[German]Does cumulative update KB4505903, released July 26, 2019, for Windows 10 V1903 fills the system disk with useless event entries? I received a message from a blog reader, that indicates this behavior. Now we have been able to identify MicrosoftOfficeHub as a root cause.
Update KB4505903 for Windows 10 V1903
Cumulative Update KB4505903 is available for Windows Version 1903 and Windows Server Version 1903. The patch was released on July 26, 2019 after extensive tests with Windows insiders and various improvements by Microsoft and increases the build number to 18362.267. The update contains quality improvements, but no new operating system functions. I had reported about details in the blog post Windows 10 V1903 Update KB4505903 (07/26/2019).
Hard disk filled with thousands of evtx files
I have not yet installed the update on my test systems because it has some known issues. Now German blog reader Olaf E. e-mailed me for the weekend and reported about an observation, which I simply set.
Windows 10 with new cumulative update kb4505903, which by the way installed twice, now up to date.
Afterward I actually only checked different hardware drivers (because AMD, SATA and memory controller etc. for updates) in the hardware manager, when I noticed that there is no more space on my 150 GB system drive.
OK, I deleted all files in temp folder. After updating the hardware, I restarted the system as a precaution. After restart I have had a look into C:\Windows\Temp and xyz-event-files will be created again; probably until hard disk is full.
I certainly didn’t catch a virus (yet) (:-), because I hardly installed anything, but only prepared it -> I wanted to have a VHDX template for trying it out in Hyper-V or under Linus in VM…. But with this “Error”…
If you search the Internet, you will come across this older case, for example, which describes something similar. Short question to the Windows 10 V1903 users who have already installed the cumulative update KB4505903: Can this be confirmed? If so, is there a workaround?
Addendum: The root cause has been identified
Blog reader Olaf E. sent me two more e-mails with new information after I had set the problem here in the blog. Here is the first e-mail.
Thanks, the hard disk, even my 110 GB (volume c), was incredibly full. The del /F/Q/S *.* command couldn’t even delete so fast. I also thought at first, of a remote hack. But the files will also be 11 MB in size.
Therefore first I pulled the LAN cable. Inserted in RunOnce the command del /F/S/Q *.* and restarted. The disk still becomes full with events.
Found a workaround (switch off AppStore): deactivate AppXSvc on StartType four or via GPO Store. Restart and clean the temp folder, which then remains empty! Unfortunately, the start menu and taskbar were then inoperable! So I activated AppXSvc again
Steps for app repair executed as described at deskmodder.de – but before that cleaned the folder:
I deleted everything, because it will be created again. Then I restarted Windows. The issue wasn’t that strange anymore. Now ‘only’ an uncountable number of AppXError-GUID-*.txt (1 kB) files are created – but which App/s are responsible?
Turning off the app store was also a workaround in one of the above linked posts. In a second mail Olaf E. revealed the cause:
Now it is ONLY the MicrosoftOfficeHub*number* with ErrorCode: 80073CF6 resp. 800700B7 with Component Deployment Operation: 4294967293
And only these; every second and in thousands and thousands of *.txt-files. But I can search for them well. Thanks to all ;-)
The MicrosoftOfficeHub has already been discussed within my blog post Windows 10: News about System restore error 0x80070091 as a trouble maker. At that time the file permissions were broken. The above mentioned error code 0x80073CF6 stands for ERROR_INSTALL_REGISTRATION_FAILURE. The MicrosoftOfficeHub app can probably not be registered during installation