Delete Shadow Copies CMD: Vssadmin & Diskshadow Guide

Your C: drive is red. The notification bar keeps nagging you that "You're running out of space," yet you've already cleared your downloads folder and restarted the browser. The culprit is likely hidden in the background: Volume Shadow Copies. These snapshots, created automatically by Windows for System Restore and file recovery, can quietly consume 20GB or more. While you can hunt for them in the GUI, learning how to delete shadow copies cmd line is the fastest, most precise way to reclaim space without guessing.

This guide isn't just about running one command. It’s about understanding the risks. Deleting these snapshots is permanent. You lose the ability to restore files to a previous state. But when disk space management is critical, and you know what you're doing, the Command Prompt offers surgical control that the graphical interface lacks. In this article, we will move through a structured approach: mastering the standard Vssadmin commands, troubleshooting when things get stuck, and setting up automation so you never face this crunch again.

Prerequisites: Admin Rights & Checking Your Disk Space

Before you type a single character into the command line, you need two things: administrative privileges and a clear picture of what you're looking at. The Volume Shadow Copy Service (VSS) is a system-level service. It doesn't talk to standard user accounts.

Opening Command Prompt as Administrator

You cannot run these commands in a standard user terminal. If you try, you will immediately hit an "Access Denied" wall.

1. Press the Windows key on your keyboard.
2. Type cmd.
3. Look at the right side of the screen. Click Run as administrator.
4. Accept the User Account Control (UAC) prompt.

In my 15 years of supporting Windows systems, I’ve seen countless users fail at this first step. They type vssadmin in a normal prompt, get the error, and think the command is broken. It’s not broken; it’s just protected. The VSS service requires elevated rights to modify the NTFS journaling structure where snapshots live.

Identifying Shadow Copy Sizes

Now that you have the elevated terminal open, let's see what’s actually hogging that space. Don’t just delete blindly. Know what you’re throwing away.

Type the following command and press Enter:

vssadmin list shadows

You’ll see a list of current shadow copies. Look at the Shadow Copy column. Each entry has a GUID (a long string of numbers and letters). Below that, you’ll see the Original Volume and the Shadow Copy volume.

Here is what a typical output looks like:

Shadow copies of volume "C:"
Shadow Copy 1:
  Creation time: 2023-10-27 08:15:22.0000000
  Original: C:\
  Shadow Copy: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
  Shadow Copy ID: {B1A2C3D4-56E7-89F0-1A2B-3C4D5E6F7890}
  Command Line: vssadmin create shadow

The Shadow Copy ID is crucial. It’s the unique identifier you’ll need if you want to delete specific snapshots rather than the whole batch. Note that if you don’t see any shadows, your disk might be clean, or the service hasn’t created them yet. In most cases, however, you’ll find multiple entries, each taking up gigabytes of your drive.

Step-by-Step: Using Vssadmin to Delete Previous Versions

Now that you know what’s there, let’s delete it. The primary tool for this is Vssadmin. It is the user-friendly CLI interface to the VSS service.

The Core Command: vssadmin delete shadows

The syntax for deleting copies is straightforward, but the parameters matter.

To delete all shadow copies on the C: drive, use this command:

vssadmin delete shadows /for=C: /all

Let’s break that down:

• /for=C: tells Windows which volume’s shadows you want to target.
• /all instructs it to remove every single snapshot on that volume.

If you only want to remove the oldest snapshot (useful for keeping a rolling backup of the last 24 hours), use:

vssadmin delete shadows /for=C: /oldest

I prefer the /oldest approach for routine maintenance. It gives you a safety buffer. If you delete all copies today, and something goes wrong with your PC tomorrow, you have zero restore points. By keeping the newest one, you retain a last line of defense.

Deleting Specific Shadow Copies by ID

Sometimes you don’t want to delete everything. Maybe one specific snapshot failed to complete properly and is now stuck, or you just want to remove a large snapshot created during a Windows Update last week.

First, run vssadmin list shadows again and find the Shadow Copy ID (that GUID from earlier). Let’s say the ID is {B1A2C3D4-56E7-89F0-1A2B-3C4D5E6F7890}.

Then run:

vssadmin delete shadows /for=C: /shadow={B1A2C3D4-56E7-89F0-1A2B-3C4D5E6F7890}

Note: You usually need to include the curly braces {} in the command. This precision is why the command line beats the GUI. In the graphical "Previous Versions" tab, you don’t always have granular control over which underlying VSS snapshot to kill.

Troubleshooting: 'Access Denied' & Stuck Shadow Copies

Here is where things get messy. In my experience, Vssadmin works about 80% of the time. The other 20%, it fails with cryptic errors. This section addresses the "delete shadow copies cmd not working" scenarios.

When Vssadmin Fails: Using Diskshadow

If you run the vssadmin delete command and get an error like Error: Snapshots were found, but they were outside of your allowed context, you’re dealing with a non-client-accessible shadow copy. These are often created by backup software, virtualization layers, or system restore processes that lock the snapshot in a way Vssadmin can’t touch.

For this, you need Diskshadow. It is a lower-level tool that interacts directly with the VSS infrastructure.

1. In your Administrator CMD, type:

   diskshadow
   

   You will see a prompt change to DISKSHADOW>.

2. List the volumes to find the one with the stuck copy:

   list volumes
   

   Look for the volume ID (usually a number like 5 or 1) associated with your C: drive.

