• NEW DISM folder created every day in User/Temp

    Home » Forums » AskWoody support » Windows » Windows 10 » Windows 10-other » NEW DISM folder created every day in User/Temp

    Author
    Topic
    #2483303

    This started maybe a week ago. Before any Windows Updates for September. Only thing was EDGE updates. Nothing else I can tell.

    A folder is created in User/Temp that contains all of DISM. If I try to delete it, it says requires Administrator Permiossions. I am the admin. If I click continue, it deletes. Then needs permission again to clear the recycle bin.

    If I delete it, it seems to be back with a new folder name the next day.

    What? Why?

    Its pretty new. so wondering what this is all about.

    Thanks.

     

    PS. MOST files dated 5/5/2021 under a folder dated today.

    • This topic was modified 2 months ago by rebop2020.
    Viewing 67 reply threads
    Author
    Replies
    • #2483307

      Finding others with the issue. Some say related to Windows Defender not being able to run (I have ESET – so maybe).

      Reading results of searching and finding more than expected on this. For example:

      https://www.bleepingcomputer.com/forums/t/604648/dlls-muis-dismhostexe-re-appearing-in-temp-folder/

      Will let you know what I find.

    • #2483314

      SFC and DISM scans clean.

    • #2483315

      CLUE:

      The DISM folders were created when this task ran:

      \Microsoft\Windows\Management\Provisioning

      What is that? About to Google.

    • #2483351

      It seems unlikely it’s Goggle (how did you arrive at that?) or Windows defender, As I too have the folder, any my machine is so vanilla Chrome is now the only extra program on it bar some drivers which came through Microsoft anyway..

      It looks as if they’re actually trying to service the DISM tool and failing? (unless it’s the “new kid on the block” (https://www.bleepingcomputer.com/news/security/new-chaos-malware-infects-windows-linux-devices-for-ddos-attacks/) and they need to place the entire subsystem to get a DLL exploit to work..)

      That said Windows update is unusually busy for the “up to date” state despite the optional KB5017380 being the only offer.. and the application servicing is going like crazy (see attached ) so that might explain – DISM would be needing to update the catalogue to successfully work with the changes.. so I’m putting that down to MS fixing their problems without bragging about what we were open to.. and yes, edge is on the list at the top..

      Attachments:
    • #2483354

      Nooo, I was about to Google MicrosoftWindowsManagementProvisioning creates DISM folder. Not that Google is the issue. This is within seconds of the folder being created. And runs only at login. But also only started in the last week(s).

      Exactly what folder do you have? I have (and the folder name changes each time):

      1dism
      I do not believe at all Windows Update caused this. Happened before Sept Updates. Edge updates, maybe.

       

      Attachments:
      • #2483753

        At a glance that’s the folder I have. I fact its quite  amess as the processes aren’t deleting them – so I have a bunch of them with the same content. Mine aren’t being cleared out or deleted but it might not have to around to it yet.

        It could be my install as one thing I have done is used DISM to massacre a lot of the cr@p which comes in the box to aid in getting a large product onto a small SSD. I also occasionally use the /resetbase switch (as well as the usual measures with DISM to generally remove the update trash which storage seems to love to cling to) to ditch all the old versions of everything to help maintain the space I have..

        I don’t have a problem and I’m making the case that the effect described in this post doesn’t represent a problem beyond that MS can’t be bothered to tidy up the mess as they so along, preferring to get the cleaning lady in once a month to clear it out.. (unless like me you’ve turned off storage because you actually store things in your download folder for a reason.. have you?)

        I guess the way to tell would be to disable the what was the content delivery service – that’s been gone a while, by description it might be delivery optimisation now? That was harder than it should have been (when I went there back at 1809). If the effect disappears it’d prove the point but I wouldn’t try to hard to prove it, or leave that service off long term (as you might want edge  to update).

        As I have to manually kick Chrome to get it to update, I just did that and it did. No extra folders appeared so I still doubt that’s a cause of the issue (now got 105.0.5195.127 should anyone want to know!). I also have the empty folders with an En-US within. I’m quite happy to completely ignore the extra folders, and I’ll clean them out myself when Windows starts to complain about space (as I followed SB’s post so already have the recovery media downloaded..) and I think others here have completely vindicated the reasoning as well..

        As to the “I haven’t got a temp folder” post – what happens shortly after you type

        cmd /c start %temp%

        in your run box and click the Ok button there?? I guess you could delete the system variable but I’d also guess that might cause some strange behaviour..

         

         

         

    • #2483357

      Also unsure how your image pertains to this issue, oldguy??

    • #2483395

      Interesting. I don’t have a TEMP folder under my user.

      Windows 10 21H2 Sept. updates.
      Defender disabled. Updating Edge manually.
      I have a DISM folder in system32

      Attachments:
    • #2483409

      You have two types of Microsoft Store apps:

      • User
      • Provisioned

      Microsoft Store Provisioned apps are what you could best call master apps: every user on your computer gets them. What I suspect has been updating are your Microsoft Store apps. Go to the Microsoft Store Library and see what and when which apps were updated. These apps update whenever they want to update. (This is a conjecture based upon what I know of provisioned and user apps and admittedly limited.)

      Carpe Diem {with backup and coffee}
      offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
      offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.674 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
      online▸ Win11Pro 22H2.22621.819 x64 i5-9400 RAM16GB HDD Firefox108.0b7 MicrosoftDefender
      • #2483419

        I do not believe that is it. I have only one MStore app and I have MStore set to not update anything. The only thing not under that control is Edge. Which updates from other methods. Wish it would not, but it does.

        Actually there are more than I expected and some I never asked for. But nothing recent and set not to update by itself.

         

    • #2483424

      Interesting. I don’t have a TEMP folder under my user.

      Windows 10 21H2 Sept. updates.
      Defender disabled. Updating Edge manually.
      I have a DISM folder in system32

      Alex, I would be amazed if you truly do not:

      C:\Users\YOURNAME\AppData\Local\Temp

      Please check. Might be a system file, so be sure you are showing them.

       

      The other DISM folder is where it should be. Which is why a newly created one here is such a mystery.

      Still researching in my spare time.

      • #2483430

        A folder is created in User/Temp

        That’s not under your User (C:\Users\your ID\Temp.
        Be specific and correct when you list the path.

    • #2483479

      Hi rebop2020:

      There is a Microsoft support article at How Provisioning Works in Windows but I’m not sure it would have any useful information unless you’re a software developer.

      I checked my automated provisioning tasks in Task Scheduler (Task Scheduler Library | Microsoft | Windows | Management | Provisioning) and the last time the Logon task triggered ProvTool.exe was today (28-Sep-2022) @ 8:35:27 AM, which is about 3 hours after I powered on my system and first logged into Windows. However, it looks like that task failed to run today (i.e., Last Run Result = 0x80070428).

