Heads up - InTune filling C: drive

[gshaw]

Public service announcement, we had reports of machines filling their drives yesterday and this morning. Upon investigation it's a winget log, now acknowledged as an issue in M365 Admin portal.

 

In the meantime there's a Remediation script on the Reddit thread here:

 

 

[mitchell1981]

The Admin Centre report says:

 

More Info:

While we're focused on remediation, admins may be able to delete the contents of the "%windir%\Temp\WinGet\defaultState" folder and restart the device to temporarily mitigate the issue.

 

Scope of Impact:

This issue may potentially affect any user with a Windows Intune device utilizing the Intune Store application.

 

Root Cause:

A recent update to the Intune Store application version contains a code issue that is causing error logging to take up too much disk space.

 

 

Can anyone confirm what they mean by the InTune Store Application. Is this a different thing from Company Portal?

 

 

Edited October 9, 2025 by mitchell1981

[gshaw]

19 minutes ago, mitchell1981 said:

The Admin Centre report says:

 

More Info:

While we're focused on remediation, admins may be able to delete the contents of the "%windir%\Temp\WinGet\defaultState" folder and restart the device to temporarily mitigate the issue.

 

Scope of Impact:

This issue may potentially affect any user with a Windows Intune device utilizing the Intune Store application.

 

Root Cause:

A recent update to the Intune Store application version contains a code issue that is causing error logging to take up too much disk space.

 

 

Can anyone confirm what they mean by the InTune Store Application. Is this a different thing from Company Portal?

 

 

 

I was wondering the same thing, we use Company Portal and have machines with drives filling up so... maybe?

Reddit also has the same question...

 

 

[mitchell1981]

They change names so much they don't even know what they call their own products!

 

I notice someone else says that the problem only occurs if the primary user is different from the actual user. Do you know if that was true on the devices that you had with the problem?

 

I've installed the remediation anyway just in case.

 

Thank you.

[gshaw]

1 hour ago, mitchell1981 said:

They change names so much they don't even know what they call their own products!

 

I notice someone else says that the problem only occurs if the primary user is different from the actual user. Do you know if that was true on the devices that you had with the problem?

 

I've installed the remediation anyway just in case.

 

Thank you.

The first device that I checked was set as Shared (Primary User removed) so it seems to rule out that theory

 

Ironically the InTune portal that would've allowed me to push the Remediation straight away remotely was also down due to the Azure Front Door service outage, so the onsite tech had to run the remediation sneakernet style

Edited October 9, 2025 by gshaw