From 5a08df43f05631ff0719c87a0f4905baacf38450 Mon Sep 17 00:00:00 2001 From: David Yoder Date: Sat, 19 Nov 2022 14:37:35 -0500 Subject: [PATCH] overhaul --- Cleanup-SystemTempFiles.ps1 | 291 +++++++++++++++++++++++++----------- 1 file changed, 201 insertions(+), 90 deletions(-) diff --git a/Cleanup-SystemTempFiles.ps1 b/Cleanup-SystemTempFiles.ps1 index 590482c..605e3e8 100644 --- a/Cleanup-SystemTempFiles.ps1 +++ b/Cleanup-SystemTempFiles.ps1 @@ -1,107 +1,118 @@ - +. "C:\Users\dyoder\Documents\Emberkom\Data\Projects\development\management-scripts\Tools.ps1" # When deleting temp files en masse, only delete files/folders older than the number of days specified here $OlderThan = 7 $TimeDelta = New-TimeSpan -Days $OlderThan -# Only run this section if we have administrative privileges -If ( IsAdmin ) -{ - LogMsg "Running with administrative privileges" +# Remove all *.evtx files from system temporary files location +$EventLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Filter *.evtx +If ( $EventLogs ) { + LogMsg "Deleting all event logs from ${Env:SystemRoot}\TEMP" + ForEach ( $EventLog in $EventLogs ) { Remove-Item $EventLog -Force -ErrorAction SilentlyContinue } +} - # Remove all *.evtx files from $SysTemp - $EventLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Filter *.evtx - If ( $EventLogs ) - { - LogMsg "Deleting all event logs from ${Env:SystemRoot}\TEMP" - ForEach ( $EventLog in $EventLogs ) { Remove-Item $EventLog -Force -ErrorAction SilentlyContinue } - } +# Remove misc logs and error reports +$MiscLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Include "${Env:COMPUTERNAME}-*.log", "AppxErrorReport_*.txt" +If ( $MiscLogs ) { + LogMsg "Deleting misc logs from ${Env:SystemRoot}\TEMP" + ForEach ( $MiscLog in $MiscLogs ) { Remove-Item $MiscLog -Force -ErrorAction SilentlyContinue } +} - # Remove misc logs and error reports - $MiscLogs = Get-ChildItem -Path "${Env:SystemRoot}\TEMP\*" -File -Include "${Env:COMPUTERNAME}-*.log", "AppxErrorReport_*.txt" - If ( $MiscLogs ) - { - LogMsg "Deleting misc logs from ${Env:SystemRoot}\TEMP" - ForEach ( $MiscLog in $MiscLogs ) { Remove-Item $MiscLog -Force -ErrorAction SilentlyContinue } - } - - # Remove archived CBS logs - $CBSLogs = Get-ChildItem -Path "${Env:SystemRoot}\Logs\CBS\*" -File -Include "CbsPersist_*.log", "CbsPersist_*.cab" - If ( $CBSLogs ) - { - $TotalBytes = 0 - ForEach ( $CBSLog in $CBSLogs) { $TotalBytes += $CBSLog.Length } - $TotalSize = $TotalBytes / 1MB - If ( $TotalSize -ge 200 ) { - LogMsg "Total CBS log archive size: ${TotalSize}MB" - Control-Service -Stop 'TrustedInstaller' - LogMsg "Deleting primary CBS.log file" - Remove-Item "${Env:SystemRoot}\Logs\CBS\CBS.log" -Force -ErrorAction SilentlyContinue } - Control-Service -Start 'TrustedInstaller' - } - LogMsg "Deleting archived CBS logs from ${Env:SystemRoot}\Logs\CBS" - ForEach ( $CBSLog in $CBSLogs ) { Remove-Item $CBSLog -Force -ErrorAction SilentlyContinue } - +# Remove archived CBS logs +$CBSLogs = Get-ChildItem -Path "${Env:SystemRoot}\Logs\CBS\*" -File -Include "CbsPersist_*.log", "CbsPersist_*.cab" +If ( $CBSLogs ) { + $TotalBytes = 0 + ForEach ( $CBSLog in $CBSLogs) { $TotalBytes += $CBSLog.Length } + $TotalSize = [math]::Round(($TotalBytes / 1MB),2) + If ( $TotalSize -ge 200 ) { + LogMsg "Total CBS log archive size: ${TotalSize}MB" + Control-Service -Stop 'TrustedInstaller' + LogMsg "Deleting primary CBS.log file" + Remove-Item "${Env:SystemRoot}\Logs\CBS\CBS.log" -Force -ErrorAction SilentlyContinue + Control-Service -Start 