Update Powershell/README.md
This commit is contained in:
@@ -19,6 +19,138 @@ Launch the menu on local machine:
|
||||
|
||||
You’ll be prompted step-by-step to list or create tasks, including remote targeting.
|
||||
|
||||
---
|
||||
---
|
||||
|
||||
<h2>Invoke-DiskCleanupScan.ps1</h2>
|
||||
`Invoke-DiskCleanupScan.ps1` is a PowerShell script for recovering disk space on Windows Server 2016 through current versions. It performs a full scan of the C: drive across all known bloat sources, presents a grouped findings report with sizes, then requires explicit user confirmation before touching anything.
|
||||
|
||||
Supports: **Windows Server 2016, 2019, 2022, 2025**
|
||||
Requires: **Run as Administrator**
|
||||
|
||||
---
|
||||
|
||||
## Features
|
||||
|
||||
- Full pre/post drive capacity reporting
|
||||
- Grouped scan results with colour-coded size indicators
|
||||
- Interactive cleanup mode — clean all, pick individually, or exit
|
||||
- **Event log backup to Zipline (pebkac.pro) before any wipe**
|
||||
- IIS log cleanup scoped to files older than 30 days
|
||||
- Delivery Optimisation cache cleanup with safe service stop/start
|
||||
- PS 5.1 compatible — no PowerShell 7 required
|
||||
|
||||
---
|
||||
|
||||
## What It Scans
|
||||
|
||||
| Category | Target |
|
||||
|---|---|
|
||||
| Temp Files | `C:\Windows\Temp`, `$env:TEMP`, User AppData Temp |
|
||||
| Windows Update | `SoftwareDistribution\Download`, `WinSxS\Backup` |
|
||||
| System Logs | `C:\Windows\Logs\CBS` |
|
||||
| Error Reporting | WER ReportQueue, ReportArchive, User WER folder |
|
||||
| Crash Dumps | `C:\Windows\Minidump`, `MEMORY.DMP` |
|
||||
| Prefetch | `C:\Windows\Prefetch` (*.pf files) |
|
||||
| Delivery Optimisation | SoftwareDistribution\DeliveryOptimization, NetworkService profile cache |
|
||||
| IIS Logs | `C:\inetpub\logs\LogFiles`, `W3SVC1` (files >30 days) |
|
||||
| Windows Event Logs | All `.evtx` logs — **backed up before wipe** |
|
||||
| Recycle Bin | C: Recycle Bin via Shell COM object |
|
||||
| Cache | Thumbnail cache, Font cache |
|
||||
| Installer | MSI Patch Cache ⚠️ |
|
||||
| User Profiles | Non-system profiles in `C:\Users` ⚠️ |
|
||||
| Legacy | Downloaded Program Files |
|
||||
|
||||
> ⚠️ **MSI Patch Cache** — deleting may break MSI repair/uninstall for some applications. Only select this if space is critical and you have installer media available.
|
||||
|
||||
> ⚠️ **Old User Profiles** — script flags these for review. Manual verification is strongly recommended before selecting.
|
||||
|
||||
---
|
||||
|
||||
## Event Log Backup — Zipline Integration
|
||||
|
||||
Before any event log is cleared, the script automatically:
|
||||
|
||||
1. Exports all non-empty event logs to `.evtx` files in a temp staging folder
|
||||
2. Compresses them into a single zip: `HOSTNAME_EventLogs_YYYYMMDD-HHmmss.zip`
|
||||
3. Uploads the zip to **pebkac.pro** via the Zipline API
|
||||
4. **Only clears logs if the upload returns HTTP 200/201/204**
|
||||
5. If upload fails for any reason — logs are NOT wiped, and the local export path is printed
|
||||
|
||||
The file URL returned by Zipline is printed to console for reference.
|
||||
|
||||
**Upload endpoint:** `https://pebkac.pro/api/upload`
|
||||
**Auth header:** `authorization: <token>` (bare token, no `Bearer` prefix — Zipline-specific)
|
||||
**Extra header:** `x-zipline-original-name: true`
|
||||
**Response field:** `.files[0].url`
|
||||
|
||||
---
|
||||
|
||||
## Usage
|
||||
|
||||
```powershell
|
||||
# Run in an elevated PowerShell session
|
||||
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
|
||||
.\Invoke-DiskCleanupScan.ps1
|
||||
```
|
||||
|
||||
### Cleanup Menu
|
||||
|
||||
```
|
||||
[A] Clean ALL items listed above
|
||||
[S] Select items individually
|
||||
[X] Exit — do nothing
|
||||
```
|
||||
|
||||
- Choosing **A** requires typing `YES` in full to confirm
|
||||
- Choosing **S** prompts Y/N per item
|
||||
- All confirmations require input in the console — nothing runs silently
|
||||
|
||||
---
|
||||
|
||||
## Output Example
|
||||
|
||||
```
|
||||
C: Drive Status
|
||||
────────────────────────────────────────────────────────────
|
||||
Total: 120.00 GB Used: 108.42 GB Free: 11.58 GB (9.7% free)
|
||||
|
||||
[Windows Update]
|
||||
────────────────────────────────────────────────────────────
|
||||
SoftwareDistribution\Download 3.21 GB (Cached WU downloads)
|
||||
WinSxS\Backup 512.00 MB (Old component backups)
|
||||
|
||||
[Event Logs]
|
||||
────────────────────────────────────────────────────────────
|
||||
Windows Event Logs (*.evtx) 1.84 GB (Will clear all logs — review first)
|
||||
|
||||
...
|
||||
|
||||
TOTAL RECOVERABLE 9.10 GB
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Notes & Caveats
|
||||
|
||||
- **Event logs**: All logs are cleared when selected. The Zipline backup is the safety net — don't skip it or remove that gate.
|
||||
- **IIS logs**: Only files older than 30 days are removed. Adjust the `$cutoff` variable in the script if you need a different retention window.
|
||||
- **Prefetch**: Windows Server typically has Prefetch disabled by default. The script will skip this silently if no `.pf` files are found.
|
||||
- **WinSxS**: The script removes `WinSxS\Backup` only — it does not touch the main WinSxS store. Running `DISM /Online /Cleanup-Image /StartComponentCleanup` separately is recommended for deeper WinSxS reduction but requires a maintenance window.
|
||||
- **Delivery Optimisation**: The `DoSvc` service is stopped briefly during cleanup and restarted. If the server is actively downloading updates this may cause a minor interruption.
|
||||
|
||||
---
|
||||
|
||||
## Script Location
|
||||
|
||||
Store the script in a consistent admin tools location, e.g.:
|
||||
|
||||
```
|
||||
\\<server>\AdminTools\Scripts\Invoke-DiskCleanupScan.ps1
|
||||
```
|
||||
|
||||
Or maintain in your preferred source control / internal repo.
|
||||
|
||||
<h2>Everything Else</h2>
|
||||
|
||||
Still working documenting this crap
|
||||
Reference in New Issue
Block a user