CapabilityAccessManager.db-wal ballooning to hundreds of gigabytes

Safely deleting CapabilityAccessManager.db-wal

Many posts suggest restarting in Safe Mode and simply deleting CapabilityAccessManager.db-wal; however, that unfortunate approach reportedly breaks WiFi, screen capture, Settings, and more.

u/Ancient-Reply2879 and Pony appear to have independently arrived at the correct method: delete the folder (C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\) rather than the file (C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\ CapabilityAccessManager.db-wal).

Refactored a PowerShell script shared by Anonymous (2024) and jsmorley (2025) to delete the directory rather than the contents:

$services = @("camsvc", "SysMain", "lfsvc")
$folder = "C:\ProgramData\Microsoft\Windows\CapabilityAccessManager"

# --- Stop services and kill their processes ---
foreach ($svc in $services) {
    Write-Output "Stopping service: $svc"
    Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue

    $proc = Get-WmiObject -Class Win32_Service -Filter "Name='$svc'" -ErrorAction SilentlyContinue
    if ($proc -and $proc.ProcessId -gt 0) {
        Write-Output "  Killing process ID: $($proc.ProcessId)"
        Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue
    }
}

Write-Output "Waiting for processes to fully exit..."
Start-Sleep 10

# --- Verify nothing is locking the files ---
$lockers = Get-Process | Where-Object {
    try {
        $_.Modules | Where-Object { $_.FileName -like "$folder*" }
    } catch {}
}

if ($lockers) {
    Write-Output "Killing remaining processes with locks on the folder:"
    foreach ($p in $lockers) {
        Write-Output "  Killing: $($p.Name) (PID $($p.Id))"
        Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue
    }
    Start-Sleep 5
}

# --- Take ownership and delete ---
if (Test-Path $folder) {
    Write-Output "Taking ownership..."
    takeown /F $folder /R /D Y | Out-Null
    icacls $folder /grant Administrators:F /T /Q | Out-Null

    # Retry loop — sometimes handles take a moment to release
    $maxRetries = 5
    for ($i = 1; $i -le $maxRetries; $i++) {
        Write-Output "Delete attempt $i of $maxRetries..."
        Remove-Item $folder -Recurse -Force -ErrorAction SilentlyContinue

        if (-not (Test-Path $folder)) {
            Write-Output "Folder deleted successfully."
            break
        }

        Write-Output "  Folder still exists, waiting 5 seconds..."
        Start-Sleep 5
    }

    if (Test-Path $folder) {
        Write-Output "ERROR: Could not delete folder after $maxRetries attempts."
        Write-Output "Remaining files:"
        Get-ChildItem $folder -Recurse | ForEach-Object { Write-Output "  $($_.FullName)" }
    }
} else {
    Write-Output "Folder does not exist."
}

Start-Sleep 5

# --- Restart services ---
foreach ($svc in $services) {
    Write-Output "Starting service: $svc"
    Start-Service -Name $svc -ErrorAction SilentlyContinue
}

Start-Sleep 5

foreach ($svc in $services) {
    $status = (Get-Service -Name $svc -ErrorAction SilentlyContinue).Status
    Write-Output "  $svc status: $status"
}

Write-Output "Done"

Prevention

Disabling Location services (Settings → Privacy & security → App permissions → Location) and uninstalling SmartByte (advisable in any case) are reported as possible fixes.

❧ 2026-04-18