      Win-10-Pro-v21H2-Task-Manager-Windows-Provisioning-ProvTool_exe-28-Sep-2022

      I searched my hidden C:\Users\<myusername>\AppData\Local\Temp folder for dism*.*, *.dll and *.exe and couldn’t find any files with those names or extensions, so I don’t appear to have DismHost.exe or any of the other DISM files that you showed in your image in post # 2483354. I last cleaned that Temp folder on 25-Sep-2022 and since then TreeSize Free shows that my Temp folder has grown to ~418 MB, but the contents of two subfolders (C:\Users\<myusername>\AppData\Local\Temp\Diagnostics and C:\Users\<myusername>\AppData\Local\Temp\Outlook Logging) account for over 350 MB of that 418 MB. I have dozens of subfolders in C:\Users\<myusername>\AppData\Local\Temp with randoms names like {AA31FBDE-303A-421A-95CB-12363FFFBDD9} similar to the ones you see but they’re all empty.

      TreeSize-v4_5_3-Users-AppData-Local-Temp-28-Sep-2022

      I only see one .ppkg file in my hidden C:\ProgramData\Microsoft\Provisioning folder.

      TreeSize-v4_5_3-ProgramData-Microsoft-Provisioning-28-Sep-2022

      My last automatic Windows Update check ran at 7:25 AM today (28-Sep-2022) but no updates have been installed by Windows Update except my daily Microsoft Defender definition updates since my Sept 2022 Patch Tuesday updates were delivered on 15-Sep-2022 (see my post # 2478258).
      ————–
      Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v 105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1767 * Macrium Reflect Free v8.0.6979 * Dell Update Windows Universal v4.6.0 * TreeSize Free Portable v4.6.1

      Attachments:
      • #2483493

        Thanks. A lot to reply to. First not seeing those files. Do you have a folder in temp that those files are inside? My current folder is named DD4B175C-AA63-48EF-A366-923D157E7CE8 so it would be something along those lines. Interesting you have lots, but empty. Not one with files?

        Note in my latest post the provisioning task (which also says runs at logon and runs a few hours later) also creates a number of other tmp folders.

        So, mystery continues. But this is all new as I mentioned. Cannot be happening for more than two weeks and likely just a week. I should have noted first appearance.

        I’ll keep reading.

    • #2483491

      A folder is created in User/Temp

      That’s not under your User (C:\Users\your ID\Temp.
      Be specific and correct when you list the path.

      Sorry. Was talking in shorthand, not posting a path there. I have shortcuts to what I refer to as User Temp and Windows Temp. This was the User Temp and I assumed would be better understood.

      That said, do you have files folders with DISM in it?

      This ALSO is creating a slew of tw-xxxxxxxx.tmp folders at the same moment (and same as Windows-Management-Provisioning task running) in C:\Windows\System32\config\systemprofile\AppData\Local

      I had 2399 of those files. Deleted them and now 19 new created this afternoon.

       

      Something just not right.

      • #2483523

        Nothing DISM in C:\Users\myID\AppData\Local\Temp. The total folder size is 4.63MB – bunch of empty folders.

        I do have a slew of tw-* folders in the C:\Windows\System32\config\systemprofile\AppData\Local folder. They all seem to be empty and the total Local folder size is 32.5MB (stuff in other folders).

    • #2483498

      Some clues here including agreement on what is the cause:

      https://www.askvg.com/fix-empty-tw-tmp-folders-in-system32-directory-in-windows-10-11/

      Reading…

      Mine completes succesfully and creates the files. No error unlike this article.

      I donlt think disabling the task is the right solution.

    • #2483520

      https://www.ceofix.net/6107/how-to-fix-the-empty-tw-tmp-folders-on-windows-11-and-10/

      I think these files have been happening for quite some time/ The DISM files in tmp are new, but I am somewhat confident created by the same cause and somehow triggered by some change with a Wndows Edge update.

      No real solution.

      Here’s a Woody thread on the tw files form a few years ago:

      https://www.askwoody.com/forums/topic/provtool-exe-creating-temp-folders/

      Ahhhh, here:

      https://www.elevenforum.com/t/windows-10-11-create-tons-of-empty-folders-in-system32.2444/page-10

      “If you want to see what the provtool is doing. Open event viewer, I haven’t for so long but wondered. Scroll to applications and services> Microsoft >Windows> Provisioning-Diagnostics-Provider>Admin. All of the entries coincide with the folders created. When I had logon task disabled it did not record anything. Now that it is back on I get 21 entries at each logon but only 20 empty Tmp folders.”

      Good stuff. So, more info now:

      Here is what ran when all these were created today.

      1prov
      Looking at a few:

      Applying package ‘Microsoft.Windows.Cosa.Desktop.Client.ppkg’ ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.

      Applying package ‘Power.Settings.Sleep.ppkg’ ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.

      Applying package ‘Power.Settings.PCIExpress.ppkg’ ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.

      Applying package ‘Power.Settings.Graphics.ppkg’ ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.

      Applying package ‘Power.EnergyEstimationEngine.Telemetry.ppkg’ ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.

      Hmm. All similar. Related to power or “cosa”?

      These undeniably created the TW folders and the folder containing DISM. Match to the seconds.

      So…now why? Happens at every logon/ Does not happen on days I do not turn off the computer or reboot.

      Hmmm. COSA:

      https://learn.microsoft.com/en-us/windows-hardware/drivers/mobilebroadband/cosa-overview

      COSA overview

      COSA, or Country and Operator Settings Asset, is the new format that Mobile Operators (MOs) use in Windows 10, version 1703 and later to provision Windows devices for mobile broadband.

      Attachments:
    • #2483538

      I have a folder like that in my C:\Users\YOURNAME\AppData\Local\Temp. It’s size is <10MB. So what?

      And I have 400+ “tw” empty folders in C:\Windows\System32\config\systemprofile\AppData\Local going back to April 20, 2022.

      That *seems* wrong.

    • #2483539

      Some clues here including agreement on what is the cause: https://www.askvg.com/fix-empty-tw-tmp-folders-in-system32-directory-in-windows-10-11/ Reading… Mine completes succesfully and creates the files. No error unlike this article. I donlt think disabling the task is the right solution.

      The tw-*** temp folders issue as a result of the Provisioning task has been discussed here and elsewhere many times (since 2019). System is apparently supposed to delete them periodically but often fails to.

      The article you refer to shows:

      It might be a bug or glitch in Windows 10 and Windows 11 operating systems which should be fixed in future updates.

      Issues with this Provisioning task were first reported AFAIK in 2016 (with the Windows 10 Anniversary Update). Since 2019 I have always disabled the Provisioning task(s) and can’t say that I’ve ever noticed any adverse side-effect.

      Your experience shows that – more than 6 years on – Microsoft are no closer to fixing any bug or glitch with this Provisioning task so – for me – disabling it/them *IS* the right solution for me, in the absence of any effective Microsoft QAT (Quality Assurance Testing). YMMV.

