FolderRisk: Safe
Temp C:\Users\<utilisateur>\AppData\Local\Temp
The user's temporary files (%TEMP% and %TMP% variables). Can be deleted, except for files in use.
What it’s for
%TEMP% and %TMP% point here for each user. When an application has no other instruction, it writes its working files to this folder: an installer extraction, the preview of an attachment opened directly, a partial download. To find the folder, the GetTempPath function checks TMP, then TEMP, then USERPROFILE, then the Windows directory.
What it contains
- Temporary files and folders from applications, installers and attachments opened directly.
- Leftovers from applications that were closed abruptly.
- Files in use, locked for as long as the application is running.
Risks and best practices
- Empty the contents with applications closed and skip locked files. Keep the folder itself, since some applications assume it exists.
- Do not keep anything important here; the folder can be emptied at any time.
- A volume filled by
Tempoften points to a faulty application. Identify it rather than clearing the folder regularly. - Malware likes to drop files here. Do not run unknown files from this folder.
Useful commands
# Effective path and size$env:TEMPGet-ChildItem $env:TEMP -Recurse -Force -ErrorAction SilentlyContinue | Measure-Object -Property Length -Sum
# Simulate deleting files older than 7 daysGet-ChildItem $env:TEMP -Recurse -Force -ErrorAction SilentlyContinue | Where-Object LastWriteTime -lt (Get-Date).AddDays(-7) | Remove-Item -Recurse -Force -WhatIf