CapabilityAccessManager.db-wal ballooning to hundreds of gigabytes

Safely deleting CapabilityAccessManager.db-wal

Many posts suggest restarting in Safe Mode and simply deleting CapabilityAccessManager.db-wal; however, that unfortunate approach reportedly breaks WiFi, screen capture, Settings, and more.

u/Ancient-Reply2879 and Pony appear to have independently arrived at the correct method: delete the folder (C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\) rather than the file (C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\ CapabilityAccessManager.db-wal).

Refactored a PowerShell script shared by Anonymous (2024) and jsmorley (2025) to delete the directory rather than the contents:

$services = @("camsvc", "SysMain", "lfsvc")
$folder = "C:\ProgramData\Microsoft\Windows\CapabilityAccessManager"

# --- Stop services and kill their processes ---
foreach ($svc in $services) {
    Write-Output "Stopping service: $svc"
    Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue

    $proc = Get-WmiObject -Class Win32_Service -Filter "Name='$svc'" -ErrorAction SilentlyContinue
    if ($proc -and $proc.ProcessId -gt 0) {
        Write-Output "  Killing process ID: $($proc.ProcessId)"
        Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue
    }
}

Write-Output "Waiting for processes to fully exit..."
Start-Sleep 10

# --- Verify nothing is locking the files ---
$lockers = Get-Process | Where-Object {
    try {
        $_.Modules | Where-Object { $_.FileName -like "$folder*" }
    } catch {}
}

if ($lockers) {
    Write-Output "Killing remaining processes with locks on the folder:"
    foreach ($p in $lockers) {
        Write-Output "  Killing: $($p.Name) (PID $($p.Id))"
        Stop-Process -Id $p.Id -Force -ErrorAction SilentlyContinue
    }
    Start-Sleep 5
}

# --- Take ownership and delete ---
if (Test-Path $folder) {
    Write-Output "Taking ownership..."
    takeown /F $folder /R /D Y | Out-Null
    icacls $folder /grant Administrators:F /T /Q | Out-Null

    # Retry loop — sometimes handles take a moment to release
    $maxRetries = 5
    for ($i = 1; $i -le $maxRetries; $i++) {
        Write-Output "Delete attempt $i of $maxRetries..."
        Remove-Item $folder -Recurse -Force -ErrorAction SilentlyContinue

        if (-not (Test-Path $folder)) {
            Write-Output "Folder deleted successfully."
            break
        }

        Write-Output "  Folder still exists, waiting 5 seconds..."
        Start-Sleep 5
    }

    if (Test-Path $folder) {
        Write-Output "ERROR: Could not delete folder after $maxRetries attempts."
        Write-Output "Remaining files:"
        Get-ChildItem $folder -Recurse | ForEach-Object { Write-Output "  $($_.FullName)" }
    }
} else {
    Write-Output "Folder does not exist."
}

Start-Sleep 5

# --- Restart services ---
foreach ($svc in $services) {
    Write-Output "Starting service: $svc"
    Start-Service -Name $svc -ErrorAction SilentlyContinue
}

Start-Sleep 5

foreach ($svc in $services) {
    $status = (Get-Service -Name $svc -ErrorAction SilentlyContinue).Status
    Write-Output "  $svc status: $status"
}

Write-Output "Done"

Prevention

Disabling Location services (Settings → Privacy & security → App permissions → Location) and uninstalling SmartByte (advisable in any case) are reported as possible fixes.

Update

Microsoft admits a Windows 11 bug is eating up to 500GB of storage, verify if you are affected:

"[A] file linked to Capability Access Manager continues to fill the system drive until it runs out of storage. ... If your PC is affected, the safest fix is to install Windows 11 KB5095093 from Windows Update, or wait for the July 2026 Patch Tuesday update, where the fix is expected to roll out automatically"

❧ 2026-04-18