Deleting old Windows update logs in 25H2

cereberus · Dec 23, 2025

I was doing a disk cleanup and found 900+MB of Windows update logs, but no matter what I tried (various online solutions), they would not be removed.

I tried safe mode - no joy.

I tried manually to delete them and here is where I began to suspect my issue lay. Most of the logs deleted fine but three or four logs (or so) would not get deleted.

Often logs cumulate i.e. new data is appended to existing logs any they just grow inexorably. So I write a simple batch file and then booted from Macrium Reflect, and run batch file from its PE Explorer, and that worked getting logs down to a few kb. All those stuborn logs got deleted.

Unfortunately, I see the logs have crept up again to 19.1 MB, and I tried to use batch file from Windows but back to stubborn files not being deleted.

So I guess I shall have to use my batch file using Macrium Reflect in preOS mode periodically.

I have no idea if outher users are experiencing this issue or if it is a bug in 25H2 but at least I have a workaround.

Code:

c:

cd/

cd windows

del *.log /a /s /q /f

pause

tecknot · Dec 23, 2025

Good morning @cereberus,

It's my understanding that if you boot up into Linux, you can then delete any file in Windows. I am sure others can confirm.

Kind regards,

tecknot

EB2XR6 · Dec 23, 2025

Did you run Disk Clean up as Admin?

hader · Dec 23, 2025

Search for clean. It will show you diskcleaner. Start it. Choose the C-drive. There some options here, but *.old dir is a copy of Windows after a In-Place-Installment. It will not show up there. Click on clean systemfiles. Choose the C-drive again. In the following screen you can tag certain files like old Windows dirs. Update files etc. This is the only way this will work. Inside the Windows.old and other files or directory's; there are files owned by the TrustedInstaller. The highest user on a Windows system. If you try to delete these files as admin; you are getting a lot of errors because Admin can't delete these files (not enough rights) owned by the TrustedInstaller.
With this program it can because it will elevate itself to be the TrustedInstaller and deletes the files with no problems.

cereberus · Dec 24, 2025

tecknot said:
Good morning @cereberus,

It's my understanding that if you boot up into Linux, you can then delete any file in Windows. I am sure others can confirm.

Kind regards,

tecknot

Sure but as I said, I boot into WinPE which worked.

cereberus · Dec 24, 2025

hader said:
Search for clean. It will show you diskcleaner. Start it. Choose the C-drive. There some options here, but *.old dir is a copy of Windows after a In-Place-Installment. It will not show up there. Click on clean systemfiles. Choose the C-drive again. In the following screen you can tag certain files like old Windows dirs. Update files etc. This is the only way this will work. Inside the Windows.old and other files or directory's; there are files owned by the TrustedInstaller. The highest user on a Windows system. If you try to delete these files as admin; you are getting a lot of errors because Admin can't delete these files (not enough rights) owned by the TrustedInstaller.
With this program it can because it will elevate itself to be the TrustedInstaller and deletes the files with no problems.

The first thing I tried of course! Still did not delete logs using Windows - I do not think it is a trusted installer issue - more that some logs are not being released properly but I have solved issue.

Actually I have another solution now as well. Image backup C drive specifically excluding log files and then immediately restoring image backup using Macrium Reflect. No real advantage though over manually deleting them in winpe mode.

PurSpyk!! · Dec 24, 2025

I use a program called Hibituninstaller that has a junk file scanner that will remove all these files. It will do it directly within Windows

TairikuOkami · Dec 24, 2025

You need to stop Windows Event Log service.

Windows Update log files

Learn about the Windows Update log files and how to merge and convert Windows Update trace files (.etl files) into a single readable WindowsUpdate.log file.

learn.microsoft.com

For a deeper cleanup, you need to stop some services and processes. I use this.

Windows/Windows Cleanup.bat at main · TairikuOokami/Windows

Windows. Contribute to TairikuOokami/Windows development by creating an account on GitHub.

github.com

hader · Dec 24, 2025

cereberus said:
The first thing I tried of course! Still did not delete logs using Windows - I do not think it is a trusted installer issue - more that some logs are not being released properly but I have solved issue.

Actually I have another solution now as well. Image backup C drive specifically excluding log files and then immediately restoring image backup using Macrium Reflect. No real advantage though over manually deleting them in winpe mode.

This clean option is only for old Windows stuff that isn't used any more or some backup's. It is the TrustedInstaller that owns many files in the Windows and Windows.old directory. (e.g. Just look inside the Component Store; C:\Windows\WinSxS. Admin can Read, Execute, Show you the content of the dirs. But can't delete them. Only TrustedInstaller can. It has all the rights) You can't delete them using Admin!

But as you would probably also know you can't delete log files if they are in use. If you want to delete them you must kill the proces or stop the service that is holding it. Backup software can not access them also during a backup. It's not that important to backup these kind of files. Services etc. are writing into it when needed. It content is related to the moments that service/proces is running. At a offline restore that log file will be missing. But when the restore is complete and after a reboot of the PC that service is started again, sees that the logfile is missing and creates a new and empty file. When needed it writes into it again.

If you would stop the service and look inside this logfile it knows nothing about the time before the restore. It's only valid when Windows is running. From that perspective this is some kind of temporary file also. This why you can't find a earlier date prior to the latest restore or In-place-Installment. Just look inside the C:\Windows\Logs\DISM\dism.log file. It is possible by using the Windows Recovery Environment and CMD to delete these file. But not all of them. This environment is the bare minimum what's needed to run Windows. There are log files locked because of the needed services that run at that moment.

The user TrustedInstaller has his own service called Windows Modules Installer. Only active during updates and DISM/SFC operations. Shuts down 2 minutes after the operation has been finished. (Ending TrustedInstaller finalization, inside the CBS.log.)

Deleting old Windows update logs in 25H2

Well-known member

My Computer

living in a van down by the river

My Computer

Active member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Similar threads