      For anyone interested, I use the following PowerShell command (in an elevated console) to disable the two default Provisioning tasks:

      Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Disable-ScheduledTask

      provtool_task-disable

      To re-enable them, use:

      Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Enable-ScheduledTask

      provtool_task-enable

      Hope this helps…

      (Note to Mods… despite being in a modified group, I still experienced the forum’s ‘slash-stripping’ bug so had to correct broken filepaths.)

      Attachments:
      • #2483547

        Thanks Rick. Agreed, old issue. What is new is that it also creates a copy of DISM complete in the temp directories, which was my original issue in this thread. Was not until I learned that its from Provisioning that I even looked and found 2400 tw*.tmp files still. They seem to be triggered by the same thing, though “possibly” also related to Windows Defender not running.

    • #2483550

      Nothing DISM in C:\Users\myID\AppData\Local\Temp. The total folder size is 4.63MB – bunch of empty folders.

      I do have a slew of tw-* folders in the C:\Windows\System32\config\systemprofile\AppData\Local folder. They all seem to be empty and the total Local folder size is 32.5MB (stuff in other folders).

      I don’t have a path like that on my computer 🙂 🙂

      No worries. I know what you mean.

      So Provisioning and/or defender is causing the DISM. Provisioning for sure on the tw*.tmp folders.

      Read entirely too much on this today. I can easily delete the tw folders. DISM Folder and files more difficult and since new that the system creates these, I’m extremely cusious why and what changed.

    • #2483552

      OK, on further reflection on what has happened in my case, not Defender. Definitely both issues from Provisioning. The DISM folders were being created with nothing touching Defender nor any scheduled task for Defender.

      So that’s wher I shall leave it for tonight. I don’t think anyone will find better answers on the tw*.tmp folders. but would love more on the DISM folders.

    • #2483585

      So that’s wher I shall leave it for tonight.

      As mentioned earlier, l disable the Provisioning tasks. I’ll wait for Microsoft to sort it out in the fullness of time (or not)… but won’t hold my breath. In the meantime I’ll just work around the flaws.

      IMO life is too short to be trying to understand poor quality programming and a 6-yr-old lack of a fix.

    • #2483609

      In the past I have seen such folders appear in %TMP% as the result of Windows Update, Window Security protection updates, running troubleshooters and selecting “Clean up system files” in Disk Cleanup.

      HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 21H2
      Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB
      1 user thanked author for this post.
      • #2483689

        Hi rebop2020:

        Further to EyesOnWindows’ post # 2483609, I did a Google search for “dismhost.exe appdata local temp” and found several similar reports about these DISM files being created in the hidden …\AppData\Local\Temp folder. I didn’t go through all these threads but the majority suggest the DISM files can be created in C:\Users\<username>\AppData\Local\Temp when a scheduled automated task fails to run. At first glance the most common cause seems to be because a scheduled Microsoft Defender scan failed to run (e.g., because the user has a third-party antivirus that prevents Microsoft Defender’s daily Quick Scans from running- see DismHost exe in Temp Folder in the MS Answers forum from a Norton AV user for one example), Windows Update failed to finish installation of an update and rolled back the update, or something prevented a Windows automatic maintenance task from running (e.g., Control Panel | System and Security | Security and Maintenance | Maintenance | Automatic Maintenance is not running correctly) and triggered a DISM “health check” scan.

        WIn-10-Pro-v21H2-Control-Panel-System-and-Security-Automatic-Maintenance-29-Sep-2022

        Assuming the failure of an automated task is causing your problem, and given the number of automatic maintenance tasks that run in Windows (see Shawn Brink’s TenForums tutorial View All Automatic Maintenance Tasks in Windows 10), you might have a difficult time ahead of you isolating exactly what task is failing and triggering a DISM scan on your system.

        At this point my best suggestion would be that you purge the temp files in C:\Users\<username>\AppData\Local\Temp (I use the Custom Clean feature of CCleaner Free to purge all my system temporary files but I assume the built-in Windows Disk Cleanup can also be used) and then see if you can catch the background task that is generating these DISM files in that hidden …\AppData\Local\Temp folder. If you’re lucky you might be able to find an event logged in your Reliability Monitor (see my image below of events logged on 15-Sep-2022 when I installed my Sept 2022 Patch Tuesday updates) that matches the time and date of the subfolder created in C:\Users\<username>\AppData\Local\Temp containing the DISM files.

        If you do have a third-party antivirus I’d also suggest you turn ON Microsoft Defender’s Limited Periodic Scanning and see if allowing Microsoft Defender to run the occasional Quick Scan prevents DISM files from being re-created in your C:\Users\<username>\AppData\Local\Temp folder.

        Win-10-Pro-v21H2-Relaibility-Monitor-Sep-2022-Patch-Tuesday-Updates-of-15-Sep-2022
        ——————–
        Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1767 * Macrium Reflect Free v8.0.6979 * Dell Update Windows Universal v4.6.0 * CCleaner Free Portable v6.04.10044

        Attachments:
        1 user thanked author for this post.
        • #2483703

          Thanks, Imacri. Thoughtful and appreciated reply.

          I found all that on Defender failed to run, but I have no tasks for Defender. Would have been a likely culprit.

          My Automatic Maintenance has no errors.

          So, once again, these files and folders are created the moment Management Provisioning runs after a delay on Logon. So I think I have it as isolated and perhaps I can.

          Reliability monitor is a great idea I had not thought of! Unfortunately, nothing there except a Firefox crash last week.

           

           

    • #2483611

      Alex, I would be amazed if you truly do not:

      C:\Users\YOURNAME\AppData\Local\Temp

      All these folders have empty EN_US subfolder.

      Attachments:
    • #2483694

      So that’s wher I shall leave it for tonight.

      As mentioned earlier, l disable the Provisioning tasks. I’ll wait for Microsoft to sort it out in the fullness of time (or not)… but won’t hold my breath. In the meantime I’ll just work around the flaws.

      IMO life is too short to be trying to understand poor quality programming and a 6-yr-old lack of a fix.

      More interested in the 2 week issue than the 6 year issue, Rick.

    • #2483695

      In the past I have seen such folders appear in %TMP% as the result of Windows Update, Window Security protection updates, running troubleshooters and selecting “Clean up system files” in Disk Cleanup.

      Thanks. None of those run before the first appearance of the DISM folder. Well, possibly a Defender update, but Defender is diabled by ESET and not set to scan periodically.

    • #2483696

      Alex, I would be amazed if you truly do not:

      C:\Users\YOURNAME\AppData\Local\Temp

      All these folders have empty EN_US subfolder.

      Thanks. And interesting. I only have one at a time and fully populated. Something different.

      I’ll try a new Logon today and see what happens.

    • #2484212

      OK, seem to have things sorted for the moment.

