How to Clear the Windows Component-Based Servicing (CBS) Logs Cache via PowerShell

The Silent SSD Killer

In the background of every modern Windows operating system, the Component-Based Servicing (CBS) engine is constantly working. The CBS engine (primarily driven by the TrustedInstaller.exe service) is responsible for unpacking Windows Updates, modifying deeply integrated system files, injecting device drivers, and adding or removing optional Windows Features. It is the absolute core of the OS upgrade architecture.

Because the CBS engine handles highly dangerous, low-level file manipulations, it logs every single action it takes into massive text files located in the C:\Windows\Logs\CBS\ directory. Under normal circumstances, Windows automatically compresses these text files into .cab archives when they reach 50 Megabytes in size, and eventually deletes the oldest archives.

However, if the Windows Update engine becomes corrupted, or if a specific patch enters an infinite installation loop, the CBS engine will generate gigabytes of log data per hour. Furthermore, the makecab.exe compression engine can crash when trying to archive a corrupted log file that is locked by the system. This results in the C:\Windows\Logs\CBS\ folder silently swelling to 50GB, 100GB, or even 200GB, completely filling the server’s hard drive and bringing production databases to a halt. To recover the server, you must forcefully terminate the update services and purge the CBS logs via PowerShell.

Locating the CBS Log Archive

The logs are located at C:\Windows\Logs\CBS\.

You cannot simply open File Explorer and hit delete. The primary cbs.log file is locked 24/7 by the TrustedInstaller service. Attempting to delete it via the GUI will result in an “Action cannot be completed because the file is open in another program” error.

Purging the Cache via PowerShell

You must open an elevated PowerShell session as an Administrator. We must violently stop the underlying system services to release the NTFS file locks before initiating the deletion.

Step 1: Stopping the Windows Modules Installer

The TrustedInstaller service is officially known as the Windows Modules Installer. You must stop it to release the lock on cbs.log.

Stop-Service -Name TrustedInstaller -Force -ErrorAction SilentlyContinue

Step 2: Stopping the Windows Update Engine

To ensure no background update tasks instantly restart the installer, stop the primary Windows Update service as well.

Stop-Service -Name wuauserv -Force -ErrorAction SilentlyContinue

Step 3: Obliterating the Logs

Now that the services are dead and the file locks are released, we can aggressively delete the logs. We will delete both the active text logs and the massive backlog of .cab archives.

$CBS_Dir = "C:\Windows\Logs\CBS"

if (Test-Path $CBS_Dir) {
    # Delete the active text files
    Remove-Item -Path "$CBS_Dir\*.log" -Force -ErrorAction SilentlyContinue
    
    # Delete the compressed archives
    Remove-Item -Path "$CBS_Dir\*.cab" -Force -ErrorAction SilentlyContinue
    
    Write-Host "CBS Log directory successfully purged." -ForegroundColor Green
}

Step 4: Restarting the Services

With the hard drive space immediately reclaimed (often freeing up dozens of gigabytes instantly), you must restart the services to return the server to a healthy state.

Start-Service -Name TrustedInstaller
Start-Service -Name wuauserv

The Aftermath

When the TrustedInstaller service starts back up, it will realize the cbs.log file is missing. It will simply create a brand new, empty, 0-byte cbs.log file and begin logging its routine operations normally.

Crucial Warning: While purging these logs is completely safe and will not break the operating system (it only deletes diagnostic text), it destroys the historical record of why the updates were failing. If the CBS folder rapidly fills up to 50GB again within a few days, you have a catastrophic corruption in the Windows Component Store (WinSxS). You will need to run the DISM /Online /Cleanup-Image /RestoreHealth command to repair the underlying OS image before the runaway logging will permanently stop.