Deleting all users WER (Windows error reporting) files

Question

Hi,
I am using windows server 2008 R2 (Standard), I have created around 120 users in this server, yesterday i found that my C drive is full, after checking all i found around 30GB is used for Windows error reporting files, Please help me to delete This files
Please, i cant delete all files one by one...

Answer 1

For what it's worth, this is the script I use to find Windows Error Reports that have not been sent, and delete archived Windows Error Reports:
It's not currently doing per-user error reports, as we don't have people logging into the servers, typically.
Karl
<#
.SYNOPSIS
Find-WER - Finds Windows Error Reports that have not been sent to Microsoft.
.DESCRIPTION
This script finds Windows Error Reports that have not been sent to Microsoft.
This script also deletes archived Windows Error Reports.
.NOTES
File Name: Find-WER.ps1
Author: Karl Mitschke
Requires: Powershell V2
Created: 12/16/2011
.EXAMPLE
C:\PS>.\Find-Wer.ps1
Description
Finds Windows Error Reports on the local computer.
.EXAMPLE
C:\PS>.\Find-WER -Computer Exch2010
Description
Finds Windows Error Reports on the computer Exch2010.
.EXAMPLE
C:\PS> Get-ExchangeServer | Find-WER
Description
Finds Windows Error Reports on all Exchange servers.
.EXAMPLE
C:\PS> $cred = Get-Credential -Credential mitschke\karlm
C:\PS>.\Find-WER.ps1 -ComputerName (Get-Content -Path ..\Servers.txt) -Credential $cred
Description
Finds Windows Error Reports on all servers in the file Servers.txt.
.PARAMETER ComputerName
The Computer(s) to search for Windows Error Reports. If not specified, defaults to the local computer.
.PARAMETER Credential
The Credential to use. If not specified, runs under the current security context.
#>
[CmdletBinding(SupportsShouldProcess=$true, ConfirmImpact='Medium')]
param (
[parameter(
Position = 1,
Mandatory=$false,
ValueFromPipeline=$true)
[String[]]$ComputerName=$Env:ComputerName,
[Parameter(
Position = 2,
Mandatory = $false,
ValueFromPipeline=$false)
$Credential
BEGIN{
#region PSBoundParameters modification
if ($Credential -ne $null -and $Credential.GetType().Name -eq "String"){
$PSBoundParameters.Remove("Credential") | Out-Null
$PSBoundParameters.Add("Credential", (Get-Credential -Credential $Credential))
$PSBoundParameters.Remove("WhatIf") | Out-Null
#endregion
$ReportPath = "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue"
$ArchivePath = "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive"
$FoundReport = $false
$DeleteFailure = $false
PROCESS {
$PSBoundParameters.Remove("ComputerName") | Out-Null
foreach ($StrComputer in $ComputerName){
$Count = @((Get-WmiObject Win32_Directory -Filter "Name= '$ReportPath'" -ComputerName $StrComputer @PSBoundParameters).GetRelated('Win32_directory') |? {$_.name -match $ReportPath}).Count
if ($Count -gt 0){
Write-Warning "There are $Count Windows Error Reports on $StrComputer."
$FoundReport = $true
Else{
Write-Output "There are no Windows Error Reports on $StrComputer."
$Archives = @((Get-WmiObject Win32_Directory -Filter "Name= '$ArchivePath'" -ComputerName $StrComputer @PSBoundParameters).GetRelated('Win32_directory') |? {$_.name -match $ArchivePath})
if ($Archives.Count -gt 0){
Write-Output "Deleting Archived Windows Error Reports on $StrComputer."
foreach ($Folder in $Archives)
if ($pscmdlet.ShouldProcess($($StrComputer), "Deleting '$($folder.name.split("\")[-1])'")){
$Return = $Folder.Delete()
if ($Return.ReturnValue -ne 0){
$DeleteFailure = $true
if ($DeleteFailure -eq $true){
Write-Warning "Could not delete all Archived Windows Error Reports on $StrComputer."
END {
If ($FoundReport){
Write-Warning "Remember to run the Action items on the servers."
else{
Write-Output "There are no Windows Error Reports."
When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
My Blog: Unlock PowerShell
My Book:
Windows PowerShell 2.0 Bible
My E-mail: -join ('6F6C646B61726C406F75746C6F6F6B2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}})