      Each logon creates 19 tw-*.tmp FOLDERS.

      Each logon DOES NOT create a folder with all DISM in it. Unsure if that was aone time issue, if it happens after or when an EDGE update. Will watch.

      I wrote a bat file called by a vbs in TASKS to run at logon. It clears all the exisitng tw-*.tmp files that exists on logon, then later (takes maybe 20 minutes) there are 19 again cleared at the next logon.

      I learned something! You cannot use wildcards (*) to match folders to delete using RD or RMDIR in a batch file!! You can for files, but not folders. Surprised me. So the solution is:

      FOR /d %%p IN (“C:\Windows\System32\config\systemprofile\AppData\Local\tw*.tmp”) DO rmdir “%%p” /s /q

      I have other things I delete in the same bat file that build up in temp folders that I delete like Outlook .cvr files, etc. But this was the tricky one.

      So now I wait to see if that DISM folder ever reappears.

       

       

      1 user thanked author for this post.
      • #2484216

        I have 1299 empty tw_.tmp folders in C:\Windows\System32\config\systemprofile\AppData\Local

        Attachments:
      • #2484414

        OK, seem to have things sorted for the moment. Each logon creates 19 tw-*.tmp FOLDERS. Each logon DOES NOT create a folder with all DISM in it. Unsure if that was aone time issue, if it happens after or when an EDGE update. Will watch.

        Hi rebop2020:

        This thread seems to be going a bit off topic. As noted in Rick Corbett’s post # 2483539, Vishal Gupta’s AskVG! 22-Mar-2022 article Empty TW-.tmp Folders in “System32” Directory in Windows 10, 11 states that there is a connection between Windows Provisioning (ProvTool.exe) and the empty folders created in the hidden, protected C:\Windows\System32\config\systemprofile\AppData\Local folder that are named tw-xxxx-xxxx-xxxxxx.tmp . More specifically, Vishal Gupta suspects these empty folders are created when the Logon task at Task Scheduler at Task Scheduler Library | Microsoft | Windows | Management | Provisioning fails to run at logon (see my image below showing a 0x8007042B error for this Logon task). It’s an old bug that affects most Windows 10 / 11 users (see the 15-Dec-2020 images I posted <here> in the Norton forum when I was still using Win 10 Pro v1909) that Microsoft has never fixed, and while the build-up of these empty folders may be annoying for some people they’re completely harmless.

        If you’d like to test Vishal Gupta’s theory then temporarily disable the Logon and/or Cellular tasks for Provisioning in Task Scheduler at Task Scheduler Library | Microsoft | Windows | Management | Provisioning, or temporarily turn off these two Provisioning tasks using the PowerShell commands that Rick Corbett provided in post # 2483539, and see if that stops the creation of these empty tw-xxxx-xxxx-xxxxxx.tmp folders.  If that stops the creation of these empty folders then you can decide for yourself if you want to turn those Provisioning tasks back on or not.

        Win-10-Pro-v21H2-Task-Manager-Windows-Provisioning-ProvTool_exe-28-Sep-2022

        Getting back to your original problem, how often do new copies of DismHost.exe and other DISM files shown in your image in post # 2483354 appear in your hidden C:\Users\<username>\AppData\Local\Temp folder? The title of this topic implied these DISM files are created daily, but your post # 2484212 now suggests this only happened once and that you will monitor this hidden folder to see if it ever happens again. Is that correct?
        ————————-
        Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1772 * Macrium Reflect Free v8.0.6979

        Attachments:
    • #2484417

      Hmm, I do not see it as off topic. And your first parahragh is completely true and I think all agreed to previously. And when Logon runs is exactly the ame time as the folder with DISM is created, so something tied in there as well.

      I have already tested and proved. Unsure why that isn’t obvious?

      The DISM was there first time a week or 10 days ago. If I deleted it, granting ADMIN permission to, it would recreate the next Logon. Until yesterday when it stopped. For now. SO more than once, less than daily. If I did not delete, it would remain until I did. And recreate if I deleted. Until yesterday.

      So, as I said, I am watching to see if it comes back and if so if tied to an Edge update.

       

    • #2484442

      Further to EyesOnWindows’ post # 2483609, I did a Google search for “dismhost.exe appdata local temp” and found several similar reports about these DISM files being created in the hidden …AppData\Local\Temp folder. I didn’t go through all these threads but the majority suggest the DISM files can be created in C:Users\AppData\Local\Temp when a scheduled automated task fails to run. At first glance the most common cause seems to be because a scheduled Microsoft Defender scan failed to run…

      …And when Logon runs is exactly the ame time as the folder with DISM is created, so something tied in there as well…

      Hi rebop2020:

      Correlation does not always mean causation.

      There are several scheduled background tasks that can be triggered to run at a Windows logon, and if the Windows Provisioning (ProvTool.exe) Logon task is creating empty folders in C:\Windows\System32\config\systemprofile\AppData\Local at logon that doesn’t necessarily mean that this same task is responsible for creating DismHost.exe and other DISM files in C:\Users\<username>AppData\Local\Temp just because the folders have similar timestamps. I’m only suggesting that you shouldn’t link the two issues until you have more evidence.

      It’s still possible that the failure of some other background task created those DISM files in C:\Users\<username>\AppData\Local\Temp. For example, Task Scheduler shows I have a MS Edge task called MicrosoftEdgeUpdateTaskMachineCore that triggers MicrosoftEdgeUpdate.exe to run at the logon of any user. Note that the Last Run Result of both my MS Edge tasks shown below is 0x0 (i.e., operation completed successfully), even though I’ve disabled both “Startup Boost” and “Continue Running Background Extensions and Apps When Microsoft Edge is Closed” in my MS Edge browser at Settings | System and Performance | System to prevent MS Edge from running in the background after my MS Edge browser is closed (see the ghacks.net 04-Feb-2022 article Microsoft Edge May Be Running on Your Windows PCs, Even If You Don’t Use the Browser for more information about Startup Boost). That’s just one example of a scheduled task other than Windows Provisioning that can be triggered at logon.

      Win-10-Pro-v21H2-Task-Scheduler-MicrosoftEdgeUpdateTaskMachineCore-01-Oct-2022

      MS-Edge-v105_0_1343_53-Startup-Boost-and-Background-Apps-Disabled-01-Oct-2022
      —————-
      Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1772 * Macrium Reflect Free v8.0.6979

      Attachments:
      1 user thanked author for this post.
      • #2484459

        After Logon, it takes 17-22 minutes for the tw-*.tmp folders to be created. At EXACTLY the same time, the DISM was time stamped. Pretty big coincidence, no?

    • #2484447

      lmacri wrote:
      At first glance the most common cause seems to be because a scheduled Microsoft Defender scan failed to run…

      I don’t use defender which is disabled and no auto-update of EDGE..
      My laptop is on 24/7/365 so no logon… yet I have both DISM (empty folders) and tw- (empty folders) created.

