FolderRisk: Safe
Temp C:\Windows\Temp
C:\Windows\Temp: temporary folder of the System account, services and elevated installers. Safe to empty, except files in use.
What it’s for
The TEMP and TMP system variables point here: it is the temporary folder of the System account, so of services, installers and programs run as SYSTEM. The GetTempPath API also falls back to it as a last resort when TMP, TEMP and USERPROFILE are missing. Local Service and Network Service have their own temporary folder in their profile under ServiceProfiles.
What it contains
- Temporary files from services, updates, MSI installers or programs run as administrator.
- Installation logs and temporary extractions.
- Files locked by running services.
Risks and best practices
- The content can be deleted safely, except for files in use, which Windows refuses to erase. You need administrator rights to write to the folder.
- Empty the contents, not the folder: Windows and services rely on its existence and permissions. Avoid doing it during an installation or an update.
- Unusual growth often points to a faulty service or installer: look at the largest files and their dates to find the culprit.
- Take a look during a security analysis: programs running with elevated rights drop files here.
Useful commands
# The 10 largest files, to find what is making it growGet-ChildItem "$env:windir\Temp" -Recurse -Force -File -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 10 FullName, Length, LastWriteTime
# As administrator: simulate cleaning files older than 7 daysGet-ChildItem "$env:windir\Temp" -Recurse -Force -File -ErrorAction SilentlyContinue | Where-Object LastWriteTime -lt (Get-Date).AddDays(-7) | Remove-Item -Force -ErrorAction SilentlyContinue -WhatIf