Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Logs
  4. CBS
  5. CbsPersist_<AAAAMMJJhhmmss>.cab
FileRisk: Safe

CbsPersist_<AAAAMMJJhhmmss>.cab C:\Windows\Logs\CBS\CbsPersist_<AAAAMMJJhhmmss>.cab

CbsPersist_<date>.cab: compressed archives of CBS.log, created when it reaches its size limit. Useful for tracing older update errors.

Updated on By AltF4 Formation

What it’s for

When CBS.log reaches its size limit, the servicing stack (Component-Based Servicing) compresses it into a CbsPersist_YYYYMMDDhhmmss.cab archive in the same folder, then starts a fresh CBS.log. The archives keep the history of older updates, so this is where you look for an error that is no longer in the current log.

What it contains

  • One .cab per archive, holding a copy of the CBS.log of the time (and sometimes other logs).
  • A name carrying the date and time of the compression, so you can find the right period.

Risks and best practices

  • They are logs: you can delete them with no consequence for Windows, for example to free disk space. Keep them if an update incident is under analysis.
  • Extract them into a working folder, not into C:\Windows.

Useful commands

Fenêtre de terminal
# List the archives
Get-ChildItem "$env:windir\Logs\CBS\CbsPersist_*.cab" | Sort-Object LastWriteTime | Select-Object Name, Length, LastWriteTime


# Extract an archive into a working folder
New-Item -ItemType Directory -Path "$env:TEMP\cbs" -Force | Out-Null
expand.exe -F:* "$env:windir\Logs\CBS\CbsPersist_YYYYMMDDhhmmss.cab" "$env:TEMP\cbs"


# Delete archives older than 90 days (as administrator; -WhatIf to simulate)
Get-ChildItem "$env:windir\Logs\CBS\CbsPersist_*.cab" | Where-Object LastWriteTime -lt (Get-Date).AddDays(-90) | Remove-Item -WhatIf

Report a mistake