Logs C:\Windows\Logs

Folder of Windows servicing text logs (CBS, DISM, Windows Update, MoSetup), not to be mistaken for the .evtx event logs.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

C:\Windows\Logs gathers the text logs of the components that install, update and repair Windows. This is where you look to find out why an update, an sfc run or a DISM run failed. Do not confuse it with the event logs (.evtx files in System32\winevt\Logs), which you read with Event Viewer.

What it contains

CBS: Component-Based Servicing log, including CBS.log (servicing operations and sfc results).
DISM: log of the DISM tool (dism.log).
WindowsUpdate: Windows Update agent traces.
MoSetup (Modern Setup of upgrades) and DPX (extraction of update packages). NetSetup and SIH also appear depending on the version and components.

Risks and best practices

Keep these logs during an incident: CBS.log and dism.log are the first files support asks for after a failed update or repair.
To reclaim space, first copy the old large files if an analysis is in progress, then delete them. Keep the folder itself: Windows recreates it, but the history is gone.
The logs cite machine names, user names and paths, so scrub them before sharing.

Useful commands

# Size of each subfolder
Get-ChildItem "$env:windir\Logs" -Directory -Force | ForEach-Object {
  $b = (Get-ChildItem $_.FullName -Recurse -Force -File -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum
  [pscustomobject]@{ Folder = $_.Name; 'Size (MB)' = [math]::Round($b / 1MB, 1) }
}

# The 10 most recently modified files
Get-ChildItem "$env:windir\Logs" -Recurse -File -Force -ErrorAction SilentlyContinue | Sort-Object LastWriteTime -Descending | Select-Object -First 10 FullName, LastWriteTime

Folder contents

Folders 6

Report a mistake