3. Delete all copies on that volume. Replace 5 with your actual volume ID:

   delete volumes 5
   yes
   

   The yes automatically confirms the prompt.

4. Exit the tool:

   exit
   

This method is blunt but effective. It forces the deletion of any shadow copy associated with that volume ID, regardless of who created it. Be careful: this will delete all snapshots on that volume, including any created by backup software.

Common Error Codes & Fixes

Beyond CMD: PowerShell & Automation for Recurring Tasks

If you’re tired of manually deleting these every month, let’s automate it.

PowerShell One-Liners

PowerShell is superior for scripting because it handles object manipulation. Instead of parsing text from Vssadmin, you can query the WMI/CIM layer directly.

To delete all shadow copies on the local machine:

Get-CimInstance Win32_ShadowCopy | ForEach-Object { $_.Delete() }

This is cleaner. It finds all Win32_ShadowCopy instances and calls the Delete() method on them. You can add filters to only delete copies older than 7 days:

Get-CimInstance Win32_ShadowCopy | Where-Object { $_.InstallDate -lt (Get-Date).AddDays(-7) } | ForEach-Object { $_.Delete() }

Scheduling Automatic Cleanup

You can wrap the PowerShell command in a .ps1 script and schedule it via Task Scheduler to run weekly.

1. Create a text file named CleanVSS.ps1.
2. Paste the PowerShell snippet above.
3. Open Task Scheduler.
4. Create a Task -> Trigger -> Weekly.
5. Action -> Start a program -> powershell.exe -> Arguments: -ExecutionPolicy Bypass -File C:\Scripts\CleanVSS.ps1.

A word of caution: do not delete all copies automatically. I recommend a retention policy. Keep the last 3 days of snapshots. This balances disk space management with safety. If you automate the deletion of everything, you are leaving your system naked.

Security & Risk: Is It Safe to Delete Shadow Copies?

This is the most important section. Most guides tell you how to delete. They don’t tell you why you shouldn’t in certain contexts.

The Ransomware Paradox

Shadow copies are your best friend during a ransomware attack. Malware like CryptoLocker specifically targets VSS to delete your shadow copies, because they know you’ll use them to restore your files.

• Scenario A: Routine Maintenance. You’re just low on disk space. You want to free up 10GB. Verdict: Safe. Go ahead and delete the old snapshots. You’ll just create new ones as time passes.
• Scenario B: Suspected Infection. Your PC is running slow, you see weird executables, and your files are changing. Verdict: Dangerous. If you delete the shadow copies now, you are removing your only chance to roll back to a clean state if the ransomware encrypts your files before you can boot into Safe Mode or disconnect from the network.

If you suspect a security breach, do not delete shadow copies. Instead, isolate the machine, run an AV scan, and restore from an external backup.

Alternative: Limiting Size Instead of Deleting

Before you delete anything, consider capping the size. In most cases, you don’t need to remove copies; you just need Windows to stop creating so many.

1. Right-click your C: drive -> Properties -> Shadow Copies tab (or "Previous Versions").
2. Click Settings.
3. Drag the "Maximum usage" slider to 5-10% of your drive size.

By limiting the total space VSS can consume, Windows will automatically delete the oldest snapshots when the limit is reached. This is the "set it and forget it" solution. It prevents the disk space crunch without requiring you to manually run delete shadow copies cmd every month.

FAQ

How do I delete all shadow copies in Windows 10 or 11 using CMD? Open Command Prompt as Administrator and run: vssadmin delete shadows /for=C: /all. This works identically on both Windows 10 and 11. Ensure you are targeting the correct volume.

Will deleting shadow copies delete my actual files? No. Shadow copies are snapshots of previous states. Deleting them only removes the archived versions. Your current, live files on the C: drive remain untouched. However, you will lose the ability to "Restore" a file to an older date.

What is the difference between Vssadmin and Diskshadow? Vssadmin is for standard, client-accessible copies. It is easier to use but limited. Diskshadow is a lower-level tool for administrators. It can delete "stuck" or non-client-accessible copies that Vssadmin cannot touch. If Vssadmin gives you an "outside allowed context" error, switch to Diskshadow.

How can I stop Windows from creating new shadow copies automatically? You technically can disable the service, but this breaks System Restore. A better approach is to limit the storage size via the GUI (File Properties > Shadow Copies > Settings). Set the max usage to 500MB-1GB. This forces Windows to keep only the most recent snapshots, preventing them from eating your whole drive.

Conclusion

Managing disk space on Windows often comes down to understanding the hidden layers of your file system. The delete shadow copies cmd commands—specifically Vssadmin and Diskshadow—give you the precision to target exactly what needs to be removed.

• Standard cleanup: Use vssadmin delete shadows /for=C: /oldest to keep a rolling backup.
• Stuck copies: Use diskshadow to force-delete problematic snapshots.
• Automation: Use PowerShell scripts in Task Scheduler for recurring maintenance.
• Safety: Always create an external backup before wiping all VSS data, especially if you suspect any system instability.

For 95% of users, I recommend simply capping the VSS storage size via the GUI settings. It’s safer, automatic, and prevents the "low disk space" alert from ever becoming a real problem again. But if you are an IT professional or a power user, the command line tools in this guide are your best friends for quick, surgical interventions.

Ready for more? Check out our guide on "Optimizing NTFS Journaling for Performance" or subscribe for weekly advanced Windows CMD tutorials.