Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm managing a Windows Server 2003. A couple of times the server has crashed with error message saying that the C: drive is full. After searching folders to free up space, I found that lot of temp files being created in C:\WINNT\Temp and some of them of enormous size with more than 2GB. The temp files seem to have a common name pattern, Efs###.tmp. Since we encrypt files frequently using Windows's EFS, I initially suspected Windows encryption. But as per the documentation, Efs###.tmp are created only under the folder which is currently being encrypted, not in Temp folder.

This looks very strange; unless someone tried to encrypt that Temp folder itself, the temp files(Efs###.tmp) shouldn't be created under C:\WINNT\Temp. The server has Tivoli Backup client. Could that be messing with windows Encryption? Can anyone shed some light on what could be causing the issue?

Note:Edited for brewity

share|improve this question
what backup software do you use – tony roth May 25 '10 at 21:13
Tivoli storage client – BlueGene May 26 '10 at 2:43
ok not familiar with tivoli storage client but the storage software that I use creates a snapshot of the largest file. It stored these in the windows\temp directory. So if you have a 4 gig file it will consume another 4 gigs just for the backup. Not sure if this has anything to do with your issue though. – tony roth May 26 '10 at 14:47
how fequently do you have the problem? – tony roth May 28 '10 at 17:33
up vote 2 down vote accepted

I'd setup File Monitor with a suitable filter and leave it running. Or have it triggered by Performance Monitor. Certainly leave Perfmon running to see the time as this might give an indication of a cronjob running at the same time etc..

share|improve this answer
File Monitor or the PA File Sight demo -- both can tell you what app is creating those files. – DougN Jun 2 '10 at 2:24

Have you tried to unencrypt these files? You can also use the efsinfo command from the Resource kit to get more information about the files.

Cipher /d /a Efs###.tmp
share|improve this answer
Thanks...I get a message saying that the file is not encrypted when I try to decipher. But the file content is garbled – BlueGene Jun 2 '10 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.