IT Support Knowledge Base

← All runbooksWindows

Disk Space Low

The system drive is almost full, causing slowness, failed updates or "not enough space" errors.

Windows 10 / 11 and Linuxabout 3 min read

Symptoms

  • "Low disk space" warnings, or a red drive bar in File Explorer.
  • Windows updates or app installs fail with "not enough space".
  • The PC is slow, can't save files, or apps crash.
  • On Linux: "No space left on device" errors, services failing to write logs.

Before you start

  • Which drive is full (C: system drive or a data drive)? How much is free in total?
  • Don't delete things you don't recognise. Delete only items you know are safe (Recycle Bin, temp files, the user's own downloads after they agree).
  • Never manually delete files from C:\Windows, C:\Program Files, or /usr / /etc on Linux.

Steps

Windows

  1. See what's using space: Settings > System > Storage. Click each category (Apps & features, Temporary files, Documents) to see sizes.
  2. Empty the Recycle Bin (after confirming with the user).
  3. Remove temporary files: in Storage > Temporary files, tick Temporary files, Recycle Bin, Downloads (only if the user agrees), Windows Update Cleanup, and click Remove files. Or run Disk Cleanup (cleanmgr) and choose Clean up system files.
  4. Turn on Storage Sense (Settings > System > Storage > Storage Sense) so Windows cleans temporary files automatically.
  5. Uninstall unused programs: Settings > Apps > Installed apps, sort by size, remove what the user confirms they don't need.
  6. Find big files: sort the user's folders (Downloads, Videos, Desktop) by size in File Explorer. Free tools such as WinDirStat or TreeSize Free show a map of what uses space (check that your organisation permits installing them).
  7. Move or offload data: move large personal files to an external drive or OneDrive. With OneDrive Files On-Demand you can right-click a folder > Free up space to keep cloud files online-only (only for files already synced; check the sync status is complete first).
  8. Shrink Windows system components (optional): 
    DISM /Online /Cleanup-Image /StartComponentCleanup
    (administrator Command Prompt; can take a while). Turning off hibernation frees the hiberfil.sys file but also disables hibernate and Fast Startup: powercfg /h off (reverse with powercfg /h on). Only do this if the user agrees.
  9. If the drive is still nearly full: the PC may need a larger drive. Record the sizes and recommend an upgrade.

Linux

  1. See which filesystem is full: df -h. Also check inodes: df -i (a disk can be "full" because it ran out of file slots).
  2. Find the biggest folders (stay on one filesystem with -x): 
    sudo du -xh --max-depth=1 / 2>/dev/null | sort -h | tail -n 15
    Repeat inside the biggest folder (for example /var).
  3. Common safe cleanups (Debian/Ubuntu): 
    sudo apt clean                          # remove downloaded package files
sudo apt autoremove                     # remove no-longer-needed packages (read the list first)
sudo journalctl --vacuum-size=200M      # shrink the systemd journal to about 200 MB
  4. Large old log files in /var/log can be compressed or rotated (logrotate); don't delete a log that a running service is writing to. Truncate it instead, if approved: sudo truncate -s 0 /var/log/example.log.
  5. Deleted but still open files: sudo lsof +L1 lists deleted files still held by running programs. Restarting that program frees the space.
  6. Re-check with df -h.

Escalate when

  • It's a server or shared storage, or a database/mail volume is growing quickly.
  • The space is used by something you can't identify and aren't allowed to delete.
  • Free space keeps dropping again within days (something is filling the disk).
  • The drive reports errors or the PC needs a hardware upgrade.

Ticket note template

Issue: Low disk space on <drive/mount> of <device>
Before: __ GB free of __ GB (__%)
Biggest users of space found: <folder/app> (__ GB), <folder/app> (__ GB)
Actions (with user's OK): emptied Recycle Bin | temp files / Windows Update cleanup | uninstalled <apps> | moved <files> to <location> | Linux: apt clean / journal vacuum
After: __ GB free of __ GB (__%)
Root cause: <e.g. large downloads, old logs, small drive>
Recommendation: <upgrade drive / enable Storage Sense / log rotation>
Next step / escalated to:

View as Markdown

How to use this

  1. Search first. Type what the user is describing, like printer offline or locked out. The search reads the whole text of every runbook, not only the titles.
  2. Narrow it down if you want to. The topic links under the search box (Windows, Network, Accounts and so on) trim the list. Click one again, or pick All, to go back.
  3. Open a runbook and read down the page. Symptoms tell you if you are in the right place. Before you start lists the quick questions. Then work through Steps in order, simplest first.
  4. Know when to stop. The shaded Escalate when box lists the signs that it is time to hand the ticket on. If any one of them matches, stop and escalate.
  5. Copy the ticket note. The last section has a note template. Press Copy, paste it into your ticketing system, and fill in the blanks.
Words you will see
Runbook
A written set of steps for one kind of problem, so you do not have to work it out from scratch each time.
First-line support
The first person a user talks to. Fixes the common problems and passes the rest on.
Escalate
Hand a ticket to someone with more access or experience, with notes so they do not have to start over.
Scope
How many people or devices are affected. One laptop and the whole office are very different problems.
Ticket note
A short written record of what was reported, what you tried and what happened.

Why I built this

I'm a computer science student in Toronto and I'm looking for junior IT support and help desk roles. When I started practising troubleshooting, I noticed I knew a lot of individual fixes but not a calm order to try them in, or when to stop and hand a problem on.

So I wrote these twelve runbooks to put that in order for myself, and I built this site so they are easy to search and read. They come from public vendor documentation and common help desk practice. They are not copied from a workplace and they are not real tickets.

They are still a work in progress. If a step looks wrong or something is missing, I would like to know.