    • #2485018

      Had same issue, seems may have been linked to a windows update, specifically being KB5017262. Had a client have this issue and I uninstalled this update and seems to have cleared up…. for now that is…. It has not produced the folders with the DSIMHOST.exe and DLLs in several hours now.

      • #2485081

        KB5017262 is the 2022-09 .NET Framework 3.5/4.8 Preview issued 9/22.

    • #2485083

      Interesting.

      FWIW, I logged in last night and it took 1 hour and 18 minutes for the TW-*.tmp files to appear. The LOGON  task did not run until then. And no DISM folder yet since that logon.

      I do not have KB5017262 installed on my computer.

    • #2485251

      OK, new DISM folder created yesterday. This time caused by: .NET Framework NGEN v4.0.30319 64 task. Cannot tell what this is doing as its a “custom handler” But down to the second.

      Ideas?

      • #2485321

        NGEN is a tool that improves the performance of managed applications. It compiles .NET apps to optimize them for your CPU.

    • #2485273

      Had same issue, seems may have been linked to a windows update, specifically being KB5017262. Had a client have this issue and I uninstalled this update and seems to have cleared up…. for now that is…. It has not produced the folders with the DSIMHOST.exe and DLLs in several hours now.

      This did not fix it sadly… checked on the PC this morning at over 1000 folders were created.

    • #2485322

      NGEN is a tool that improves the performance of managed applications. It compiles .NET apps to optimize them for your CPU.

      Thanks I read that. But it does not tell me what the TASK is doing or why this creates a folder with all DISM in the temp directory. That is what is curious.

    • #2495139

      New Dism folder created yesterday. Now two full copies in the temp directory. It was improving, but something now has it back. And takes admin rights to delete and I am an admin. So….going to watch this again to see what happens.

    • #2496063

      OK, more things running at unepected times creating or modifying the DISM folders in temp. Nirsoft (love them) have a free app called TaskSchedulerView that show exactly what was run at the moment that these files were last modified. Much more than I would have thought and some I think should not be running. I need to investigate further, but no time right now so thought I would throw this out there.

      tasks1
      tasks2
      I am starting to think it is NOT the .NET tasks creating this (maybe the .NET calls the others?) but for now (before investigation) I do not think that these should be running:

      DmClient
      MaintenanceTasks
      StorageSense
      WorkFoldersMaintenance
      StartComponentCleanup

      Maybe more.

      Thoughts?

       

       

       

      Attachments:
    • #2496079

      What makes you think they should not be running? They all could be part of the regularly run maintenance tasks. There is no telling what Microsoft has defined as a maintenance task.

      --Joe

      • #2496082

        Several things.

        Many were not running until recently. Things like DEFRAG (not in the list) should never be run on SSD. There are other reasons, but no time to go one by one right now. But there are many tasks that can and should be disabled.  Some of these might be in that group.

        • #2496084

          DEFRAG should be run on an SSD. On an SSD, it optimizes the free space and does not do a traditional defrag.

          Of course, it is your PC. If you choose to disable tasks go ahead but check them out and beware of side effects of not running them.

          --Joe

          • #2496087

            Of course. I disagre on DEFRAG on SSD. Trim yes, Defrag no.

            And I been around windows since 1.0. Seriously. So continually learning, but know my way around. When something starts creating DISM files in Temp, there is something new I may not wish to be running. I always check DISM MANUALLY when I need and do not let it automatically make changes. Master of my domain as much as I can be. But thanks for the warnings….

            • #2496092

              Defrag in Windows 10 & 11 does not defrag on an SSD. It uses the TRIM function to optimize the drive.

              --Joe

            • #2496281

              Defrag in Windows 10 & 11 does not defrag on an SSD

              Windows does defrag SSDs, but not in the same way as an HDD.
              Hanselman – Does Windows defragment your SSD?

              cheers, Paul

              1 user thanked author for this post.
            • #2496287

              Fascinating Paul. Thanks.

              The article is from 2014 but I think we can assume if anything optimize has become better.

              I have my SSD set to “OFF”. Says 829 days since last run. I think I shall run it. And Google (and otherwise search) to see more current thinking. But I did recall that as true for defrag but also recalled not a good idea and to run TRIM from the SSD’s manufacturer utility.

              So shall see what else I find.

            • #2496298

              Read enough to run Optimize. Took maybe 10 seconds to TRIM when run. BUT, it also deleted my restore point that had been working. I find it odd that TRIM would delete a restore point. The clue was gaining 6GB free space after running Optimize.

            • #2496093

              Of course. I disagre on DEFRAG on SSD. Trim yes, Defrag no.

              Windows will not “Defrag” a Solid State Drive (SSD).  It will retrim a SSD.  Windows Tools > Defrag and optimize drives recognizes SSD’s and only runs retrim.  On HDD’s only will it run defrag.

              Create a fresh drive image before making system changes/Windows updates, in case you need to start over!
              We all have our own reasons for doing the things that we do. We don't all have to do the same things.

    • #2496099

      Ok.

      Point of todays post is that much more than .Net and provisioning was running when the dism changes occur and I intend to learn more about each one and post.
      And I think you will find many sites at least suggesting tasks that either should not be tun (telemetry?) or should be options. So I’ll see what I can see tonight.

    • #2496240

      Most of these tasks are all ok and check out. There are some that are suggested to disable for telemetry issues.

      ProgramDataUpdater

      It is recommended to disable “\Microsoft\Windows\Application Experience\ProgramDataUpdater” as a scheduled task. (thi from Windows 7)
      http://windows.fyicenter.com/4688_ProgramDataUpdater_Scheduled_Task_on_Windows_7.html

      Martin Brinkman says turn off all User Experience. I thought I had. Hmm, still off in GPEDIT.

      Then says:

      You may stop it dead in its track using the Task Scheduler as well. Basically, what you can do is block the data collection and uploading right there.

      Tap on the Windows-key, type Task Scheduler, and hit the Enter-key. This opens the Windows Task Scheduler.
      Use the folder hierarchy on the left to go to the following folder: Task Scheduler Library > Microsoft > Windows > Autochk.
      The Proxy task there “collects and uploads autochck SQM data if opted-in to the Microsoft Customer Experience Improvement Program”.
      Right-click on Proxy and select Disable from the context menu.
      Go to Task Scheduler Library > Microsoft > Windows > Application Experience.
      Right-click on Microsoft Compatibility Appraiser, ProgramDataUpdater, and StartupAppTask, and disable them.

      Proxy: This task collects and uploads autochk SQM data if opted-in to the Microsoft Customer Experience Improvement Program.
      Microsoft Compatibility Appraiser: Collects program telemetry information if opted-in to the Microsoft Customer Experience Improvement Program.
      ProgramDataUpdater: Collects program telemetry information if opted-in to the Microsoft Customer Experience Improvement Program
      StartupAppTask: Scans startup entries and raises notification to the user if there are too many startup entries.

