistribution\Download`, `WinSxS\Backup` | +| System Logs | `C:\Windows\Logs\CBS` | +| Error Reporting | WER ReportQueue, ReportArchive, User WER folder | +| Crash Dumps | `C:\Windows\Minidump`, `MEMORY.DMP` | +| Prefetch | `C:\Windows\Prefetch` (*.pf files) | +| Delivery Optimisation | SoftwareDistribution\DeliveryOptimization, NetworkService profile cache | +| IIS Logs | `C:\inetpub\logs\LogFiles`, `W3SVC1` (files >30 days) | +| Windows Event Logs | All `.evtx` logs — **backed up before wipe** | +| Recycle Bin | C: Recycle Bin via Shell COM object | +| Cache | Thumbnail cache, Font cache | +| Installer | MSI Patch Cache ⚠️ | +| User Profiles | Non-system profiles in `C:\Users` ⚠️ | +| Legacy | Downloaded Program Files | + +> ⚠️ **MSI Patch Cache** — deleting may break MSI repair/uninstall for some applications. Only select this if space is critical and you have installer media available. + +> ⚠️ **Old User Profiles** — script flags these for review. Manual verification is strongly recommended before selecting. + +--- + +## Event Log Backup — Zipline Integration + +Before any event log is cleared, the script automatically: + +1. Exports all non-empty event logs to `.evtx` files in a temp staging folder +2. Compresses them into a single zip: `HOSTNAME_EventLogs_YYYYMMDD-HHmmss.zip` +3. Uploads the zip to **pebkac.pro** via the Zipline API +4. **Only clears logs if the upload returns HTTP 200/201/204** +5. If upload fails for any reason — logs are NOT wiped, and the local export path is printed + +The file URL returned by Zipline is printed to console for reference. + +**Upload endpoint:** `https://pebkac.pro/api/upload` +**Auth header:** `authorization: ` (bare token, no `Bearer` prefix — Zipline-specific) +**Extra header:** `x-zipline-original-name: true` +**Response field:** `.files[0].url` + +--- + +## Usage + +```powershell +# Run in an elevated PowerShell session +Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass +.\Invoke-DiskCleanupScan.ps1 +``` + +### Cleanup Menu + +``` + [A] Clean ALL items listed above + [S] Select items individually + [X] Exit — do nothing +``` + +- Choosing **A** requires typing `YES` in full to confirm +- Choosing **S** prompts Y/N per item +- All confirmations require input in the console — nothing runs silently + +--- + +## Output Example + +``` + C: Drive Status + ──────────────────────────────────────────────────────────── + Total: 120.00 GB Used: 108.42 GB Free: 11.58 GB (9.7% free) + + [Windows Update] + ──────────────────────────────────────────────────────────── + SoftwareDistribution\Download 3.21 GB (Cached WU downloads) + WinSxS\Backup 512.00 MB (Old component backups) + + [Event Logs] + ──────────────────────────────────────────────────────────── + Windows Event Logs (*.evtx) 1.84 GB (Will clear all logs — review first) + + ... + + TOTAL RECOVERABLE 9.10 GB +``` + +--- + +## Notes & Caveats + +- **Event logs**: All logs are cleared when selected. The Zipline backup is the safety net — don't skip it or remove that gate. +- **IIS logs**: Only files older than 30 days are removed. Adjust the `$cutoff` variable in the script if you need a different retention window. +- **Prefetch**: Windows Server typically has Prefetch disabled by default. The script will skip this silently if no `.pf` files are found. +- **WinSxS**: The script removes `WinSxS\Backup` only — it does not touch the main WinSxS store. Running `DISM /Online /Cleanup-Image /StartComponentCleanup` separately is recommended for deeper WinSxS reduction but requires a maintenance window. +- **Delivery Optimisation**: The `DoSvc` service is stopped briefly during cleanup and restarted. If the server is actively downloading updates this may cause a minor interruption. + +--- + +## Script Location + +Store the script in a consistent admin tools location, e.g.: + +``` +\\\AdminTools\Scripts\Invoke-DiskCleanupScan.ps1 +``` + +Or maintain in your preferred source control / internal repo. +

Everything Else

Still working documenting this crap \ No newline at end of file