Windows Server 2022 Domain Controller Losing Disk Space On Logs Directory

REM64 20 Reputation points
2023-01-26T16:45:25.0866667+00:00

Hi All,

We have a Windows Server2022 Data Center environment with 3 domain controllers with different roles. We have 2 DCs losing free disk space (shrinks about 1 GIG a week) and I cannot locate any files that could be using space. I will just note the following for one DC with the hope someone here can shine some light on how to troubleshoot and identify what is going on with the logical drive losing space.

(Logical Volume for logs directory)

E= Logs (Total volume = 19.9 GIG. Free space =13.3GIG)

  • If I check the properties of the drive it displays used space=6.66GB
  • If I expand the folder and navigate to the logs directory, all logs combined are 110MB
  • I've unhidden system files and hidden files, folders, and drives, but cannot find any files that would be using over 6GIG
  • I installed a Windirstat program that scans the directory and lists all files, but even with this program, there is nothing displaying additional files.

I'm at a loss and can't find any KB article anywhere that could help me identify the issues. I'm assuming there is some orphaned or phantom file somewhere that maybe a PowerShell command can be run to find what is eating up the space.

Any help would be appreciated.

Thanks in advance,

Bob

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,703 questions
0 comments No comments
{count} votes

Accepted answer
  1. Limitless Technology 44,526 Reputation points
    2023-01-31T08:53:09.3+00:00

    Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

    There are a few potential causes of unexpected disk space usage on Windows servers, some common ones include:

    1. Large event logs: Event logs can take up a significant amount of disk space, especially if they are not being regularly cleared or archived. Check the event logs for any large logs that might be causing the issue.
    2. System restore points: Windows Server creates system restore points by default. Over time, these restore points can take up a significant amount of disk space. You can try disabling system restore or configuring it to use less disk space.
    3. Windows updates: Windows updates can also cause disk space usage to increase, especially if there are a large number of updates that have been downloaded but not yet installed. Check for any updates that may be causing the issue and install them if possible.
    4. Windows defender: Windows defender can take up disk space when it saves the scan results or quarantined files. Consider disabling the real-time protection, cleaning the quarantine and configure the defender to use less disk space.
    5. Shadow Copies: Shadow Copies are used to create snapshots of the file system at specific points in time. Over time, these snapshots can take up a significant amount of disk space. You can try disabling shadow copies or configuring them to use less disk space.
    6. Large files or folders: Sometimes there are large files or folders that are not easily noticeable, check if there are any large files or folders in the root of the drive, or in the hidden files and folders.
    7. Disk fragmentation: The disk fragmentation can cause disk usage to increase, consider running disk defragmenter to optimize the disk.
    8. Replication issues: If the domain controllers are replicating data, the replication process can cause disk space usage to increase if there are any issues with the replication process. Check the replication status and troubleshoot any issues that may be found.

    It's essential to identify which one of these causes is behind the disk space shrinkage and address it accordingly. It would be advisable to take a backup of the important data before making any changes.

    If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

    1 person found this answer helpful.
    0 comments No comments

5 additional answers

Sort by: Most helpful
  1. Anonymous
    2023-01-26T16:53:40.4133333+00:00

    3 domain controllers with different roles

    What roles? Generally speaking, it isn't recommended to install other roles / applications on a domain controller. You may want to consider standing up a new dedicated virtual machine for active directory domain services.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    1 person found this answer helpful.

  2. Anonymous
    2023-01-26T18:53:16.11+00:00

    Since you can't find the log files or the source of disk space usage the simplest thing to do may be to stand up a new one for replacement.

    I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new one, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    0 comments No comments

  3. REM64 20 Reputation points
    2023-01-26T19:54:33.5466667+00:00

    Dave,

    I appreciate your input, but this is a last resort that I don't want to entertain. Also, I never said I couldn't find the log files. The log files are there (they are only 110MEG combined). The problem is the partition is using over 6GIG of space and I can't find what is using that space. There are no issues with active directory or replication and no event viewer errors for any AD-specific issues.

    I will defer to Microsoft and post back the solution so you will have (as well as myself) a better understanding of what the issue is.

    Thanks,

    Bob


  4. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.