'TrustedInstaller' } + LogMsg "Deleting archived CBS logs from ${Env:SystemRoot}\Logs\CBS" + ForEach ( $CBSLog in $CBSLogs ) { Remove-Item $CBSLog -Force -ErrorAction SilentlyContinue } +} - # Remove all system temp files older than 7 days - $OldTempFiles = Get-ChildItem -Path "${Env:SystemRoot}\TEMP" | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) } - If ( $OldTempFiles ) - { - LogMsg "Deleting all temp files not modified in ${OlderThan} day(s) from ${Env:SystemRoot}\TEMP" - ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue } - } +# Remove all system temp files older than 7 days +$OldTempFiles = Get-ChildItem -Path "${Env:SystemRoot}\TEMP" | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) } +If ( $OldTempFiles ) { + LogMsg "Deleting all temp files not modified in ${OlderThan} day(s) from ${Env:SystemRoot}\TEMP" + ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue } +} - # Turn off system hibernation if it's in use - If ( Test-Path "${Env:SystemDrive}\hiberfil.sys" ) - { - LogMsg "Turning off system hibernation" - Try { Start-Process "powercfg" -ArgumentList "-h off" -Wait } - Catch { LogErr $_.Exception.Message } - } +# Remove all old files from the Recycle Bin +$RecycleBin = (New-Object -ComObject Shell.Application).NameSpace(0xa) +ForEach($file in $RecycleBin.Items()) { - # Remove PDCRevocation dump files - $PDCRevocationDumpFiles = Get-ChildItem -Path "${Env:SystemRoot}\LiveKernelReports\*" -File -Include "PDCRevocation-*.dmp" - If ( $PDCRevocationDumpFiles ) { - LogMsg "Deleting PDCRevocation dump files from ${Env:SystemRoot}\LiveKernelReports" - ForEach ( $PDCRevocationDump in $PDCRevocationDumpFiles ) { Remove-Item $PDCRevocationDump -Force -ErrorAction SilentlyContinue } - } + # Remove RTL and LTR marks from date string so it can be compared + $DateDeleted = $Recycler.GetDetailsOf($item,2) -replace "\u200f|\u200e","" - # Remove Genetec application crash dumps - If ( Test-Path "${Env:ProgramData}\Genetec\Dumps" ) { - $GenetecCrashDumps = Get-ChildItem -Path "${Env:ProgramData}\Genetec\Dumps" - If ( $GenetecCrashDumps ) - { - LogMsg "Deleting Genetec application crash dumps" - Try { ForEach ( $dump in $GenetecCrashDumps ) { Remove-Item $dump.FullName -Force -Recurse -ErrorAction SilentlyContinue } } - Catch { LogErr $_.Exception.Message } - } - } + # Make sure the item has expired + If( (Get-Date $DateDeleted) -lt ((Get-Date) - $TimeDelta)) { - # Remove AutoCAD temp files - If (-not (IsRunning -Name "acad") ) { - $AutoCADTempFiles = Get-ChildItem -Path "${Env:SystemDrive}\Users" | Where-Object { $_.PSIsContainer -eq $true } | ForEach-Object { Get-ChildItem -Path $($_.FullName + "\AppData\Local\Temp\*") -File -Include '*.ac$' -ErrorAction SilentlyContinue } - If ( $AutoCADTempFiles ) { - LogMsg "Deleting AutoCAD temp files for all users" - ForEach ( $tempfile in $AutoCADTempFiles ) { Remove-Item $tempfile -Force -ErrorAction SilentlyContinue } - } + # Delete the item + $path = $file.Path + Write-Output "Deleting expired Recycle Bin item: ""${path}""" + Try { Remove-Item -Path $path -Force -Recurse } + Catch { Write-Error $_.Exception.Message } } +} - # Silently run cleanmgr.exe with default settings - LogMsg "Running cleanmgr.exe with default settings" - Try { Start-Process "cleanmgr.exe" -ArgumentList "/VERYLOWDISK" } +# Turn off system hibernation if it's in use +If ( Test-Path "${Env:SystemDrive}\hiberfil.sys" ) { + LogMsg "Turning off system hibernation" + Try { Start-Process "powercfg" -ArgumentList "-h off" -Wait } Catch { LogErr $_.Exception.Message } } -# Only run this section if we don't have administrative privileges -Else -{ - LogMsg "Running without administrative privileges" +# Remove PDCRevocation dump files +$PDCRevocationDumpFiles = Get-ChildItem -Path "${Env:SystemRoot}\LiveKernelReports\*" -File -Include "PDCRevocation-*.dmp" +If ( $PDCRevocationDumpFiles ) { + LogMsg "Deleting PDCRevocation dump files from ${Env:SystemRoot}\LiveKernelReports" + ForEach ( $PDCRevocationDump in $PDCRevocationDumpFiles ) { Remove-Item $PDCRevocationDump -Force -ErrorAction SilentlyContinue } +} - # Remove all system temp files older than 7 days - $OldTempFiles = Get-ChildItem -Path $Env:TEMP | Where { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) } - If ( $OldTempFiles ) +# Remove Genetec application crash dumps +If ( Test-Path "${Env:ProgramData}\Genetec\Dumps" ) { + $GenetecCrashDumps = Get-ChildItem -Path "${Env:ProgramData}\Genetec\Dumps" + If ( $GenetecCrashDumps ) { - LogMsg "Deleting all temp files not modified in ${OlderThan} day(s) from ${Env:TEMP}" + LogMsg "Deleting Genetec application crash dumps" + Try { ForEach ( $dump in $GenetecCrashDumps ) { Remove-Item $dump.FullName -Force -Recurse -ErrorAction SilentlyContinue } } + Catch { LogErr $_.Exception.Message } + } +} + +# Defragment Windows Elastic Search database +$ESDB = "${Env:ProgramData}\Microsoft\Search\Data\Applications\Windows\Windows.edb" +If ( Test-Path $ESDB ) { + Try { + LogMsg "Found Windows Elastic Search database: ""${ESDB}""" + LogMsg " - Disabling Windows Search service" + Start-Process "sc.exe" -ArgumentList "config wsearch start= disabled" -Wait + LogMsg " - Stopping Windows Search Service" + Start-Process "net.exe" -ArgumentList "stop wsearch" -Wait + LogMsg " - Defragmenting database file" + Start-Process "esentutl.exe" -ArgumentList "/d ""${ESDB}""" -Wait + LogMsg " - Enabling Windows Search Service" + Start-Process "sc.exe" -ArgumentList "config wsearch start= delayed-auto" -Wait + LogMsg " - Starting Windows Search Service" + Start-Process "net.exe" -ArgumentList "start wsearch" -Wait + } + Catch { LogErr $_.Exception.Message } + +} + +# TODO: Evaluate system restore points and delete them if they take up too much space + +# Remove files from user profile directories +ForEach ( $userProfile in $(EnumUserProfiles) ) { + + # Remove all user temp files older than 7 days + $OldTempFiles = Get-ChildItem -Path "${userProfile}\AppData\Local\Temp" -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) } + If ( $OldTempFiles ) { + LogMsg "Deleting all temp files not modified in ${OlderThan} day(s) from ""${userProfile}\AppData\Local\Temp""" ForEach ( $OldTempFile in $OldTempFiles ) { Remove-Item $OldTempFile -Force -Recurse -ErrorAction SilentlyContinue } } @@ -110,12 +121,112 @@ Else $AutoCADTempFiles = Get-ChildItem -Path "${Env:TEMP}\*" -File -Include '*.ac$' -ErrorAction SilentlyContinue If ( $AutoCADTempFiles ) { LogMsg "Deleting AutoCAD temp files" - ForEach ( $tempfile in $AutoCADTempFiles ) { Remove-Item $tempfile -Force -ErrorAction SilentlyContinue } + ForEach ( $tempfile in $AutoCADTempFiles ) { + Try { Remove-Item $tempfile -Force -ErrorAction SilentlyContinue } + Catch { LogErr $_.Exception.Message } + } + } + } + + # Apple iTunes data + If (-not (IsRunning -Name 'itunes') ) { + + # Remove Apple software updates downloaded from iTunes + $IPSWBasePath = "${userProfile}\AppData\Roaming\Apple Computer\iTunes" + $IPSW = @() + # iPhone update files + ForEach ( $updateFile in $(Get-ChildItem -Path "${IPSWBasePath}\iPhone Software Updates\*" -File -Include '*.ipsw' -ErrorAction SilentlyContinue) ) { + $IPSW += ,@($updateFile.FullName) + } + # iPad update files + ForEach ( $updateFile in $(Get-ChildItem -Path "${IPSWBasePath}\iPad Software Updates\*" -File -Include '*.ipsw' -ErrorAction SilentlyContinue) ) { + $IPSW += ,@($updateFile.FullName) + } + # iPod update files + ForEach ( $updateFile in $(Get-ChildItem -Path "${IPSWBasePath}\iPod Software Updates\*" -File -Include '*.ipsw' -ErrorAction SilentlyContinue) ) { + $IPSW += ,@($updateFile.FullName) + } + + # Remove Apple mobile applications downloaded from iTunes + $IPA = @() + ForEach ( $mobileApp in $(Get-ChildItem -Path "${userProfile}\Music\iTunes\iTunes Media\Mobile Applications\*" -File -Include '*.ipa' -ErrorAction SilentlyContinue) ) { + $IPA += ,@($updateFile.FullName) + } + + If ( $IPSW ) { + LogMsg "Found Apple software update files" + ForEach ( $path in $IPSW ) { + LogMsg " - Deleting: ""${path}""" + Try { Remove-Item -Path $path -Force -ErrorAction SilentlyContinue } + Catch { LogErr $_.Exception.Message } + } + } + + If ( $IPA ) { + LogMsg "Found Apple mobile application files" + ForEach ( $path in $IPA ) { + LogMsg " - Deleting: ""${path}""" + Try { Remove-Item -Path $path -Force -ErrorAction SilentlyContinue } + Catch { LogErr $_.Exception.Message } + } + } + } + + # Remove old downloaded application files + $OldDownloadedApps = (Get-ChildItem -Path "${userProfile}\Downloads\*" -File -Filter '*.exe' -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -lt ((Get-Date) - $TimeDelta) }) + If ( $OldDownloadedApps ) { + LogMsg "Deleting old downloaded app files" + ForEach ( $oldDownloadedApp in $OldDownloadedApps ) { + $path = $oldDownloadedApp.FullName + LogMsg " - Deleting: ""${path}""" + Try { Remove-Item -Path $path -Force -ErrorAction SilentlyContinue } + Catch { LogErr $_.Exception.Message } + } + } + + + # Remove duplicate downloads + # Separate the possible duplicates from the rest + $PossibleDuplicates = @() + $NotDuplicates = @() + ForEach ( $file in (Get-ChildItem -Path "${userProfile}\Downloads\*" -File -ErrorAction SilentlyContinue) ) { + If ( $file.BaseName -match '\s\(\d*\)$' ) { + $PossibleDuplicates += ,@($file) + } Else { + $NotDuplicates += ,@($file) + } + } + # Loop through all files + ForEach ( $pd in $PossibleDuplicates ) { + ForEach ( $nd in $NotDuplicates ) { + + # Match the first part of $pd to $nd + If ( [regex]::Match($pd.BaseName,'^(.*)(\s\(\d*\))$').Groups[1].Value -eq $nd.BaseName ) { + + # Check for equal file size + If ( $(Get-Item -Path $pd.FullName).Length -eq $(Get-Item -Path $nd.FullName).Length ) { + + # Make sure the file still exists before writing any log messages + $ToDelete = $pd.FullName + If ( Test-Path $ToDelete ) { + + # Delete the duplicate file + LogMsg "Deleting duplicate download: ""$ToDelete""" + Try { Remove-Item -Path $ToDelete -Force -ErrorAction SilentlyContinue } + Catch { LogErr $_.Exception.Message } + } + } + } } } - # Silently run cleanmgr.exe with default settings - LogMsg "Running cleanmgr.exe with default settings" - Try { Start-Process "cleanmgr.exe" -ArgumentList "/VERYLOWDISK" } - Catch { LogErr $_.Exception.Message } } + +# Silently run cleanmgr.exe with default settings +# TODO: This does not run silently - commenting out for now! +#Try { +# LogMsg "Running cleanmgr.exe with default settings for very low disk space" +# Start-Process "cleanmgr.exe" -ArgumentList "/VERYLOWDISK" +# LogMsg " - Finished" +#} +#Catch { LogErr $_.Exception.Message } \ No newline at end of file