Large temp files created in Windows Server 2003 temp folder

Question

I'm managing a Windows Server 2003. A couple of times the server has crashed with error message saying that the C: drive is full. After searching folders to free up space, I found that lot of temp files being created in C:\WINNT\Temp and some of them of enormous size with more than 2GB. The temp files seem to have a common name pattern, Efs###.tmp. Since we encrypt files frequently using Windows's EFS, I initially suspected Windows encryption. But as per the documentation, Efs###.tmp are created only under the folder which is currently being encrypted, not in Temp folder.

This looks very strange; unless someone tried to encrypt that Temp folder itself, the temp files(Efs###.tmp) shouldn't be created under C:\WINNT\Temp. The server has Tivoli Backup client. Could that be messing with windows Encryption? Can anyone shed some light on what could be causing the issue?

Note:Edited for brewity

ok not familiar with tivoli storage client but the storage software that I use creates a snapshot of the largest file. It stored these in the windows\temp directory. So if you have a 4 gig file it will consume another 4 gigs just for the backup. Not sure if this has anything to do with your issue though. — tony roth, May 26 '10 at 14:47

score 2 · Accepted Answer · answered Jun 01 '10 at 20:55

2

I'd setup File Monitor with a suitable filter and leave it running. Or have it triggered by Performance Monitor. Certainly leave Perfmon running to see the time as this might give an indication of a cronjob running at the same time etc..

answered Jun 01 '10 at 20:55

Luke Puplett

939
3
16
24

File Monitor or the PA File Sight demo -- both can tell you what app is creating those files. – DougN Jun 02 '10 at 02:24

score 1 · Answer 2 · answered May 28 '10 at 16:27

1

Have you tried to unencrypt these files? You can also use the efsinfo command from the Resource kit to get more information about the files.

Cipher /d /a Efs###.tmp

answered May 28 '10 at 16:27

citadelgrad

716
6
12

Thanks...I get a message saying that the file is not encrypted when I try to decipher. But the file content is garbled – BlueGene Jun 02 '10 at 14:48

Large temp files created in Windows Server 2003 temp folder

2 Answers2