Windows 8.1 Automatic Maintenance - What's REALLY going on under the hood?

Question

I have been playing around with Windows 8.1 with a view to upgrade from Windows 7. The one thing holding me back is the insane amount of Automatic Maintenance that occurs.

My test:

• Decent PC (i5-3570 CPU @ 3.4GHz, 8GB DDR3 RAM, Intel SSD 520 120GB HDD)
• Fresh install (hard drive secure-erased first)
• System Restore, Windows Defender, and Scheduled Defrag disabled by Group Policy
• All Windows Updates installed
• Nothing else

The first round of maintenance took 3 hours to complete. Thereafter, every single day, maintenance kicks in during idle and completes in about 30 minutes.

Question: Has anyone done any kind of thorough investigation into what is actually happening during this maintenance? I have read Microsoft's documentation/blogs but nothing specific is revealed. Like what files are being hit, how they're being processed, what's being written, changed, or logged.

I just can't wrap my head around what's going on that requires 3.4 GHz of desktop i5 processing power for that length of time.

Answer 1

"Automatic Maintenance" is a potential time at which scheduled tasks can be run. There's some default ones, but any piece of software that adds scheduled tasks can add one to be run "at maintenance time".

Unfortunately Task Scheduler does not seem to display these tasks. But when maintenance is running, you can see what it is doing by opening Task Scheduler and choosing "display all running tasks" or running via schtasks | find "Running" at a command prompt.

You can see what it's going to do via schtasks | find "Queued".

I haven't fully verified this but it seems you can get the full list at any time by running schtasks /query /xml > tasks.xml and then searching the generated tasks.xml for any task with the element UseUnifiedSchedulingEngine and MaintenanceSettings.

Based on my install, here's the list in Windows 10. Note that not all of these necessarily run every Maintenance pass, and I couldn't find documentation for all of them.

• SmartScreenSpecific: updates application signatures for SmartScreen.
• ProgramDataUpdater: sends program telemetry data for Microsoft Customer Experience. Equivalent to compattelrunner -maintenance.
• StartupAppTask: scans startup apps and warns the user if there are too many. rundll32 Startupscan.dll,SusRuntask
• CleanupTemporaryState: clears temporary files in AppX (Metro/UWE) app packages. rundll32 Windows.Storage.ApplicationData.dll,CleanupTemporaryState.
• DsSvcCleanup: runs dstokenclean. Nobody seems to be sure what this does.
• Pre-Staged App Cleanup: part of the AppX cleanup process. rundll32 AppxDeploymentClient.dll,AppxPreStageCleanupRunTask.
• ProactiveScan: Does a chkdsk scan.
• BthSQM: something to do with Bluetooth SQM.
• KernelCeipTask: sends kernel telemetry data to Microsoft Customer Experience.
• UsbCeip: sends device driver telemetry data to Microsoft Customer Experience.
• ScheduledDefrag: runs the Windows Defragmenter: defrag -c -h -o -$. This is often the task that takes the longest. Oddly, the -h switch makes it run at normal instead of low priority, which is odd for automatic maintenance.
• Diagnosis\Scheduled: runs Windows Diagnostics.
• SilentCleanup: runs Disk Cleanup: cleanmgr /autoclean /d %systemdrive%.
• DiskDiagnosticDataCalculator: runs disk diagnostics. rundll32 dfdts.dll,DfdGetDefaultPolicyAndSMART.
• DiskFootprint\Diagnostics: runs disksnapshot -z. Nobody seems to be quite sure what this does, but it may be to do with Volume Shadow Copy.
• DiskFootprint\StorageSense: presumably this updates the Storage Sense statistics on the amount of space used by different file categories.
• ErrorDetailsUpdate. No clear information about this, but it's likely to do with collecting updates to system errors previously reported.
• Siuf\DmClient. SIUF is System Initiated User Feedback, so this is likely to do with the poll messages that can appear in Windows 10.
• File History Maintenance Mode. Runs a File History backup.
• IME\SQM Data Sender: This is presumably something to do with telemetry of unusual input methods (IME).
• TempSignedLicenseExchange. Probably something to do with temporary Windows licenses.
• WinSAT. Runs Windows System Assessment Tool, presumably for more telemetry.
• RunFullMemoryDiagnostic: what it sounds like; a RAM diagnostic.
• LPRemove: runs lpremove which removes unnecessarily or unusable language packs.
• Plug And Play Cleanup: clears the state information for any Plug and Play devices which haven't been used for 30 days.
• AnalyseSystem: runs Power Efficiency Diagnostics.
• VerifyWinRE: checks the Windows Recovery Environment is intact.
• RegIdleBackup: makes a backup of the registry.
• MRTHB: runs MRT /EHB /Q. This is the Malicious Software Removal tool, so this is likely a security scan.
• StartComponentCleanup: cleans up the WinSxS directory that holds optional Windows component images.
• SettingSync\BackgroundUploadTask: uploads settings if you're using cloud sync.
• SettingSync\BackupTask.
• AccountCleanup: cleans up ancient user profiles on network shared machines.
• FamilySafetyUpload: upload logs from the parental control component.
• IndexerAutomaticMaintenance: update search indexes.
• SkyDrive\Idle Sync Maintenance Task, SkyDrive\Routine Maintenance Task: syncs SkyDrive documents.
• HybridDriveCachePrepopulate, HybridDriveCacheRebalance: Not fully documented, but likely tries to ensure that the SSD part of any hybrid drives attached has useful stuff in it.
• ResPriStaticDBSync.
• WsSwapAssessmentTask. This is presumably something to do with virtual memory.
• SystemRestore. srtasks ExecuteScheduledSPPCCreation. Makes a Restore Point.
• SynchronizeTime. sc start w32time task_started. Syncs the system clock.
• SynchronizeTimeZone. tzsync. Connected to the above.
• Maintenance Install. usoclient StartInstall. Installs any Windows Updates that have been downloaded but not installed yet.
• Work Folders Maintenance Work. Relates to the Work Folders file sharing server system.

Answer 2

One more thing on the disabled services for me. I would't want my system to wake up on its own for 'maintenance'.

Anyway, when it runs, take a look at what processes your machine is currently running (consuming most of the CPU/RAM). This usually leads to a good indication of what the automatic maintenance is doing.

The good it does (in-theory): It runs defrag (useless on SSDs - it uses trim instead), anti-malware (nearly useless), checks some of it's .dll files (useless since they are alter-protected and mirrored) and searches for registry/configuration conflicts (finally something good), optimizes .NET-related stuff, digs into error reports.

The bad (in practice): Can cause crashes, break network connections, alter advanced system custom configuration.

Verdict: turn off.

Answer 3

There are a good number of tasks that can be run as part of auto maintenance in Windows 8.1, the most common being malware protection scans/updates, and disk optimization. Given that you're running with an Intel SSD, no defragmentation takes place during disk optimization - only TRIM (SSD write performance optimization, typically completes in less than 1 minute on a drive of that size). If you're seeing it run for 30 minutes, it's so tempting to say that it's probably the Windows Defender service... Are you certain it's not still running? Consider checking Task Manager - see what's using up the largest percentage of CPU or Disk resources durning that time and that will likely give you the culprit. And while that is a decent PC build, keep in mind that any of those components can still become the performance bottleneck during some lengthy job. Auto maintenance is intended to be something that runs without you ever even needing to take any notice of it; if it's catching your eye, you might just consider changing the settings so that it runs at a different time of day when you don't typically utilize the system, and just let it do its thing.

Answer 4

The maintenance does several things.

• optimizing the HDD with defrag or sending TRIM to SSDs
• optimizing the .net files via ngen, to later improve the performance (reduce memory usage and improve startup times) of .net applications
• free some HDD space by removing updates which are replaced by newer ones and compressing unsued files which can't be removed into difference data. This takes the longest time and causes most of the CPU usage.