Windows 10 / 11 post WU installation cleanup script

johnlgalt · Oct 1, 2024

jessewilliams56 said:
I was directed in one of my forum help posts to run this script. Can anyone tell me what it does? Either I am out of the loop, or I missed what the script is supposed to do.

Thanks, Jesse

antspants said:
It basically just runs these commands but automated and in succession, Jesse.

/drivers/maxclean
dism /Online /Cleanup-Image /CheckHealh
sfc /scannow
dism /Online /Cleanup-Image /RestoreHealth
dism /online /Cleanup-Image /Startcomponentcleanup /resetbase

So, to clarify a little more, the script I have linked in the first post is my attempt to collate all of the usual steps many of use power, pro and expert users here at Eleven FOrum (11F) use to help clean up our systems after a major update to Windows, specifically those line items that @antspants mentions. I did a lot of research and evaluated various ways to make the script more automated, and settled on a way that the batch file run and automatically elevated its own privileges so the commands can be run without unnecessary (and repeated) UAC elevation prompts, or potentially failing because of a lack of elevation in the first place.

In post #47 (<-- clickable link) above, though, I link to a utility that can run all of these commands with a bit more clarity, giving a small explanation of each, and while less automated than my script, it is, I feel, the superior approach to accomplishing these same steps that my script does, partially because of the independent windows with respective command output, as well as the ability to run other commands that are not included in the script that I compiled.

jimminy said:
Your approach is probably the best way!

I removed another app called web experience something or other. It apparently controls the widget stuff which I don't use. Bofore the day was out, I noticed that windows had re-installed it.

I'm beginning to think this particular minion function really isn't useful.

I suppose it depends on the approach - but removing pre-installed Windows app does require a bit of research. As Garlin noted in post #54 above, one such example is one app the was renamed and a new app that was added using the old name lol. Whereas the old app was removable, the newer one is not, and you noted that it still showed up even after you tagged it for removal - quite possibly because Stefan's utility was still trying to remove the old one versus the new one.

I've played around in the part with removing things, but I've found that simply disabling most of them suffices for me, and it's a lot less hassle in the long run, particularly when

1. I tend to cleanly install Windows 2-3 times a year, and
2. Windows can pull things like the above-noted app rename and replace, potentially rendering pre-written scripts (at least partially) useless, unless you are made aware of such changes in newer builds and adjust accordingly.

It's already so much of a headache to maintain such a script because of that second point, and since I run multiple VMs of various Windows 10 and Windows 11 versions, I've resorted to using Stefan's utility for everything my script can do and basically nothing else.

Almighty1 · Oct 4, 2024

Just some input about the script:

1) rundll32.exe pnpclean.dll,RunDLL_PnpClean /drivers/maxclean
which when I did a search to figure out what it does before reading beyond the post #1, it can have bad consequences as seen here:

Redirecting

2) dism /online /Cleanup-Image /Startcomponentcleanup /resetbase

A few days ago when I had the Error 6824, I was reading about /resetbase and according to post #2 in this thread:

Dism /online /Cleanup-Image /StartComponentCleanup /ResetBase not working

Tried to cleanup my component store but the command isn't working. Any suggestions? https://www.elevenforum.com/t/analyze-and-clean-up-component-store-winsxs-folder-in-windows-11.7597/

www.elevenforum.com

/resetbase has been disabled and it does more harm than good but /resetbase is ignored regardless.
Comment #26 in the current thread actually tells what /resetbase does in the "Warning" section.

Almighty1 · Oct 4, 2024

Burgurne said:
I downloaded your script, but at this line in the script, dism /online /Cleanup-Image /Startcomponentcleanup /resetbase, I get this error at 23%:
Error: 6824 - The operation cannot be performed because another transaction depends on this property not changing.
What to do??

That has nothing to do with the script or the build of Windows you are running as others had mentioned when responding to you and also, /resetbase has nothing to do with it as it's ignored and disabled by Windows .

I had the same issue two days ago and the solution is mentioned in my post here with full credits to @Bree who along with others experienced the same problem over a year ago:

KB5043166 Windows 11 Insider Beta build 22635.4291 (23H2) - Sept. 30

UPDATE 10/04: https://www.elevenforum.com/t/kb5044386-windows-11-insider-beta-build-22635-4300-23h2-oct-4.29168/ Windows Blogs: Hello Windows Insiders, today we are releasing Windows 11 Insider Preview Build 22635.4291 (KB5043166) to the Beta Channel. Changes in Beta Channel builds and updates...

www.elevenforum.com

MultiDoc · Jan 19, 2025

Is it a good idea/recommended to run this after the update to 24H2 from 23H2 ? And if it is, should I be running all of the commands or ?

johnlgalt · Jan 23, 2025

MultiDoc said:
Is it a good idea/recommended to run this after the update to 24H2 from 23H2 ? And if it is, should I be running all of the commands or ?

I run Virtual Machines of numerous Windows 11 builds, mostly the various Insider Preview builds, but I do have one bone stock Windows 11 23H2 VM and another Windows 11 24H2 bone stock VM.

