u/Adobe_Track2011

Hey all, hoping someone with PVS experience can help.

Setup: Citrix PVS, master image in Standard Image Mode, targets boot from a shared read-only vDisk with a write cache. The problem: when stuff gets written to C:, the write cache VHDX grows and grows, and once it gets too big the machine hangs/freezes. Classic write cache exhaustion, I think.

I understand the cache only grows and never shrinks until reboot, so I've been trying to track down what's generating all the writes. So far I've identified a few usual suspects:

• Antivirus agent continuous log writes plus pattern/definition churn
• Vulnerability assessment agent writes logs and job/scan result data, plus a filesystem-walker process that crawls the disk for assessments
• Software distribution / management agent cache and state data

What we've already done:

• Redirected several log and cache folders to a separate persistent local drive via symbolic links, to keep them out of the write cache. This helped, but the VHDX is still growing more than I'd like. So there are clearly other writers I haven't pinned down yet.
• Defragmented C: in the master image before sealing
• Various DISM cleanup commands (component store cleanup etc.)
• Checked and disabled all auto-updates (Windows Update, Store, and the agents own self-update mechanisms)
• Disabled unnecessary scheduled tasks

What I'm trying to figure out:

1. Best way to actually measure which folders are growing in the write cache. I tried Process Monitor but it keeps crashing and the output is overwhelming. I can't narrow anything down with it.

Any pointers appreciated. Thanks!