I'm managing a Windows Server 2003. A couple of times the server has crashed with error message saying that the C: drive is full. After searching folders to free up space, I found that lot of temp files being created in C:\WINNT\Temp and some of them of enormous size with more than 2GB. The temp files seem to have a common name pattern, Efs###.tmp. Since we encrypt files frequently using Windows's EFS, I initially suspected Windows encryption. But as per the documentation, Efs###.tmp are created only under the folder which is currently being encrypted, not in Temp folder.

This looks very strange; unless someone tried to encrypt that Temp folder itself, the temp files(Efs###.tmp) shouldn't be created under C:\WINNT\Temp. The server has Tivoli Backup client. Could that be messing with windows Encryption? Can anyone shed some light on what could be causing the issue?

Note:Edited for brewity

  • what backup software do you use – tony roth May 25 '10 at 21:13
  • Tivoli storage client – BlueGene May 26 '10 at 2:43
  • ok not familiar with tivoli storage client but the storage software that I use creates a snapshot of the largest file. It stored these in the windows\temp directory. So if you have a 4 gig file it will consume another 4 gigs just for the backup. Not sure if this has anything to do with your issue though. – tony roth May 26 '10 at 14:47
  • how fequently do you have the problem? – tony roth May 28 '10 at 17:33

I'd setup File Monitor with a suitable filter and leave it running. Or have it triggered by Performance Monitor. Certainly leave Perfmon running to see the time as this might give an indication of a cronjob running at the same time etc..

  • File Monitor or the PA File Sight demo -- both can tell you what app is creating those files. – DougN Jun 2 '10 at 2:24

Have you tried to unencrypt these files? You can also use the efsinfo command from the Resource kit to get more information about the files.

Cipher /d /a Efs###.tmp
  • Thanks...I get a message saying that the file is not encrypted when I try to decipher. But the file content is garbled – BlueGene Jun 2 '10 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.