Remove Winsxs: Syntax, Examples, Flags & Production Guide

remove winsxs describes the operation of safely reducing the Windows component store (WinSxS) size using DISM, Disk Cleanup, and Task Scheduler to delete superseded system files.

Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase

Run these commands from an elevated Command Prompt on Windows 10 (version 1607 and later) or Windows Server 2012 R2+. The /ResetBase flag permanently removes all superseded component versions, disabling update rollback.

Syntax

Dism.exe /online /Cleanup-Image /StartComponentCleanup [/ResetBase]
Dism.exe /online /Cleanup-Image /SPSuperseded
cmd.exe /c Cleanmgr /sageset:65535 & Cleanmgr /sagerun:65535
cleanmgr

Options and Flags

Usage Examples

1. Basic component cleanup

Dism.exe /online /Cleanup-Image /StartComponentCleanup

Removes superseded component versions without compressing the store. Safe to run after every cumulative update. Does not prevent rolling back updates.

2. Aggressive cleanup with ResetBase

Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase

Deletes all superseded versions of every component. After this, you cannot uninstall any installed update. Use only when you are certain you won’t need rollback.

3. Clean service pack backups (legacy)

Dism.exe /online /Cleanup-Image /SPSuperseded

Targets backup files from service packs. Effective on Windows 8.1 and earlier; on Windows 10/11 the flag may produce no effect but remains safe.

4. Extended Disk Cleanup

cmd.exe /c Cleanmgr /sageset:65535 & Cleanmgr /sagerun:65535

Opens Disk Cleanup with advanced options including “Windows Update Cleanup” and “Delivery Optimization Files”. Tick desired categories, then run automatically. Repeat every 30 days.

5. One‑time graphical Disk Cleanup

cleanmgr

Launches the standard Disk Cleanup GUI. Click “Clean up system files” to access WinSxS‑related categories.

Troubleshooting & Common Errors

Performance Considerations

WinSxS cleanup performance depends on the chosen DISM flags and system load. The /StartComponentCleanup switch processes a batch of superseded components; adding /ResetBase compresses the entire component store, increasing I/O but reducing future growth. The /SPSuperseded variant targets only service pack backups, offering a faster but narrower cleanup. These flags act as batch-size and depth knobs—no separate buffer-size, MTU, or timeout parameters exist in the DISM WinSxS interface. Windows internally manages parallelism at the component servicing layer; no user‑tunable concurrency is exposed. For disk‑cleanup automation, the Cleanmgr tool with /sageset:65535 and /sagerun:65535 lets you pre‑select categories (e.g., “Windows Update Cleanup”) that reduce WinSxS size in a single batch. Microsoft recommends running these commands during low‑usage periods to avoid competing with foreground processes.

• Batch size: /StartComponentCleanup /ResetBase processes all eligible components in one pass; omit /ResetBase for a smaller batch that leaves current baseline intact.
• Cleanup scope: /SPSuperseded narrows the batch to superseded service packs only; reduces time but leaves other obsolete components.
• Disk cleanup batch: /sageset:65535 saves a preset of selected categories; /sagerun:65535 executes them as a single batch, combining WinSxS cleanup with temporary file removal.

Security and Operational Best Practices

Reducing the WinSxS folder size on Windows 10 (version 1607 and later) must follow strict operational guidelines to avoid system corruption and security gaps. Microsoft strongly recommends using only the official tools: Deployment Imaging Service and Management Tool (DISM) and Disk Cleanup (cleanmgr). The recommended commands are:

• Least-privilege (IAM): Execute cleanup operations only from an administrator account created solely for maintenance. Avoid running as the built-in Administrator or SYSTEM. Use User Account Control (UAC) elevation to minimize attack surface. For remote management, enforce Kerberos authentication and restrict PowerShell Remoting to authorized admin accounts.
• Authentication/Network knobs: Not applicable to local file system operations. If managing remotely via WinRM, ensure encrypted sessions using HTTPS with certificate validation.
• Audit & Logging hooks: Enable process creation auditing (Event ID 4688) to log each execution of dism.exe or cleanmgr.exe. Review the DISM log at C:WindowsLogsDISMdism.log for cleanup errors (error codes 3, 99). Use wevtutil and PowerShell to query Security and System logs.

# Audit: Query Security log for DISM/Cleanmgr process starts
wevtutil qe Security /q:"*[System[EventID=4688 and (EventData[Data[@Name='ProcessName']='C:WindowsSystem32dism.exe'] or EventData[Data[@Name='ProcessName']='C:WindowsSystem32cleanmgr.exe']]]" /c:5 /f:text

# Audit: Display recent DISM cleanup lines from dism.log (PowerShell)
Get-Content $env:SystemRootLogsDISMdism.log -Tail 20 | Select-String "Cleanup-Image","error"

# Operational: Run component cleanup with reset base
Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase

dism /online /Cleanup-Image /StartComponentCleanup
dism /online /Cleanup-Image /StartComponentCleanup /ResetBase

dism /online /Cleanup-Image /AnalyzeComponentStore

dism /online /Cleanup-Image /RestoreHealth
sfc /scannow
dism /online /Cleanup-Image /StartComponentCleanup

# Windows Server 2012 R2+
dism /online /Cleanup-Image /StartComponentCleanup /ResetBase
# Legacy check
dism /online /Get-CurrentEdition

# Fastest safe cleanup
dism /online /Cleanup-Image /StartComponentCleanup
# For deepest reduction (rollback disabled)
dism /online /Cleanup-Image /StartComponentCleanup /ResetBase