I run this script (mainly through the app I mentioned in post #47) on all of them. it's caught a few issues here and there along the way, early on, so for that reason alone I highly suggest doing this every time there is a massive update like changing the build version (23H2 --> 24H2) but even when there are simple build version changes (26100.2859 --> 26100.3025, as an example).

So, long story short - yes, it is always worth it to run these steps. I even run them on my main machine that is running 24H2.

Since you're asking specifically for the major update, it really is worth your while to run all of the steps.

@Almighty1 mentions a few posts up that the driver cleaning might cause issues, and resetbase has been ... relegated to being ignored.

So, these are the commands you'll want.

Batch:

dism /Online /Cleanup-Image /CheckHealth
dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Technically, you don't even need to run the first one, so these two should be good enough:

Batch:

dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow

antspants · May 16, 2025

In what order do members here use these?

scanhealth
CheckHealth
RestoreHealth

AnalyzeComponentStore
StartComponentCleanup
Startcomponentcleanup /resetbase

It’s annoying to me that there are so many opinions on the web that conflict. depending on who or what you’re reading.

I've been playing with the original script in post one.
Should any of the commands I have asked to be excluded, not have been excluded (skipped)?

The script I have created is as follows:

If DISM ScanHealth found no errors. CheckHealth and RestoreHealth will be skipped with Popup notification.

If AnalyzeComponentStore found no issues. StartComponentCleanup and resetbase will be skipped with Popup notification.

Filtered output – only meaningful results from each command will be saved in the log file, instead of entire execution logs.

Script runs properly – added error checking while ensuring steps don’t stop execution when skipping sections.

Log file auto-opens in Notepad at the end of script process for easy review.

Batch:

:: Elevation script from StackOverflow :: https://stackoverflow.com/a/28467343
:: Begin Elevation script
@ECHO OFF
setlocal EnableDelayedExpansion
set "logfile=%temp%\cleanup_log.txt"
echo Cleanup Process Log > "%logfile%"
echo =================== >> "%logfile%"

:: net file to test privileges
NET FILE 1>NUL 2>NUL
if '%errorlevel%' == '0' ( goto START ) else ( goto getPrivileges )

:getPrivileges
if '%1'=='ELEV' ( goto START )

set "batchPath=%~f0"
set "batchArgs=ELEV"

:: Add quotes to the batch path, if needed
set "script=%0"
set script=%script:"=%
IF '%0'=='!script!' ( GOTO PathQuotesDone )
    set "batchPath=""%batchPath%"""
:PathQuotesDone

:: Add quotes to the arguments, if needed
:ArgLoop
IF '%1'=='' ( GOTO EndArgLoop ) else ( GOTO AddArg )
    :AddArg
    set "arg=%1"
    set arg=%arg:"=%
    IF '%1'=='!arg!' ( GOTO NoQuotes )
        set "batchArgs=%batchArgs% "%1""
        GOTO QuotesDone
        :NoQuotes
        set "batchArgs=%batchArgs% %1"
    :QuotesDone
    shift
    GOTO ArgLoop
:EndArgLoop

:: Create and run the VB script to elevate the batch file
ECHO Set UAC = CreateObject^("Shell.Application"^) > "%temp%\OEgetPrivileges.vbs"
ECHO UAC.ShellExecute "cmd", "/c ""!batchPath! !batchArgs!""", "", "runas", 1 >> "%temp%\OEgetPrivileges.vbs"
"%temp%\OEgetPrivileges.vbs"
exit /B

:START
:: Remove the elevation tag and set the correct working directory
IF '%1'=='ELEV' ( shift /1 )
cd /d %~dp0

:: Cleanup script

echo Running PnpClean... >> "%logfile%"
start /B /wait rundll32.exe pnpclean.dll,RunDLL_PnpClean /drivers/maxclean | find /i "completed" >> "%logfile%"

echo Running DISM ScanHealth... >> "%logfile%"
start /B /wait dism /online /cleanup-image /scanhealth | find /i "completed successfully" >> "%logfile%"

:: Check ScanHealth results before proceeding
IF %ERRORLEVEL% NEQ 0 (
    echo Errors found! Running further checks... >> "%logfile%"
    start /B /wait dism /Online /Cleanup-Image /CheckHealth | find /i "corruption detected" >> "%logfile%"
    start /B /wait dism /Online /Cleanup-Image /RestoreHealth | find /i "completed successfully" >> "%logfile%"
) ELSE (
    echo No errors found. Skipping CheckHealth and RestoreHealth. >> "%logfile%"
    msg * "DISM ScanHealth found no errors. CheckHealth and RestoreHealth have been skipped."
)

:: Continue execution
echo Running SFC Scan... >> "%logfile%"
start /B /wait sfc /scannow | find /i "did not find any integrity violations" >> "%logfile%"

echo Running Component Store Analysis... >> "%logfile%"
start /B /wait Dism /Online /Cleanup-Image /AnalyzeComponentStore | find /i "recommend you clean up" >> "%logfile%"

:: Check AnalyzeComponentStore results before proceeding
IF %ERRORLEVEL% NEQ 0 (
    echo Component store cleanup is required. Running cleanup... >> "%logfile%"
    start /B /wait DISM /online /Cleanup-Image /StartComponentCleanup | find /i "completed successfully" >> "%logfile%"
    start /B /wait dism /online /Cleanup-Image /Startcomponentcleanup /resetbase | find /i "completed successfully" >> "%logfile%"
) ELSE (
    echo Component store is healthy. Skipping StartComponentCleanup and resetbase. >> "%logfile%"
    msg * "AnalyzeComponentStore found no issues. StartComponentCleanup and resetbase have been skipped."
)

:: Ensure script execution continues
echo Cleanup process completed successfully. >> "%logfile%"
echo Opening log file... >> "%logfile%"

:: Open log file in Notepad
start notepad "%logfile%"

pause

The output log file needs work.

antspants · May 16, 2025

Also, it no longer executes without prompt for permissions, which is annoying. (Elevation script)

pseymour · May 16, 2025

antspants said:
If DISM ScanHealth found no errors. CheckHealth and RestoreHealth will be skipped with Popup message

I setup something similar to this for Intune environments (cloud-based device management tool from MSFT).

CheckHealth is very fast, because it merely checks to see if the image has already been flagged as unhealthy by some other process. CheckHealth doesn't do any scanning on its own. So, I run CheckHealth first. If CheckHealth already knows there's corruption, then I can go straight to RestoreHealth.

If CheckHealth doesn't report corruption, well, there still may be corruption, so then I run a ScanHealth. If ScanHealth says corruption, then I RestoreHealth.

Now admittedly, the reason it's done this way for Intune is for reporting. I can see which machines had no issues, and which machines had issues, and which of those were successfully repaired. On a home PC, you probably don't care about that; just fix the problem.

antspants · May 16, 2025

pseymour said:
I setup something similar to this for Intune environments (cloud-based device management tool from MSFT).

CheckHealth is very fast, because it merely checks to see if the image has already been flagged as unhealthy by some other process. CheckHealth doesn't do any scanning on its own. So, I run CheckHealth first. If CheckHealth already knows there's corruption, then I can go straight to RestoreHealth.

If CheckHealth doesn't report corruption, well, there still may be corruption, so then I run a ScanHealth. If ScanHealth says corruption, then I RestoreHealth.

Now admittedly, the reason it's done this way for Intune is for reporting. I can see which machines had no issues, and which machines had issues, and which of those were successfully repaired. On a home PC, you probably don't care about that; just fix the problem.

Good to know and very helpful, thank you

Will adjust my script, slowly.

I actually just now created a GitHub Ai account. I am interested in seeing how it works

garlin · May 16, 2025

A common mistake is DO NOT RUN DISM /ResetBase unless you're confident the latest installed Monthly Update is stable. The reason there's "leftover" files is to allow Windows to roll back a bad update without restoring your PC from a previous backup. Once you run /ResetBase, you can be stuck with a broken Windows until (hopefully) MS fixes the problem in a future update.

A repair reinstall won't fix it because you need to install a lower build of Windows to undo the last update, and a newer build on disk voids the repair.

This should never be an "automatic" task except on a brand new Windows install. If you're in a habit of manually controlling when WU is allowed to install updates, and have a good idea of how long it takes to discover new problems, then it's safe to use. Otherwise, don't do it right after the Monthly Update is installed.

antspants · May 16, 2025

garlin said:
A common mistake is DO NOT RUN DISM /ResetBase unless you're confident the latest installed Monthly Update is stable.

Thanks, I did wonder about that.
Having said that, I am pretty diligent with my backup images.

jimminy · May 16, 2025

garlin said:
A common mistake is DO NOT RUN DISM /ResetBase unless you're confident the latest installed Monthly Update is stable. The reason there's "leftover" files is to allow Windows to roll back a bad update without restoring your PC from a previous backup. Once you run /ResetBase, you can be stuck with a broken Windows until (hopefully) MS fixes the problem in a future update.

I thought the reset base option was disabled in recent windows versions so that it runs the same as a plain cleanup command.

I think I remember seeing that in the registry too, but it's been a long time.

garlin · May 16, 2025

That's true, /ResetBase is cheating. In many cases, it's actually delta compressing the older files and not fully removing them. This is done to preserve full WinSxS compatibility with any future Updates you may want to install. There's a balance of recovering more space vs. the risk of breaking Windows.

Yes, you can use the two known reg keys and fully remove more superseded components, but that should be reserved for very experienced users since it can break DISM.

gunrunnerjohn · May 17, 2025

I think I'll stick to the basic repair options.

I do like the idea of CheckHealth first to save time.

Windows 10 / 11 post WU installation cleanup script

Attachments

Antidisestablishmentarianist

My Computers

Well-known member

My Computer

Well-known member

My Computer

Member

My Computers

Antidisestablishmentarianist

My Computers

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

pondering the downside of upgrading

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers