NEW DISM folder created every day in User/Temp

Topic

New Reply

[rebop2020]

This started maybe a week ago. Before any Windows Updates for September. Only thing was EDGE updates. Nothing else I can tell.

A folder is created in User/Temp that contains all of DISM. If I try to delete it, it says requires Administrator Permiossions. I am the admin. If I click continue, it deletes. Then needs permission again to clear the recycle bin.

If I delete it, it seems to be back with a new folder name the next day.

What? Why?

Its pretty new. so wondering what this is all about.

Thanks.

 

PS. MOST files dated 5/5/2021 under a folder dated today.

• This topic was modified 2 years, 5 months ago by rebop2020.

Reply | Quote

Replies

Finding others with the issue. Some say related to Windows Defender not being able to run (I have ESET – so maybe).

Reading results of searching and finding more than expected on this. For example:

https://www.bleepingcomputer.com/forums/t/604648/dlls-muis-dismhostexe-re-appearing-in-temp-folder/

Will let you know what I find.

Reply | Quote

SFC and DISM scans clean.

Reply | Quote

CLUE:

The DISM folders were created when this task ran:

\Microsoft\Windows\Management\Provisioning

What is that? About to Google.

Reply | Quote

It seems unlikely it’s Goggle (how did you arrive at that?) or Windows defender, As I too have the folder, any my machine is so vanilla Chrome is now the only extra program on it bar some drivers which came through Microsoft anyway..

It looks as if they’re actually trying to service the DISM tool and failing? (unless it’s the “new kid on the block” (https://www.bleepingcomputer.com/news/security/new-chaos-malware-infects-windows-linux-devices-for-ddos-attacks/) and they need to place the entire subsystem to get a DLL exploit to work..)

That said Windows update is unusually busy for the “up to date” state despite the optional KB5017380 being the only offer.. and the application servicing is going like crazy (see attached ) so that might explain – DISM would be needing to update the catalogue to successfully work with the changes.. so I’m putting that down to MS fixing their problems without bragging about what we were open to.. and yes, edge is on the list at the top..

Reply | Quote

Nooo, I was about to Google MicrosoftWindowsManagementProvisioning creates DISM folder. Not that Google is the issue. This is within seconds of the folder being created. And runs only at login. But also only started in the last week(s).

Exactly what folder do you have? I have (and the folder name changes each time):

I do not believe at all Windows Update caused this. Happened before Sept Updates. Edge updates, maybe.

 

Reply | Quote

At a glance that’s the folder I have. I fact its quite  amess as the processes aren’t deleting them – so I have a bunch of them with the same content. Mine aren’t being cleared out or deleted but it might not have to around to it yet.

It could be my install as one thing I have done is used DISM to massacre a lot of the cr@p which comes in the box to aid in getting a large product onto a small SSD. I also occasionally use the /resetbase switch (as well as the usual measures with DISM to generally remove the update trash which storage seems to love to cling to) to ditch all the old versions of everything to help maintain the space I have..

I don’t have a problem and I’m making the case that the effect described in this post doesn’t represent a problem beyond that MS can’t be bothered to tidy up the mess as they so along, preferring to get the cleaning lady in once a month to clear it out.. (unless like me you’ve turned off storage because you actually store things in your download folder for a reason.. have you?)

I guess the way to tell would be to disable the what was the content delivery service – that’s been gone a while, by description it might be delivery optimisation now? That was harder than it should have been (when I went there back at 1809). If the effect disappears it’d prove the point but I wouldn’t try to hard to prove it, or leave that service off long term (as you might want edge  to update).

As I have to manually kick Chrome to get it to update, I just did that and it did. No extra folders appeared so I still doubt that’s a cause of the issue (now got 105.0.5195.127 should anyone want to know!). I also have the empty folders with an En-US within. I’m quite happy to completely ignore the extra folders, and I’ll clean them out myself when Windows starts to complain about space (as I followed SB’s post so already have the recovery media downloaded..) and I think others here have completely vindicated the reasoning as well..

As to the “I haven’t got a temp folder” post – what happens shortly after you type

cmd /c start %temp%

in your run box and click the Ok button there?? I guess you could delete the system variable but I’d also guess that might cause some strange behaviour..

 

 

 

Reply | Quote

Also unsure how your image pertains to this issue, oldguy??

Reply | Quote

Interesting. I don’t have a TEMP folder under my user.

Windows 10 21H2 Sept. updates.
Defender disabled. Updating Edge manually.
I have a DISM folder in system32

Reply | Quote

You have two types of Microsoft Store apps:

• User
• Provisioned

Microsoft Store Provisioned apps are what you could best call master apps: every user on your computer gets them. What I suspect has been updating are your Microsoft Store apps. Go to the Microsoft Store Library and see what and when which apps were updated. These apps update whenever they want to update. (This is a conjecture based upon what I know of provisioned and user apps and admittedly limited.)

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

I do not believe that is it. I have only one MStore app and I have MStore set to not update anything. The only thing not under that control is Edge. Which updates from other methods. Wish it would not, but it does.

Actually there are more than I expected and some I never asked for. But nothing recent and set not to update by itself.

 

Reply | Quote

Alex5723 wrote:

Interesting. I don’t have a TEMP folder under my user.

Windows 10 21H2 Sept. updates.
Defender disabled. Updating Edge manually.
I have a DISM folder in system32

Alex, I would be amazed if you truly do not:

C:\Users\YOURNAME\AppData\Local\Temp

Please check. Might be a system file, so be sure you are showing them.

 

The other DISM folder is where it should be. Which is why a newly created one here is such a mystery.

Still researching in my spare time.

Reply | Quote

rebop2020 wrote:

A folder is created in User/Temp

That’s not under your User (C:\Users\your ID\Temp.
Be specific and correct when you list the path.

Reply | Quote

Hi rebop2020:

There is a Microsoft support article at How Provisioning Works in Windows but I’m not sure it would have any useful information unless you’re a software developer.

I checked my automated provisioning tasks in Task Scheduler (Task Scheduler Library | Microsoft | Windows | Management | Provisioning) and the last time the Logon task triggered ProvTool.exe was today (28-Sep-2022) @ 8:35:27 AM, which is about 3 hours after I powered on my system and first logged into Windows. However, it looks like that task failed to run today (i.e., Last Run Result = 0x80070428).

I searched my hidden C:\Users\<myusername>\AppData\Local\Temp folder for dism*.*, *.dll and *.exe and couldn’t find any files with those names or extensions, so I don’t appear to have DismHost.exe or any of the other DISM files that you showed in your image in post # 2483354. I last cleaned that Temp folder on 25-Sep-2022 and since then TreeSize Free shows that my Temp folder has grown to ~418 MB, but the contents of two subfolders (C:\Users\<myusername>\AppData\Local\Temp\Diagnostics and C:\Users\<myusername>\AppData\Local\Temp\Outlook Logging) account for over 350 MB of that 418 MB. I have dozens of subfolders in C:\Users\<myusername>\AppData\Local\Temp with randoms names like {AA31FBDE-303A-421A-95CB-12363FFFBDD9} similar to the ones you see but they’re all empty.

I only see one .ppkg file in my hidden C:\ProgramData\Microsoft\Provisioning folder.

My last automatic Windows Update check ran at 7:25 AM today (28-Sep-2022) but no updates have been installed by Windows Update except my daily Microsoft Defender definition updates since my Sept 2022 Patch Tuesday updates were delivered on 15-Sep-2022 (see my post # 2478258).
————–
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v 105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1767 * Macrium Reflect Free v8.0.6979 * Dell Update Windows Universal v4.6.0 * TreeSize Free Portable v4.6.1

Reply | Quote

Thanks. A lot to reply to. First not seeing those files. Do you have a folder in temp that those files are inside? My current folder is named DD4B175C-AA63-48EF-A366-923D157E7CE8 so it would be something along those lines. Interesting you have lots, but empty. Not one with files?

Note in my latest post the provisioning task (which also says runs at logon and runs a few hours later) also creates a number of other tmp folders.

So, mystery continues. But this is all new as I mentioned. Cannot be happening for more than two weeks and likely just a week. I should have noted first appearance.

I’ll keep reading.

Reply | Quote

PKCano wrote:

rebop2020 wrote:

A folder is created in User/Temp

That’s not under your User (C:\Users\your ID\Temp.
Be specific and correct when you list the path.

Sorry. Was talking in shorthand, not posting a path there. I have shortcuts to what I refer to as User Temp and Windows Temp. This was the User Temp and I assumed would be better understood.

That said, do you have files folders with DISM in it?

This ALSO is creating a slew of tw-xxxxxxxx.tmp folders at the same moment (and same as Windows-Management-Provisioning task running) in C:\Windows\System32\config\systemprofile\AppData\Local

I had 2399 of those files. Deleted them and now 19 new created this afternoon.

 

Something just not right.

Reply | Quote

Nothing DISM in C:\Users\myID\AppData\Local\Temp. The total folder size is 4.63MB – bunch of empty folders.

I do have a slew of tw-* folders in the C:\Windows\System32\config\systemprofile\AppData\Local folder. They all seem to be empty and the total Local folder size is 32.5MB (stuff in other folders).

Reply | Quote

Some clues here including agreement on what is the cause:

https://www.askvg.com/fix-empty-tw-tmp-folders-in-system32-directory-in-windows-10-11/

Reading…

Mine completes succesfully and creates the files. No error unlike this article.

I donlt think disabling the task is the right solution.

Reply | Quote

https://www.ceofix.net/6107/how-to-fix-the-empty-tw-tmp-folders-on-windows-11-and-10/

I think these files have been happening for quite some time/ The DISM files in tmp are new, but I am somewhat confident created by the same cause and somehow triggered by some change with a Wndows Edge update.

No real solution.

Here’s a Woody thread on the tw files form a few years ago:

https://www.askwoody.com/forums/topic/provtool-exe-creating-temp-folders/

Ahhhh, here:

https://www.elevenforum.com/t/windows-10-11-create-tons-of-empty-folders-in-system32.2444/page-10

“If you want to see what the provtool is doing. Open event viewer, I haven’t for so long but wondered. Scroll to applications and services> Microsoft >Windows> Provisioning-Diagnostics-Provider>Admin. All of the entries coincide with the folders created. When I had logon task disabled it did not record anything. Now that it is back on I get 21 entries at each logon but only 20 empty Tmp folders.”

Good stuff. So, more info now:

Here is what ran when all these were created today.

Looking at a few:

Applying package ‘Microsoft.Windows.Cosa.Desktop.Client.ppkg’ ID: {c8a326e4-f518-4f14-b543-97a57e1a975e}.

Applying package ‘Power.Settings.Sleep.ppkg’ ID: {3742e5e8-6d9d-473b-99a6-8ecc0f43548a}.

Applying package ‘Power.Settings.PCIExpress.ppkg’ ID: {268c43e1-aa2b-4036-86ef-8cda98a0c2fe}.

Applying package ‘Power.Settings.Graphics.ppkg’ ID: {bf56ce5a-946b-45b5-858a-1794eb0125e2}.

Applying package ‘Power.EnergyEstimationEngine.Telemetry.ppkg’ ID: {8fb7d64e-70fc-4f9d-89ee-d486817534df}.

Hmm. All similar. Related to power or “cosa”?

These undeniably created the TW folders and the folder containing DISM. Match to the seconds.

So…now why? Happens at every logon/ Does not happen on days I do not turn off the computer or reboot.

Hmmm. COSA:

https://learn.microsoft.com/en-us/windows-hardware/drivers/mobilebroadband/cosa-overview

COSA overview

COSA, or Country and Operator Settings Asset, is the new format that Mobile Operators (MOs) use in Windows 10, version 1703 and later to provision Windows devices for mobile broadband.

Reply | Quote

I have a folder like that in my C:\Users\YOURNAME\AppData\Local\Temp. It’s size is <10MB. So what?

And I have 400+ “tw” empty folders in C:\Windows\System32\config\systemprofile\AppData\Local going back to April 20, 2022.

That *seems* wrong.

Reply | Quote

rebop2020 wrote:

Some clues here including agreement on what is the cause: https://www.askvg.com/fix-empty-tw-tmp-folders-in-system32-directory-in-windows-10-11/ Reading… Mine completes succesfully and creates the files. No error unlike this article. I donlt think disabling the task is the right solution.

The tw-*** temp folders issue as a result of the Provisioning task has been discussed here and elsewhere many times (since 2019). System is apparently supposed to delete them periodically but often fails to.

The article you refer to shows:

It might be a bug or glitch in Windows 10 and Windows 11 operating systems which should be fixed in future updates.

Issues with this Provisioning task were first reported AFAIK in 2016 (with the Windows 10 Anniversary Update). Since 2019 I have always disabled the Provisioning task(s) and can’t say that I’ve ever noticed any adverse side-effect.

Your experience shows that – more than 6 years on – Microsoft are no closer to fixing any bug or glitch with this Provisioning task so – for me – disabling it/them *IS* the right solution for me, in the absence of any effective Microsoft QAT (Quality Assurance Testing). YMMV.

For anyone interested, I use the following PowerShell command (in an elevated console) to disable the two default Provisioning tasks:

Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Disable-ScheduledTask

To re-enable them, use:

Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Enable-ScheduledTask

Hope this helps…

(Note to Mods… despite being in a modified group, I still experienced the forum’s ‘slash-stripping’ bug so had to correct broken filepaths.)

Reply | Quote

Thanks Rick. Agreed, old issue. What is new is that it also creates a copy of DISM complete in the temp directories, which was my original issue in this thread. Was not until I learned that its from Provisioning that I even looked and found 2400 tw*.tmp files still. They seem to be triggered by the same thing, though “possibly” also related to Windows Defender not running.

Reply | Quote

PKCano wrote:

Nothing DISM in C:\Users\myID\AppData\Local\Temp. The total folder size is 4.63MB – bunch of empty folders.

I do have a slew of tw-* folders in the C:\Windows\System32\config\systemprofile\AppData\Local folder. They all seem to be empty and the total Local folder size is 32.5MB (stuff in other folders).

I don’t have a path like that on my computer 🙂 🙂

No worries. I know what you mean.

So Provisioning and/or defender is causing the DISM. Provisioning for sure on the tw*.tmp folders.

Read entirely too much on this today. I can easily delete the tw folders. DISM Folder and files more difficult and since new that the system creates these, I’m extremely cusious why and what changed.

Reply | Quote

Fixed the typos. 🙂

Reply | Quote

OK, on further reflection on what has happened in my case, not Defender. Definitely both issues from Provisioning. The DISM folders were being created with nothing touching Defender nor any scheduled task for Defender.

So that’s wher I shall leave it for tonight. I don’t think anyone will find better answers on the tw*.tmp folders. but would love more on the DISM folders.

Reply | Quote

rebop2020 wrote:

So that’s wher I shall leave it for tonight.

As mentioned earlier, l disable the Provisioning tasks. I’ll wait for Microsoft to sort it out in the fullness of time (or not)… but won’t hold my breath. In the meantime I’ll just work around the flaws.

IMO life is too short to be trying to understand poor quality programming and a 6-yr-old lack of a fix.

Reply | Quote

In the past I have seen such folders appear in %TMP% as the result of Windows Update, Window Security protection updates, running troubleshooters and selecting “Clean up system files” in Disk Cleanup.

HP Compaq 6000 Pro SFF PC / Windows 10 Pro / 22H2
Intel®Core™2 “Wolfdale” E8400 3.0 GHz / 8.00 GB
HP ProDesk 400 G5 SFF PC / Windows 11 Pro / 23H2
Intel®Core™ “Coffee Lake” i3-8100 3.6 GHz / 16.00 GB

1 user thanked author for this post.

lmacri

Reply | Quote

Hi rebop2020:

Further to EyesOnWindows’ post # 2483609, I did a Google search for “dismhost.exe appdata local temp” and found several similar reports about these DISM files being created in the hidden …\AppData\Local\Temp folder. I didn’t go through all these threads but the majority suggest the DISM files can be created in C:\Users\<username>\AppData\Local\Temp when a scheduled automated task fails to run. At first glance the most common cause seems to be because a scheduled Microsoft Defender scan failed to run (e.g., because the user has a third-party antivirus that prevents Microsoft Defender’s daily Quick Scans from running- see DismHost exe in Temp Folder in the MS Answers forum from a Norton AV user for one example), Windows Update failed to finish installation of an update and rolled back the update, or something prevented a Windows automatic maintenance task from running (e.g., Control Panel | System and Security | Security and Maintenance | Maintenance | Automatic Maintenance is not running correctly) and triggered a DISM “health check” scan.

Assuming the failure of an automated task is causing your problem, and given the number of automatic maintenance tasks that run in Windows (see Shawn Brink’s TenForums tutorial View All Automatic Maintenance Tasks in Windows 10), you might have a difficult time ahead of you isolating exactly what task is failing and triggering a DISM scan on your system.

At this point my best suggestion would be that you purge the temp files in C:\Users\<username>\AppData\Local\Temp (I use the Custom Clean feature of CCleaner Free to purge all my system temporary files but I assume the built-in Windows Disk Cleanup can also be used) and then see if you can catch the background task that is generating these DISM files in that hidden …\AppData\Local\Temp folder. If you’re lucky you might be able to find an event logged in your Reliability Monitor (see my image below of events logged on 15-Sep-2022 when I installed my Sept 2022 Patch Tuesday updates) that matches the time and date of the subfolder created in C:\Users\<username>\AppData\Local\Temp containing the DISM files.

If you do have a third-party antivirus I’d also suggest you turn ON Microsoft Defender’s Limited Periodic Scanning and see if allowing Microsoft Defender to run the occasional Quick Scan prevents DISM files from being re-created in your C:\Users\<username>\AppData\Local\Temp folder.

——————–
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1767 * Macrium Reflect Free v8.0.6979 * Dell Update Windows Universal v4.6.0 * CCleaner Free Portable v6.04.10044

1 user thanked author for this post.

rebop2020

Reply | Quote

Thanks, Imacri. Thoughtful and appreciated reply.

I found all that on Defender failed to run, but I have no tasks for Defender. Would have been a likely culprit.

My Automatic Maintenance has no errors.

So, once again, these files and folders are created the moment Management Provisioning runs after a delay on Logon. So I think I have it as isolated and perhaps I can.

Reliability monitor is a great idea I had not thought of! Unfortunately, nothing there except a Firefox crash last week.

 

 

Reply | Quote

rebop2020 wrote:

Alex, I would be amazed if you truly do not:

C:\Users\YOURNAME\AppData\Local\Temp

All these folders have empty EN_US subfolder.

Reply | Quote

Rick Corbett wrote:

rebop2020 wrote:

So that’s wher I shall leave it for tonight.

As mentioned earlier, l disable the Provisioning tasks. I’ll wait for Microsoft to sort it out in the fullness of time (or not)… but won’t hold my breath. In the meantime I’ll just work around the flaws.

IMO life is too short to be trying to understand poor quality programming and a 6-yr-old lack of a fix.

More interested in the 2 week issue than the 6 year issue, Rick.

Reply | Quote

EyesOnWindows wrote:

In the past I have seen such folders appear in %TMP% as the result of Windows Update, Window Security protection updates, running troubleshooters and selecting “Clean up system files” in Disk Cleanup.

Thanks. None of those run before the first appearance of the DISM folder. Well, possibly a Defender update, but Defender is diabled by ESET and not set to scan periodically.

Reply | Quote

Alex5723 wrote:

rebop2020 wrote:

Alex, I would be amazed if you truly do not:

C:\Users\YOURNAME\AppData\Local\Temp

All these folders have empty EN_US subfolder.

Thanks. And interesting. I only have one at a time and fully populated. Something different.

I’ll try a new Logon today and see what happens.

Reply | Quote

OK, seem to have things sorted for the moment.

Each logon creates 19 tw-*.tmp FOLDERS.

Each logon DOES NOT create a folder with all DISM in it. Unsure if that was aone time issue, if it happens after or when an EDGE update. Will watch.

I wrote a bat file called by a vbs in TASKS to run at logon. It clears all the exisitng tw-*.tmp files that exists on logon, then later (takes maybe 20 minutes) there are 19 again cleared at the next logon.

I learned something! You cannot use wildcards (*) to match folders to delete using RD or RMDIR in a batch file!! You can for files, but not folders. Surprised me. So the solution is:

FOR /d %%p IN (“C:\Windows\System32\config\systemprofile\AppData\Local\tw*.tmp”) DO rmdir “%%p” /s /q

I have other things I delete in the same bat file that build up in temp folders that I delete like Outlook .cvr files, etc. But this was the tricky one.

So now I wait to see if that DISM folder ever reappears.

 

 

1 user thanked author for this post.

windbg

Reply | Quote

I have 1299 empty tw_.tmp folders in C:\Windows\System32\config\systemprofile\AppData\Local

Reply | Quote

I had 2399 yesterday, Alex. Now each day I’ll have 19.

Reply | Quote

I had 20 new folders yesterday.

https://www.askwoody.com/forums/topic/tw-xxx-yyyy-zzzz-tmp-files/

Reply | Quote

rebop2020 wrote:

OK, seem to have things sorted for the moment. Each logon creates 19 tw-*.tmp FOLDERS. Each logon DOES NOT create a folder with all DISM in it. Unsure if that was aone time issue, if it happens after or when an EDGE update. Will watch.

Hi rebop2020:

This thread seems to be going a bit off topic. As noted in Rick Corbett’s post # 2483539, Vishal Gupta’s AskVG! 22-Mar-2022 article Empty TW-.tmp Folders in “System32” Directory in Windows 10, 11 states that there is a connection between Windows Provisioning (ProvTool.exe) and the empty folders created in the hidden, protected C:\Windows\System32\config\systemprofile\AppData\Local folder that are named tw-xxxx-xxxx-xxxxxx.tmp . More specifically, Vishal Gupta suspects these empty folders are created when the Logon task at Task Scheduler at Task Scheduler Library | Microsoft | Windows | Management | Provisioning fails to run at logon (see my image below showing a 0x8007042B error for this Logon task). It’s an old bug that affects most Windows 10 / 11 users (see the 15-Dec-2020 images I posted <here> in the Norton forum when I was still using Win 10 Pro v1909) that Microsoft has never fixed, and while the build-up of these empty folders may be annoying for some people they’re completely harmless.

If you’d like to test Vishal Gupta’s theory then temporarily disable the Logon and/or Cellular tasks for Provisioning in Task Scheduler at Task Scheduler Library | Microsoft | Windows | Management | Provisioning, or temporarily turn off these two Provisioning tasks using the PowerShell commands that Rick Corbett provided in post # 2483539, and see if that stops the creation of these empty tw-xxxx-xxxx-xxxxxx.tmp folders.  If that stops the creation of these empty folders then you can decide for yourself if you want to turn those Provisioning tasks back on or not.

Getting back to your original problem, how often do new copies of DismHost.exe and other DISM files shown in your image in post # 2483354 appear in your hidden C:\Users\<username>\AppData\Local\Temp folder? The title of this topic implied these DISM files are created daily, but your post # 2484212 now suggests this only happened once and that you will monitor this hidden folder to see if it ever happens again. Is that correct?
————————-
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1772 * Macrium Reflect Free v8.0.6979

Reply | Quote

Hmm, I do not see it as off topic. And your first parahragh is completely true and I think all agreed to previously. And when Logon runs is exactly the ame time as the folder with DISM is created, so something tied in there as well.

I have already tested and proved. Unsure why that isn’t obvious?

The DISM was there first time a week or 10 days ago. If I deleted it, granting ADMIN permission to, it would recreate the next Logon. Until yesterday when it stopped. For now. SO more than once, less than daily. If I did not delete, it would remain until I did. And recreate if I deleted. Until yesterday.

So, as I said, I am watching to see if it comes back and if so if tied to an Edge update.

 

Reply | Quote

lmacri wrote:

Further to EyesOnWindows’ post # 2483609, I did a Google search for “dismhost.exe appdata local temp” and found several similar reports about these DISM files being created in the hidden …AppData\Local\Temp folder. I didn’t go through all these threads but the majority suggest the DISM files can be created in C:Users\AppData\Local\Temp when a scheduled automated task fails to run. At first glance the most common cause seems to be because a scheduled Microsoft Defender scan failed to run…

rebop2020 wrote:

…And when Logon runs is exactly the ame time as the folder with DISM is created, so something tied in there as well…

Hi rebop2020:

Correlation does not always mean causation.

There are several scheduled background tasks that can be triggered to run at a Windows logon, and if the Windows Provisioning (ProvTool.exe) Logon task is creating empty folders in C:\Windows\System32\config\systemprofile\AppData\Local at logon that doesn’t necessarily mean that this same task is responsible for creating DismHost.exe and other DISM files in C:\Users\<username>AppData\Local\Temp just because the folders have similar timestamps. I’m only suggesting that you shouldn’t link the two issues until you have more evidence.

It’s still possible that the failure of some other background task created those DISM files in C:\Users\<username>\AppData\Local\Temp. For example, Task Scheduler shows I have a MS Edge task called MicrosoftEdgeUpdateTaskMachineCore that triggers MicrosoftEdgeUpdate.exe to run at the logon of any user. Note that the Last Run Result of both my MS Edge tasks shown below is 0x0 (i.e., operation completed successfully), even though I’ve disabled both “Startup Boost” and “Continue Running Background Extensions and Apps When Microsoft Edge is Closed” in my MS Edge browser at Settings | System and Performance | System to prevent MS Edge from running in the background after my MS Edge browser is closed (see the ghacks.net 04-Feb-2022 article Microsoft Edge May Be Running on Your Windows PCs, Even If You Don’t Use the Browser for more information about Startup Boost). That’s just one example of a scheduled task other than Windows Provisioning that can be triggered at logon.

—————-
Dell Inspiron 5584 * 64-bit Win 10 Pro v21H2 build 19044.2006 * Firefox v105.0.1 (default browser) * Microsoft Edge v105.0.1343.53 * Microsoft Defender v4.18.2207.7-1.1.19600.3 * Malwarebytes Premium v4.5.14.210-1.0.1772 * Macrium Reflect Free v8.0.6979

1 user thanked author for this post.

Rick Corbett

Reply | Quote

After Logon, it takes 17-22 minutes for the tw-*.tmp folders to be created. At EXACTLY the same time, the DISM was time stamped. Pretty big coincidence, no?

Reply | Quote

lmacri wrote:
At first glance the most common cause seems to be because a scheduled Microsoft Defender scan failed to run…

I don’t use defender which is disabled and no auto-update of EDGE..
My laptop is on 24/7/365 so no logon… yet I have both DISM (empty folders) and tw- (empty folders) created.

Reply | Quote

Had same issue, seems may have been linked to a windows update, specifically being KB5017262. Had a client have this issue and I uninstalled this update and seems to have cleared up…. for now that is…. It has not produced the folders with the DSIMHOST.exe and DLLs in several hours now.

Reply | Quote

KB5017262 is the 2022-09 .NET Framework 3.5/4.8 Preview issued 9/22.

Reply | Quote

Interesting.

FWIW, I logged in last night and it took 1 hour and 18 minutes for the TW-*.tmp files to appear. The LOGON  task did not run until then. And no DISM folder yet since that logon.

I do not have KB5017262 installed on my computer.

Reply | Quote

OK, new DISM folder created yesterday. This time caused by: .NET Framework NGEN v4.0.30319 64 task. Cannot tell what this is doing as its a “custom handler” But down to the second.

Ideas?

Reply | Quote

NGEN is a tool that improves the performance of managed applications. It compiles .NET apps to optimize them for your CPU.

Reply | Quote

JGauthier wrote:

Had same issue, seems may have been linked to a windows update, specifically being KB5017262. Had a client have this issue and I uninstalled this update and seems to have cleared up…. for now that is…. It has not produced the folders with the DSIMHOST.exe and DLLs in several hours now.

This did not fix it sadly… checked on the PC this morning at over 1000 folders were created.

Reply | Quote

technic wrote:

NGEN is a tool that improves the performance of managed applications. It compiles .NET apps to optimize them for your CPU.

Thanks I read that. But it does not tell me what the TASK is doing or why this creates a folder with all DISM in the temp directory. That is what is curious.

Reply | Quote

New Dism folder created yesterday. Now two full copies in the temp directory. It was improving, but something now has it back. And takes admin rights to delete and I am an admin. So….going to watch this again to see what happens.

Reply | Quote

OK, more things running at unepected times creating or modifying the DISM folders in temp. Nirsoft (love them) have a free app called TaskSchedulerView that show exactly what was run at the moment that these files were last modified. Much more than I would have thought and some I think should not be running. I need to investigate further, but no time right now so thought I would throw this out there.

I am starting to think it is NOT the .NET tasks creating this (maybe the .NET calls the others?) but for now (before investigation) I do not think that these should be running:

DmClient
MaintenanceTasks
StorageSense
WorkFoldersMaintenance
StartComponentCleanup

Maybe more.

Thoughts?

 

 

 

Reply | Quote

What makes you think they should not be running? They all could be part of the regularly run maintenance tasks. There is no telling what Microsoft has defined as a maintenance task.

--Joe

Reply | Quote

Several things.

Many were not running until recently. Things like DEFRAG (not in the list) should never be run on SSD. There are other reasons, but no time to go one by one right now. But there are many tasks that can and should be disabled.  Some of these might be in that group.

Reply | Quote

DEFRAG should be run on an SSD. On an SSD, it optimizes the free space and does not do a traditional defrag.

Of course, it is your PC. If you choose to disable tasks go ahead but check them out and beware of side effects of not running them.

--Joe

Reply | Quote

Of course. I disagre on DEFRAG on SSD. Trim yes, Defrag no.

And I been around windows since 1.0. Seriously. So continually learning, but know my way around. When something starts creating DISM files in Temp, there is something new I may not wish to be running. I always check DISM MANUALLY when I need and do not let it automatically make changes. Master of my domain as much as I can be. But thanks for the warnings….

Reply | Quote

Defrag in Windows 10 & 11 does not defrag on an SSD. It uses the TRIM function to optimize the drive.

--Joe

Reply | Quote

joep517 wrote:

Defrag in Windows 10 & 11 does not defrag on an SSD

Windows does defrag SSDs, but not in the same way as an HDD.
Hanselman – Does Windows defragment your SSD?

cheers, Paul

1 user thanked author for this post.

rebop2020

Reply | Quote

Fascinating Paul. Thanks.

The article is from 2014 but I think we can assume if anything optimize has become better.

I have my SSD set to “OFF”. Says 829 days since last run. I think I shall run it. And Google (and otherwise search) to see more current thinking. But I did recall that as true for defrag but also recalled not a good idea and to run TRIM from the SSD’s manufacturer utility.

So shall see what else I find.

Reply | Quote

Read enough to run Optimize. Took maybe 10 seconds to TRIM when run. BUT, it also deleted my restore point that had been working. I find it odd that TRIM would delete a restore point. The clue was gaining 6GB free space after running Optimize.

Reply | Quote

rebop2020 wrote:

Of course. I disagre on DEFRAG on SSD. Trim yes, Defrag no.

Windows will not “Defrag” a Solid State Drive (SSD).  It will retrim a SSD.  Windows Tools > Defrag and optimize drives recognizes SSD’s and only runs retrim.  On HDD’s only will it run defrag.

Always create a fresh drive image before making system changes/Windows updates; you may need to start over!

We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.

We were all once "Average Users".

Computer Specs

Reply | Quote

Ok.

Point of todays post is that much more than .Net and provisioning was running when the dism changes occur and I intend to learn more about each one and post.
And I think you will find many sites at least suggesting tasks that either should not be tun (telemetry?) or should be options. So I’ll see what I can see tonight.

Reply | Quote

Most of these tasks are all ok and check out. There are some that are suggested to disable for telemetry issues.

ProgramDataUpdater

It is recommended to disable “\Microsoft\Windows\Application Experience\ProgramDataUpdater” as a scheduled task. (thi from Windows 7)
http://windows.fyicenter.com/4688_ProgramDataUpdater_Scheduled_Task_on_Windows_7.html

Martin Brinkman says turn off all User Experience. I thought I had. Hmm, still off in GPEDIT.

Then says:

You may stop it dead in its track using the Task Scheduler as well. Basically, what you can do is block the data collection and uploading right there.

Tap on the Windows-key, type Task Scheduler, and hit the Enter-key. This opens the Windows Task Scheduler.
Use the folder hierarchy on the left to go to the following folder: Task Scheduler Library > Microsoft > Windows > Autochk.
The Proxy task there “collects and uploads autochck SQM data if opted-in to the Microsoft Customer Experience Improvement Program”.
Right-click on Proxy and select Disable from the context menu.
Go to Task Scheduler Library > Microsoft > Windows > Application Experience.
Right-click on Microsoft Compatibility Appraiser, ProgramDataUpdater, and StartupAppTask, and disable them.

Proxy: This task collects and uploads autochk SQM data if opted-in to the Microsoft Customer Experience Improvement Program.
Microsoft Compatibility Appraiser: Collects program telemetry information if opted-in to the Microsoft Customer Experience Improvement Program.
ProgramDataUpdater: Collects program telemetry information if opted-in to the Microsoft Customer Experience Improvement Program
StartupAppTask: Scans startup entries and raises notification to the user if there are too many startup entries.

These all enabled but it says IF opted-in to the Microsoft Customer Experience Improvement Program. So maybe does not need to be disabled? Or maybe does?

So, all that being said, I still do not know for sure what task is creating and modifying the DISM file(s) or why. Or even if DISM is being run from those folders and when or why. It “seems” that each .NET update causes more to occur with these files in TEMP.

 

Reply | Quote

If you want to dig in and find out what is creating the folder see Process Monitor – Sysinternals | Microsoft Learn.

--Joe

Reply | Quote

Interesting thought. I had thought that was realtime and I would have to know when to look, but perhaps not. Will check it out.

UPDATE:

Cannot figure out what to search for and it seems that could take hours to find. How would you suggest using this? I could search for the date and time, the folder name created then or…?

Reply | Quote

You need to set one or more filters. In the filter dialog use “Operation” and then select one of the file actions. You can add more than one filter.

--Joe

Reply | Quote

Thanks. Nothing I tried brought up any results, much less what created the DISM folders.

Reply | Quote

It gets stranger!!

OK, I mentioned that OPTIMIZE or TRIM deleted my restore point. I use them. When Windows does an Update it wipes out restore points and so I create one then.

My points are usually MB’s to low GB’s – like maybe 4 or 5 GB. After the deletion early this AM, I created a one new and it was maybe 300 MB.

I woke this morning, did my morning check on things and my SD drive was down 16 GB. How odd. Never varies that much. So I did a search for files created or modified in the last 8 hours and came up short. Nothing that would account for 16 GB less hard drive. So looked at Restore and yup, the point I created at 300 MB is now 16 GB. In fact, when I checked an hour later, it’s now 17 GB and growing.

So, what is going on? Is the fact I turned OPTIMIZE ON causing this? Did trim make Restore think it is all new?

I don’t know how to deal with this, but I should do something to take control.

Plan at the moment is to work for a few hours, see where the restore point is, then maybe delete it and create a new one and monitor.

Thoughts?????

Reply | Quote

I deleted the restore point, created a new one and it is behaving as expected. So my guess is a TRIM after not doing one for 3 years caused enough changes that RESTORE thought it needeed 17 GB to revert to before the TRIM. All I can figure. Hopefully at next month’s trim much less will change so smaller restore points and no alarms will go off making me wonder.

Reply | Quote

TRIM does not delete existing data.
It is automatic when you have an SSD. Without it your writes would be very slow.

cheers, Paul

Reply | Quote

Never said it did. But said it changed things so that RESTORE thought it was changed and needed to be backed up in a restore point. And only automatic if Optimize is enabled.

Reply | Quote

TRIM doesn’t change existing data either, it’s a clean-up process for data that has been deleted on an SSD.
TRIM is enabled at all times on an SSD, nothing to do with optimize.

cheers, Paul

Reply | Quote

OK.

BUT – OPTIMIZE caused Restore to increase by 17GB. Undeniable. So something thought something was changed. And if optimize only does TRIM on SSD, what else could it be? And if TRIM is always on (can you cite that?) why would OPTIMIZE need to be used at all on an SSD?

Reply | Quote

See this old blog post for an explanation – The real and complete story – Does Windows defragment your SSD? – Scott Hanselman’s Blog.

 

 

 

--Joe

Reply | Quote

Already cited, read and acknowledged in #2496281

Does not answer why it bloats Restore Points. Nor does it claim (if I recall) that TRIM runs without Optimize enabled. Which seem to be the two open quesions OTHER than what is creating the continuing DISM folders 🙂

Reply | Quote

Optimize is a clean up routine, so old restore points may be removed. It may run a TRIM after it has cleaned up to ensure the SSD is performing optimally.

cheers, Paul

Reply | Quote

joep517 wrote:

You need to set one or more filters. In the filter dialog use “Operation” and then select one of the file actions. You can add more than one filter.

rebop2020 wrote:

Nothing I tried brought up any results, much less what created the DISM folders.

Some suggestions:

1. You know the path so use that as a filter operator, for example:

2. You know the names of the files in the folder that’s created so use one of them as an additional filter operator, for example:

3. You know the folder is created at login so use Enable Boot Logging in the Options menu, otherwise the behaviour may have already occurred by the time you get ProcMon running:

4. You know you’re looking for a process creating a folder, so turn off Show Registry Activity and Show Network Activity views to reduce unnecessary clutter. You only need Show File System Activity and Show Process and Thread Activity active:

Note: I use ProcMon 3.50 as later versions all have bugs, even the latest. 🙁 However, the legends, positions and operations of the toolbar icons remains the same.

Hope this helps…

---

More info about ProcMon bugs:

https://www.askwoody.com/forums/topic/sysinternals-suite-update/#post-2395671

https://www.askwoody.com/forums/topic/system32-cmd-exe/#post-2378095

https://learn.microsoft.com/en-us/answers/topics/windows-sysinternals-procmon.html

Reply | Quote

Thanks Rick.

First thing that jumps out from your suggestions is I DON’T know this is triggered by Logon. It might, but also might not. Some temp files (not the DISM) seem to have a 15 minute to 45 minute delay. But…

The “begins with” was very helpful!

The only thing turining up, without Boot Logging, is explorer.exe.

 

Reply | Quote

Middle of the afternoon yesterday both folders in temp with DISM were partially cleaned up. There was no logon!

I could not get procmon to uncover which of these caused that to happen. Both folder now hav just three or four files and not exactly the same files.

Reply | Quote

rebop2020 wrote:

CLUE: The DISM folders were created when this task ran: MicrosoftWindowsManagementProvisioning

As @lmacri pointed out previously, that’s just an assumption. Maybe it’s time to test that assumption.

ProvTool.exe is fired by a scheduled task run at logon, hence the need to ‘Enable Boot Logging’ in ProcMon. Rather than do all that hard work with ProcMon, why not just disable the Provisioning tasks, if only temporarily. to see what happens?

To disable:

1. *Right*-click on Start and select Windows PowerShell (Admin).

2. When the PowerShell console opens, copy and paste the following line then press the Return/Enter key:

Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Disable-ScheduledTask

This will disable both the Logon and Cellular tasks, as this screenshot shows:

3. Close the PowerShell console… ‘cos that’s it done. The change will take effect next time you restart or if you sign out/sign in to Windows.

Then wait… see what happens to the creation of temporary files/DISM folders…

In my experience over more than 2 years, disabling the Logon and Cellular tasks have not created any discernable issues. However, I don’t use any Store apps at all and remove all the pre-installed Windows 10 bloatware (using a PowerShell script whilst in Audit mode) so YMMV. Just keep an eye out for any issues with Store-delivered apps in case they don’t update.

Note: To undo this change, use this:

Get-ScheduledTask -TaskPath "\Microsoft\Windows\Management\Provisioning\" | Enable-ScheduledTask

This will re-enable both tasks, as this screenshot shows:

Hope this helps…

 

2 users thanked author for this post.

Just another Forum Poster, PKCano

Reply | Quote

Thanks for that Rick. But that was an old message you were replying to. The latest, which definitely did NOt run at logon, was above your post. So something in that image caused BOTH folders with DISM to clean themselves and like was the cause for creating them in the first place. Unless LOGON really does not mean logon as I havd not logged off in several days before this ran.

Reply | Quote

Rick Corbett wrote:

In my experience over more than 2 years, disabling the Logon and Cellular tasks have not created any discernible issues.

Same here.

In fact, I disabled all 4 of the tasks listed under\Microsoft\Windows\Management\Provisioning\ (Cellular, Login, Retry & RunOnReboot) back in March 2019 when I upgraded from Win7 to Win10 and have never experienced any problems!

FYI, I also removed all the pre-installed Windows 10 bloatware using powershell like Rick Corbett but do use one store app (Nvidia Control Panel) because I have an Nvidia GeForce graphics card and the control panel is only available as a MS Store app.

Reply | Quote

Just another Forum Poster wrote:

I have an Nvidia GeForce graphics card and the control panel is only available as a MS Store app.

I use Nvidia’s original drivers (no Microsoft store) and have Nvidia control panel.

Reply | Quote

There’s no longer a “legacy” version of the control panel available for the newer drivers.

If you update the driver (currently running v526.47), it removes the legacy version and replaces it with the new app version.

2 users thanked author for this post.

rebop2020, Alex5723

Reply | Quote

I am running the latest Studio driver 522.30.

Reply | Quote

The download file for that version is 522.30-desktop-win10-win11-64bit-international-nsd-dch-whql.exe

DCH (Declarative Componentized Hardware) uses the new MS Store app control panel while STD would be the old “legacy” style control panel.

NVIDIA DCH/Standard Display Drivers for Windows 10 FAQ

You can also tell the difference if you look at the actual location of the control panel program on your PC.

The MS Store app version of the control panel is located at:

C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_{VERSION#}\nvcplui.exe

The Standard version of the control panel is located at:

C:\Program Files\NVIDIA Corporation\Control Panel Client\nvcplui.exe

BTW, there’s no “visible” difference between the two versions when you open it that indicates whether it’s DCH or STD.

¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
And that should be enough “off-topic” discussion for this thread!

We need to get back to @rebop2020’s original question of what’s causing all those DISM folders?

3 users thanked author for this post.

rebop2020, Alex5723, wavy

Reply | Quote

Indeed.
I have the Microsoft app store blocked but it seems the the driver installer accesses and downloads the control panel from the Microsoft store as part of the installation.

Reply | Quote

rebop2020 wrote:

Thanks for that Rick. But that was an old message you were replying to. The latest, which definitely did NOt run at logon, was above your post. So something in that image caused BOTH folders with DISM to clean themselves and like was the cause for creating them in the first place. Unless LOGON really does not mean logon as I havd not logged off in several days before this ran.

Something is making changes within your %user%\Temp folder. So, whatever process it is should be detectable by ProcMon‘s monitoring of file system and process activity on that folder alone, whether it’s file/folder creation or deletion. If that something is not triggered by a logon process then I’m guessing another scheduled task has run or, as @lmacri has already mentioned earlier – a scheduled task has failed to run.

Perhaps try Nir Sofer’s small, free, portable TaskSchedulerView (and start it using Run as administrator). I find it far more helpful than the built-in Task Scheduler because it shows the triggers assigned to each task and allows you to sort on multiple conditions. For your purposes I suspect sorting on the Last Run column may be what you are looking for but scroll across all the available columns to see what conditions are available for further examination.

As for ProcMon not showing what you are looking for, delete ProcMon‘s current filter for Path contains DismHost.exe – include:

Hope this helps…

Reply | Quote

Thanks Rick. I posted early on I am using Nirsoft and love it. All screen shots on the processes run are from TaskSchedulerView. Provide no clue WHICH of those trigerred the creation or modification of the DISM folders.

ProcMon only shows Process Monitor 64 processes on the Temp folder.

Reply | Quote

rebop2020 wrote:

ProcMon only shows Process Monitor 64 processes on the Temp folder.

Nope. Your screenshot quite clearly shows ALSys1064.sys masquerading as Process Monitor 64.exe and running from within your profile’s Temp folder. That is NOT Sysinternals/TechNet’s ProcMon.

In ProcMon, open the Filter list (CTRL+L) and you’ll see that ProcMon processess – both 32-bit and 64-bit – are excluded from recording/display by default:

A quick Google for ALSys1064.sys suggests you may be running something called Core Temp? If so, I note that its changelog shows no new version since version 1.17.1 – 11th April, 2021 and its FAQ – last updated over a year ago – makes no mention of file/folder creation in %user%\Temp nor in Bug Reports in its Support forum… so I don’t think this is related to your issue which apparently only started a week ago.

Hope this helps…

Reply | Quote

I do use Core Temp and have for maybe 10 years 🙂 this is not the problem. But I also am not seeing anything else there. It’s just too odd.

Reply | Quote

rebop2020 wrote:

I do use Core Temp and have for maybe 10 years 🙂 this is not the problem. But I also am not seeing anything else there. Its just too odd.

Apart from Core Temp, what else runs automatically from restart?

Rick Corbett wrote:

But I also am not seeing anything else there.

What? Where? Please be clearer.

Reply | Quote

Hey Rick,

A few things run from start but this happened in the middle of the day, either the day after a start or long after a start. I do not see that related.

And the “what” “where” is anything in procmon that shows what happened at the times of creation, deletion or pruning of the DISM folders in temp.

Showing the task viewer of everything that happened in THAT moment of last creation/deletion is about as much information as I can think to produce. It always matches and “usually” these things do NOT happen at the moment of logon, but always delayed or not related to logon. Some tasks that say they run at logon are actually running 15-45 minutes after.

So what more info can I possible provide?

And a final thought for the morning: Most, if not all, of what runs at startup in terms of processes and apps have run like that for months if not years. Outlook, Core temp, Eset, etc. This all seems to have started at .NET or .netcore updates as best I can piece together.

Reply | Quote

According to this : https://www.thewindowsclub.com/what-are-tw-tmp-folders-in-system32

There is a task, named Logon in the Task Scheduler which creates these empty folders in the C directory.

Logon task : Microsoft\Windows\Management\Provisioning

The command it runs at logon of is:

%windir%\system32\ProvTool.exe /turn 5 /source LogonIdleTask
ProvTool.exe is an executable exe file that belongs to the Provisioning package runtime processing tool process.

Some users had found that the Logon task keeps creating these empty folders in the System32 folder. To get rid of this problem they disabled the Logon task in the Task Scheduler. After disabling the task, Windows had stopped creating these empty folders. Also, they had not experienced any issues with their systems after disabling the Logon task…

https://www.askvg.com/fix-empty-tw-tmp-folders-in-system32-directory-in-windows-10-11/

Reply | Quote

This is true, Alex, but a totally different issue mentioned waaay above. Those are empty folders in a different directory and we all get them. Some have thousands. 19 created at each boot and never deleted. I wrote a batch file to delete them on login.

The DISM FILES are in folders in a different temp directory and not related to the above.

But thanks. One day I will find the culprit. Have not given up.

 

Reply | Quote

rebop2020 wrote:

The DISM FILES are in folders in a different temp directory and not related to the above. But thanks. One day I will find the culprit. Have not given up.

Back to ProcMon. Keep the Path filter:

Remove any other filters you’ve created then add 2 more like the screenshot below:

This will monitor your %user%\Temp folder and only show results when a new folder is created within.

PS – Back in post #2496063 you queried StartComponentCleanup. That’s DISM.

Hope this helps…

 

Reply | Quote

Thanks Rick.

Interesting on the StartComponentCleanup. That is in tasks, but does not run when the DISM folders are created. So not responsible for creating or purging the folders I believe, but it does run upon occasion at non related times.

I have created the filter. Running it now shows nothing, even though a new folder was created yesterday. Do I have to have procmon running minimized or just open after I see a folder change? And the next thing this will do is DELETE some of the contents from the folder created yesterday. Likely a week or two until a new folder again.

 

 

 

Reply | Quote

rebop2020 wrote:

Do I have to have procmon running minimized or just open after I see a folder change?

ProcMon needs to be running (minimized) as it is monitoring in real-time for CreateFile (as folder) events.

I don’t know of any method to look back to find the originating *process*, only which *account* created and/or modified a file/folder, i.e. who ‘owns’ it. As you aren’t creating the folder yourself then it’s probably going to be System or TrustedInstaller… but won’t tell you the process in use.

rebop2020 wrote:

Likely a week or two until a new folder again.

I’m not sure that I understand you. The topic title is ‘NEW DISM folder created every day in User/Temp’ and your first post shows:

rebop2020 wrote:

If I delete it, it seems to be back with a new folder name the next day.

Are you now saying the new DISM folder creation only occurs every week or two?

The only other possibility I can think of is if the originating process writes an entry in one of the event logs. As there’s dozens of logs you would need the date and time the folder was created then create a PowerShell query to output the results of a search based on that criteria.

I did a search for DISM using Nir Sofer’s FullEventLogView but with no results. I was hoping to see whether DISM writes CreateFile events.

If you do get the time/date of the next created DISM folder then you could check the %windir%\Logs\DISM\dism.log to see if you get a match with a log entry… but that still wouldn’t give you the originating process which actually called DISM.

(I checked the Component Based Servicing logs – %windir%\Logs\CBS\ – but couldn’t find any mention of DISM.)

Sorry, but if ProcMon doesn’t show the originating process, then I’ve run out of ideas.

Reply | Quote

Hi Rick.

Let me clarify as long thread an I updated but likely missed.

IF I delete the folders created by using elevated permissions (even though I am admin) it will create a replacement likely the next day or two max. If I do not delete the folder, it creates a second folder maybe a week later. Then deletes all but a few of the 27 files in the original folder sometime thereafter. Maybe a week later  it prunes the second folder. They both seem to remain until I delete them again.

Now, some of the times could be related to reboots which I only do once, maybe twice a week. So could be that rather than elapsed time.

Again, started when I posted. Never before. Likely after a monthly Update (.net or .netcore?) . Then changed after the next monthly update most likely.

I’ll try running procmon.

I always have the date and time of creation of the folder. Matches images for running tasks I have posted above. To the seconds.

Just opened the log file you cited. That time is copied into the text file attached.

 

Reply | Quote

rebop2020 wrote:

Just opened the log file you cited. That time is copied into the text file attached.

Your %user%\Temp folder is mentioned twice in the log.

The second instance (line 44) gives you a sub-folder name within of 86EA8E6E-D8A9-40C7-9606-81574783E753.

The parent process (line 6) shows as C:\WINDOWS\system32\cleanmgr.exe. At a guess this is what’s deleting files in the folder, not what created the folder in the first place.

Reply | Quote

That is indeed the name of the current folder created at that time. Not sure what the log message is telling us.

 

Reply | Quote

And indeed, if it proves DISM is creating the folders, which is logical, what is calling DISM to do this now after years of not calling it?

Reply | Quote

rebop2020 wrote:

That is indeed the name of the current folder created at that time. Not sure what the log message is telling us.

rebop2020 wrote:

And indeed, if it proves DISM is creating the folders, which is logical, what is calling DISM to do this now after years of not calling it?

It appears to be a log that’s created at the same time as the pruning of the folder by cleanmgr.exe /autoclean /d C: 9 (line 6). The ‘last modified’ timestamp may be the same, i.e. 2022-11-16 15:30:27.

From what I’ve read, this is Microsoft’s SilentCleanup but the /autoclean switch appears undocumented. However, this post mentions that SilentCleanup is a scheduled task and it creates a dism.log.

The description for SilentCleanup shows:

Maintenance task used by the system to launch a silent automatic disk clean-up when free disk space is running low.

This ties in with the task’s sole start condition (no triggers)… it’s Allow Demand Start, i.e. when needed. So, the initiating process is a maintenance check run just before… which in turn calls SilentCleanup.

I guess it’s suddenly doing this because the free storage space has fallen below a default threshold and/or you’ve turned StorageSense on.

Hope this helps…

2 users thanked author for this post.

rebop2020, Alex5723

Reply | Quote

Thanks Rick.

I had noticed this previously:

“Maintenance task used by the system to launch a silent automatic disk clean-up when free disk space is running low.”

My C drive has 785 GB free, so I thought that would never run; and it didn’t until maybe two updates ago.

I do not have StorageSense turned on.

I had to stop running procmon with that filter, it was eating 60-65% of available memory.

I’ll keep poking around.

OK, this is interesting:

Silent Cleanup: Maintenance task used by the system to launch a silent automatic disk clean-up when free disk space is running low. The operator or administrator has refused the request. 0x800710E0

Reply | Quote

rebop2020 wrote:

I had to stop running procmon with that filter, it was eating 60-65% of available memory.

Next time you use ProcMon for a long-running query, try using Drop Filtered Events.

This will stop ProcMon exhausting your swapfile.

(ProcMon‘s good… but it has a fairly steep learning curve.)

Hope this helps…

Reply | Quote

Big difference. Thanks.

Reply | Quote

New uopdates in NMov to .net and .net core has this working a little differently now. It removes EVERYTHING but dismhost.exe from the exisiting folder and creates one new with ALL the dism files. I shall wait and see if that first folder is ever automatically deleted. I doubt it. but maybe.

And I wonder what it is all looking to replace or restore.

Reply | Quote

OK, update.

I have stopped this from happening 🙂 It was Microsoft Defender not being able to be run on schedule as I had scan occasionally turned off as I use other antivirus. Once turning on, Defender runs along side my AV, updates, and no longer creates DISM folders thinking something must be corrupt since scheduled tasks do not run.

So I use more ram, get more and more often updates to Defender. But no more suspicious folders.

So now ya know….

2 users thanked author for this post.

windbg, geekdom

Reply | Quote

rebop2020 wrote:

Defender runs along side my AV,

Never run 2 A/Vs in real time.

Reply | Quote

Not true. Microsoft specifically enables Defender alongside other AV’s. I realize yours was the old rule. Windows now interleaves using Defender with another.

Reply | Quote

Real time A/V disable Defender. On demand A/Vs don’t.

Reply | Quote

“… scan occasionally … turning on,” was mentioned:

Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 or Windows 11 device.

Use limited periodic scanning in Microsoft Defender Antivirus

1 user thanked author for this post.

Alex5723

Reply | Quote

Actually, you can have two active scanners present if Malwarebytes Premium is one of them. You just need to tell MalwareBytes not to Register Itself with the Security center when your install it. I’ve used it this way for at least 10 years!

May the Forces of good computing be with you!

RG

PowerShell & VBA Rule!
Computer Specs

1 user thanked author for this post.

Alex5723

Reply | Quote

Malwarebytes Premium is the exception.
Most A/Vs disable Defender but you can still set it to periodically check.

Reply | Quote

I should have never posted 🙁 Got a new DISM folder in temp today. At least it stopped for a week. Now to decide whether to keep tht occasional scan by Defender enabled. I do get almost daily definition updates from Defender which is its own nuissance.

Reply | Quote

Well, this is back with a vengeance. Had 4 versions of folders with these yesterday. Two with juts DISM and Language folder, two full. At least it used to delete the “almost” empty folders but now they pile up more.

I have decided this is not a Defender issue but seems to be Silent Cleanup in the Disk Cleanup task. I have disabled that and no more since. Will keep an eye on it.

FWIW, I have Cleanmgr set to do VERY little. So it was not doing much anyway. Most important things there I keep an eye on. But the task says runs when disk space is getting low. With 750 GB free it was running 4-6 times a day. So likely not a loss.

Reply | Quote

Got it. Repeatable. Took a while to find this 🙂

Go to Settings. Then System/Storage. Click on Temprary Files. No need to do anything else after that loads.

Got Appdata/local/TEMP

New folder named with numbers and letters (no braces) filled with DISM files. Do it again, get another.

Silent cleanup, which should NEVER run unless low disk space (I have 750 GB free!) “can” do the same thing. Not as repeatable as this.

I’m usually quicker than this. This took 11 months to find 🙂

Reply | Quote

rebop2020 wrote:

Go to Settings. Then System/Storage. Click on Temprary Files. No need to do anything else after that loads. Got Appdata/local/TEMP New folder named with numbers and letters (no braces) filled with DISM files. Do it again, get another.

So, @rebop2020 , to avoid getting any more of these folders you consider to be annoying (in that they don’t go away), please from now on do the following:

Instead of using the procedure you described above (which I did, and I got one of those folders you’re talking about) to clean out space on your HDD or SSD, instead use the Disk Cleanup utility (run as administrator) that’s in the Start Menu under the Windows Administrative Tools folder/listing. So, left click on the Start menu and then scroll all the way down the list until you see a folder-looking icon that has the words “Windows Administrative Tools” next to it and click on it. Now go down a bit under that to find the listing for “Disk Cleanup” and right click it, selecting the “More” option and then selecting “Run as administrator” after that.

Using the Disk Cleanup utility will perform the same functions as the procedure you describe above, but won’t produce one of those folders that take up space and that you consider annoying because of that. I ran your procedure and, as I said above, wound up with one of those folders in the exact place you mentioned. BUT, when I ran Disk Cleanup, I didn’t get any such folder anywhere, even when I ran it without using the “Run as administrator” option.

I hope this helps you down the road!

Reply | Quote

Thanks Bob. That is how this started. The Scheduled Task for Disk Cleanup / Silent Cleanup would cause thse automatically even though it should never run unless less than 5GB disk free. It was CAUSING this, but I could not get it repeatable on demand. I finally disabled that task and no more DISM  folders.

I then discovered the NEW method in Settings and it does as you saw. Obviously related to touching temp folders/files with a version of disk cleanup.  So my post was to offer proof of what is behind the automatic creation of those DISM folders.

Reply | Quote

Well done rebop2020 !

I had this problem at one of my customers and couldn’t solve it until reading this today.  Thanks for all your hard work.

Reply | Quote