      These all enabled but it says IF opted-in to the Microsoft Customer Experience Improvement Program. So maybe does not need to be disabled? Or maybe does?

      So, all that being said, I still do not know for sure what task is creating and modifying the DISM file(s) or why. Or even if DISM is being run from those folders and when or why. It “seems” that each .NET update causes more to occur with these files in TEMP.

       

    • #2496241

      If you want to dig in and find out what is creating the folder see Process Monitor – Sysinternals | Microsoft Learn.

      --Joe

      • #2496285

        Interesting thought. I had thought that was realtime and I would have to know when to look, but perhaps not. Will check it out.

        UPDATE:

        Cannot figure out what to search for and it seems that could take hours to find. How would you suggest using this? I could search for the date and time, the folder name created then or…?

        • #2496376

          You need to set one or more filters. In the filter dialog use “Operation” and then select one of the file actions. You can add more than one filter.

          --Joe

          • #2496383

            Thanks. Nothing I tried brought up any results, much less what created the DISM folders.

    • #2496367

      It gets stranger!!

      OK, I mentioned that OPTIMIZE or TRIM deleted my restore point. I use them. When Windows does an Update it wipes out restore points and so I create one then.

      My points are usually MB’s to low GB’s – like maybe 4 or 5 GB. After the deletion early this AM, I created a one new and it was maybe 300 MB.

      I woke this morning, did my morning check on things and my SD drive was down 16 GB. How odd. Never varies that much. So I did a search for files created or modified in the last 8 hours and came up short. Nothing that would account for 16 GB less hard drive. So looked at Restore and yup, the point I created at 300 MB is now 16 GB. In fact, when I checked an hour later, it’s now 17 GB and growing.

      So, what is going on? Is the fact I turned OPTIMIZE ON causing this? Did trim make Restore think it is all new?

      I don’t know how to deal with this, but I should do something to take control.

      Plan at the moment is to work for a few hours, see where the restore point is, then maybe delete it and create a new one and monitor.

      Thoughts?????

    • #2496545

      I deleted the restore point, created a new one and it is behaving as expected. So my guess is a TRIM after not doing one for 3 years caused enough changes that RESTORE thought it needeed 17 GB to revert to before the TRIM. All I can figure. Hopefully at next month’s trim much less will change so smaller restore points and no alarms will go off making me wonder.

    • #2496554

      TRIM does not delete existing data.
      It is automatic when you have an SSD. Without it your writes would be very slow.

      cheers, Paul

      • #2496602

        Never said it did. But said it changed things so that RESTORE thought it was changed and needed to be backed up in a restore point. And only automatic if Optimize is enabled.

    • #2496630

      TRIM doesn’t change existing data either, it’s a clean-up process for data that has been deleted on an SSD.
      TRIM is enabled at all times on an SSD, nothing to do with optimize.

      cheers, Paul

    • #2496631

      OK.

      BUT – OPTIMIZE caused Restore to increase by 17GB. Undeniable. So something thought something was changed. And if optimize only does TRIM on SSD, what else could it be? And if TRIM is always on (can you cite that?) why would OPTIMIZE need to be used at all on an SSD?

    • #2496659

      Optimize is a clean up routine, so old restore points may be removed. It may run a TRIM after it has cleaned up to ensure the SSD is performing optimally.

      cheers, Paul

    • #2497091

      You need to set one or more filters. In the filter dialog use “Operation” and then select one of the file actions. You can add more than one filter.

      Nothing I tried brought up any results, much less what created the DISM folders.

      Some suggestions:

      1. You know the path so use that as a filter operator, for example:

      procmon_filter_for_path2

      2. You know the names of the files in the folder that’s created so use one of them as an additional filter operator, for example:

      procmon_filter_for_path3

      3. You know the folder is created at login so use Enable Boot Logging in the Options menu, otherwise the behaviour may have already occurred by the time you get ProcMon running:

      procmon_enable_boot_logging

      4. You know you’re looking for a process creating a folder, so turn off Show Registry Activity and Show Network Activity views to reduce unnecessary clutter. You only need Show File System Activity and Show Process and Thread Activity active:

      procmon_activity_views

      Note: I use ProcMon 3.50 as later versions all have bugs, even the latest. 🙁 However, the legends, positions and operations of the toolbar icons remains the same.

      Hope this helps…


      More info about ProcMon bugs:

      https://www.askwoody.com/forums/topic/sysinternals-suite-update/#post-2395671

      https://www.askwoody.com/forums/topic/system32-cmd-exe/#post-2378095

      https://learn.microsoft.com/en-us/answers/topics/windows-sysinternals-procmon.html

      Attachments:
    • #2497240

      Thanks Rick.

      First thing that jumps out from your suggestions is I DON’T know this is triggered by Logon. It might, but also might not. Some temp files (not the DISM) seem to have a 15 minute to 45 minute delay. But…

      The “begins with” was very helpful!

      The only thing turining up, without Boot Logging, is explorer.exe.

       

    • #2497498

      Middle of the afternoon yesterday both folders in temp with DISM were partially cleaned up. There was no logon!

      1

      I could not get procmon to uncover which of these caused that to happen. Both folder now hav just three or four files and not exactly the same files.

      Attachments:
    • #2497536

      CLUE: The DISM folders were created when this task ran: MicrosoftWindowsManagementProvisioning

      As @lmacri pointed out previously, that’s just an assumption. Maybe it’s time to test that assumption.

      ProvTool.exe is fired by a scheduled task run at logon, hence the need to ‘Enable Boot Logging’ in ProcMon. Rather than do all that hard work with ProcMon, why not just disable the Provisioning tasks, if only temporarily. to see what happens?

      To disable:

      1. *Right*-click on Start and select Windows PowerShell (Admin).

      2. When the PowerShell console opens, copy and paste the following line then press the Return/Enter key:

      Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Disable-ScheduledTask

      This will disable both the Logon and Cellular tasks, as this screenshot shows:

      provtool_task-disable

      3. Close the PowerShell console… ‘cos that’s it done. The change will take effect next time you restart or if you sign out/sign in to Windows.

      Then wait… see what happens to the creation of temporary files/DISM folders…

      In my experience over more than 2 years, disabling the Logon and Cellular tasks have not created any discernable issues. However, I don’t use any Store apps at all and remove all the pre-installed Windows 10 bloatware (using a PowerShell script whilst in Audit mode) so YMMV. Just keep an eye out for any issues with Store-delivered apps in case they don’t update.

      horizontal_line

      Note: To undo this change, use this:

      Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Enable-ScheduledTask

      This will re-enable both tasks, as this screenshot shows:

      provtool_task-enable

      Hope this helps…

       

      Attachments:
      2 users thanked author for this post.
      • #2497601

        Thanks for that Rick. But that was an old message you were replying to. The latest, which definitely did NOt run at logon, was above your post. So something in that image caused BOTH folders with DISM to clean themselves and like was the cause for creating them in the first place. Unless LOGON really does not mean logon as I havd not logged off in several days before this ran.

    • #2497574

      In my experience over more than 2 years, disabling the Logon and Cellular tasks have not created any discernible issues.

      Same here.

      In fact, I disabled all 4 of the tasks listed under\Microsoft\Windows\Management\Provisioning\ (Cellular, Login, Retry & RunOnReboot) back in March 2019 when I upgraded from Win7 to Win10 and have never experienced any problems!

      FYI, I also removed all the pre-installed Windows 10 bloatware using powershell like Rick Corbett but do use one store app (Nvidia Control Panel) because I have an Nvidia GeForce graphics card and the control panel is only available as a MS Store app.

    • #2497590

      I have an Nvidia GeForce graphics card and the control panel is only available as a MS Store app.

      I use Nvidia’s original drivers (no Microsoft store) and have Nvidia control panel.

      Attachments:
      • #2497592

        There’s no longer a “legacy” version of the control panel available for the newer drivers.

        If you update the driver (currently running v526.47), it removes the legacy version and replaces it with the new app version.

        2 users thanked author for this post.
        • #2497599

          I am running the latest Studio driver 522.30.

          • #2497605

            The download file for that version is 522.30-desktop-win10-win11-64bit-international-nsd-dch-whql.exe

            DCH (Declarative Componentized Hardware) uses the new MS Store app control panel while STD would be the old “legacy” style control panel.

            NVIDIA DCH/Standard Display Drivers for Windows 10 FAQ

            You can also tell the difference if you look at the actual location of the control panel program on your PC.

            The MS Store app version of the control panel is located at:

              C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_{VERSION#}\nvcplui.exe

            The Standard version of the control panel is located at:

              C:\Program Files\NVIDIA Corporation\Control Panel Client\nvcplui.exe

            BTW, there’s no “visible” difference between the two versions when you open it that indicates whether it’s DCH or STD.

            ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
            And that should be enough “off-topic” discussion for this thread!

            We need to get back to @rebop2020‘s original question of what’s causing all those DISM folders?

            3 users thanked author for this post.
            • #2497612

              Indeed.
              I have the Microsoft app store blocked but it seems the the driver installer accesses and downloads the control panel from the Microsoft store as part of the installation.

              Attachments:
    • #2497801

      Thanks for that Rick. But that was an old message you were replying to. The latest, which definitely did NOt run at logon, was above your post. So something in that image caused BOTH folders with DISM to clean themselves and like was the cause for creating them in the first place. Unless LOGON really does not mean logon as I havd not logged off in several days before this ran.

      Something is making changes within your %user%\Temp folder. So, whatever process it is should be detectable by ProcMon‘s monitoring of file system and process activity on that folder alone, whether it’s file/folder creation or deletion. If that something is not triggered by a logon process then I’m guessing another scheduled task has run or, as @lmacri has already mentioned earlier – a scheduled task has failed to run.

      Perhaps try Nir Sofer’s small, free, portable TaskSchedulerView (and start it using Run as administrator). I find it far more helpful than the built-in Task Scheduler because it shows the triggers assigned to each task and allows you to sort on multiple conditions. For your purposes I suspect sorting on the Last Run column may be what you are looking for but scroll across all the available columns to see what conditions are available for further examination.

      As for ProcMon not showing what you are looking for, delete ProcMon‘s current filter for Path contains DismHost.exe – include:

      procmon_filter_for_path3-1

      Hope this helps…

      Attachments:
      • #2497918

        Thanks Rick. I posted early on I am using Nirsoft and love it. All screen shots on the processes run are from TaskSchedulerView. Provide no clue WHICH of those trigerred the creation or modification of the DISM folders.

        ProcMon only shows Process Monitor 64 processes on the Temp folder.

        1-proc

        Attachments:
    • #2498073

      ProcMon only shows Process Monitor 64 processes on the Temp folder.

      Nope. Your screenshot quite clearly shows ALSys1064.sys masquerading as Process Monitor 64.exe and running from within your profile’s Temp folder. That is NOT Sysinternals/TechNet’s ProcMon.

      In ProcMon, open the Filter list (CTRL+L) and you’ll see that ProcMon processess – both 32-bit and 64-bit – are excluded from recording/display by default:

      procmon_default_exclusions

      A quick Google for ALSys1064.sys suggests you may be running something called Core Temp? If so, I note that its changelog shows no new version since version 1.17.1 – 11th April, 2021 and its FAQ – last updated over a year ago – makes no mention of file/folder creation in %user%\Temp nor in Bug Reports in its Support forum… so I don’t think this is related to your issue which apparently only started a week ago.

      Hope this helps…

      Attachments:
    • #2498108

      I do use Core Temp and have for maybe 10 years 🙂 this is not the problem. But I also am not seeing anything else there. It’s just too odd.

    • #2498207

      I do use Core Temp and have for maybe 10 years 🙂 this is not the problem. But I also am not seeing anything else there. Its just too odd.

      Apart from Core Temp, what else runs automatically from restart?

      But I also am not seeing anything else there.

      What? Where? Please be clearer.

    • #2498318

      Hey Rick,

      A few things run from start but this happened in the middle of the day, either the day after a start or long after a start. I do not see that related.

      And the “what” “where” is anything in procmon that shows what happened at the times of creation, deletion or pruning of the DISM folders in temp.

      Showing the task viewer of everything that happened in THAT moment of last creation/deletion is about as much information as I can think to produce. It always matches and “usually” these things do NOT happen at the moment of logon, but always delayed or not related to logon. Some tasks that say they run at logon are actually running 15-45 minutes after.

      So what more info can I possible provide?

      And a final thought for the morning: Most, if not all, of what runs at startup in terms of processes and apps have run like that for months if not years. Outlook, Core temp, Eset, etc. This all seems to have started at .NET or .netcore updates as best I can piece together.

    • #2498424

      According to this : https://www.thewindowsclub.com/what-are-tw-tmp-folders-in-system32

      There is a task, named Logon in the Task Scheduler which creates these empty folders in the C directory.

      Logon task : Microsoft\Windows\Management\Provisioning

      The command it runs at logon of is:

      %windir%\system32\ProvTool.exe /turn 5 /source LogonIdleTask
      ProvTool.exe is an executable exe file that belongs to the Provisioning package runtime processing tool process.

      Some users had found that the Logon task keeps creating these empty folders in the System32 folder. To get rid of this problem they disabled the Logon task in the Task Scheduler. After disabling the task, Windows had stopped creating these empty folders. Also, they had not experienced any issues with their systems after disabling the Logon task…

      https://www.askvg.com/fix-empty-tw-tmp-folders-in-system32-directory-in-windows-10-11/

    • #2498431

      This is true, Alex, but a totally different issue mentioned waaay above. Those are empty folders in a different directory and we all get them. Some have thousands. 19 created at each boot and never deleted. I wrote a batch file to delete them on login.

      The DISM FILES are in folders in a different temp directory and not related to the above.

      But thanks. One day I will find the culprit. Have not given up.

       

    • #2498776

      The DISM FILES are in folders in a different temp directory and not related to the above. But thanks. One day I will find the culprit. Have not given up.

      Back to ProcMon. Keep the Path filter:

      procmon_filter_for_path2-1

      Remove any other filters you’ve created then add 2 more like the screenshot below:

      procmon_filter_for_path4

      This will monitor your %user%\Temp folder and only show results when a new folder is created within.

      PS – Back in post #2496063 you queried StartComponentCleanup. That’s DISM.

      Hope this helps…

       

      Attachments:
    • #2498892

      Thanks Rick.

      Interesting on the StartComponentCleanup. That is in tasks, but does not run when the DISM folders are created. So not responsible for creating or purging the folders I believe, but it does run upon occasion at non related times.

      I have created the filter. Running it now shows nothing, even though a new folder was created yesterday. Do I have to have procmon running minimized or just open after I see a folder change? And the next thing this will do is DELETE some of the contents from the folder created yesterday. Likely a week or two until a new folder again.

       

       

       

    • #2498959

      Do I have to have procmon running minimized or just open after I see a folder change?

      ProcMon needs to be running (minimized) as it is monitoring in real-time for CreateFile (as folder) events.

      I don’t know of any method to look back to find the originating *process*, only which *account* created and/or modified a file/folder, i.e. who ‘owns’ it. As you aren’t creating the folder yourself then it’s probably going to be System or TrustedInstaller… but won’t tell you the process in use.

      Likely a week or two until a new folder again.

      I’m not sure that I understand you. The topic title is ‘NEW DISM folder created every day in User/Temp’ and your first post shows:

      If I delete it, it seems to be back with a new folder name the next day.

      Are you now saying the new DISM folder creation only occurs every week or two?

      The only other possibility I can think of is if the originating process writes an entry in one of the event logs. As there’s dozens of logs you would need the date and time the folder was created then create a PowerShell query to output the results of a search based on that criteria.

      I did a search for DISM using Nir Sofer’s FullEventLogView but with no results. I was hoping to see whether DISM writes CreateFile events.

      If you do get the time/date of the next created DISM folder then you could check the %windir%\Logs\DISM\dism.log to see if you get a match with a log entry… but that still wouldn’t give you the originating process which actually called DISM.

      (I checked the Component Based Servicing logs – %windir%\Logs\CBS\ – but couldn’t find any mention of DISM.)

      Sorry, but if ProcMon doesn’t show the originating process, then I’ve run out of ideas.

    • #2498993

      Hi Rick.

      Let me clarify as long thread an I updated but likely missed.

      IF I delete the folders created by using elevated permissions (even though I am admin) it will create a replacement likely the next day or two max. If I do not delete the folder, it creates a second folder maybe a week later. Then deletes all but a few of the 27 files in the original folder sometime thereafter. Maybe a week later  it prunes the second folder. They both seem to remain until I delete them again.

      Now, some of the times could be related to reboots which I only do once, maybe twice a week. So could be that rather than elapsed time.

      Again, started when I posted. Never before. Likely after a monthly Update (.net or .netcore?) . Then changed after the next monthly update most likely.

      I’ll try running procmon.

      I always have the date and time of creation of the folder. Matches images for running tasks I have posted above. To the seconds.

      Just opened the log file you cited. That time is copied into the text file attached.

       

      Attachments:
    • #2499014

      Just opened the log file you cited. That time is copied into the text file attached.

      Your %user%\Temp folder is mentioned twice in the log.

      The second instance (line 44) gives you a sub-folder name within of 86EA8E6E-D8A9-40C7-9606-81574783E753.

      The parent process (line 6) shows as C:\WINDOWS\system32\cleanmgr.exe. At a guess this is what’s deleting files in the folder, not what created the folder in the first place.

    • #2499015

      That is indeed the name of the current folder created at that time. Not sure what the log message is telling us.

       

    • #2499016

      And indeed, if it proves DISM is creating the folders, which is logical, what is calling DISM to do this now after years of not calling it?

    • #2499019

      That is indeed the name of the current folder created at that time. Not sure what the log message is telling us.

      And indeed, if it proves DISM is creating the folders, which is logical, what is calling DISM to do this now after years of not calling it?

      It appears to be a log that’s created at the same time as the pruning of the folder by cleanmgr.exe /autoclean /d C: 9 (line 6). The ‘last modified’ timestamp may be the same, i.e. 2022-11-16 15:30:27.

      From what I’ve read, this is Microsoft’s SilentCleanup but the /autoclean switch appears undocumented. However, this post mentions that SilentCleanup is a scheduled task and it creates a dism.log.

      SilentCleanup

      The description for SilentCleanup shows:

      Maintenance task used by the system to launch a silent automatic disk clean-up when free disk space is running low.

      This ties in with the task’s sole start condition (no triggers)… it’s Allow Demand Start, i.e. when needed. So, the initiating process is a maintenance check run just before… which in turn calls SilentCleanup.

      I guess it’s suddenly doing this because the free storage space has fallen below a default threshold and/or you’ve turned StorageSense on.

      Hope this helps…

      Attachments:
      2 users thanked author for this post.
    • #2499446

      Thanks Rick.

      I had noticed this previously:

      “Maintenance task used by the system to launch a silent automatic disk clean-up when free disk space is running low.”

      My C drive has 785 GB free, so I thought that would never run; and it didn’t until maybe two updates ago.

      I do not have StorageSense turned on.

      I had to stop running procmon with that filter, it was eating 60-65% of available memory.

      I’ll keep poking around.

      OK, this is interesting:

      Silent Cleanup: Maintenance task used by the system to launch a silent automatic disk clean-up when free disk space is running low. The operator or administrator has refused the request. 0x800710E0

    • #2499479

      I had to stop running procmon with that filter, it was eating 60-65% of available memory.

      Next time you use ProcMon for a long-running query, try using Drop Filtered Events.

      procmon_drop_filtered_events

      This will stop ProcMon exhausting your swapfile.

      (ProcMon‘s good… but it has a fairly steep learning curve.)

      Hope this helps…

      Attachments:
    • #2502341

      New uopdates in NMov to .net and .net core has this working a little differently now. It removes EVERYTHING but dismhost.exe from the exisiting folder and creates one new with ALL the dism files. I shall wait and see if that first folder is ever automatically deleted. I doubt it. but maybe.

      And I wonder what it is all looking to replace or restore.

    Viewing 67 reply threads
    Reply To: NEW DISM folder created every day in User/Temp

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: