Win11: srudb.dat keeps growing very large even after deleting it multiple times, why?

Question

Win11: srudb.dat keeps growing very large even after deleting it multiple times, why?

Question 0

As far as i can tell, the diagnostic policy service is responsible, but i dont understand why it is writing so much to that file.

Ive been trying to troubleshoot with chatgpt since nobody ive asked seems to have any idea, but i get the feeling the AI keeps going off track.

My srudb.dat file is currently 4+gb large. And its writing very large amounts to the file in short intervals for no clear reason. In the span of less than 40 minutes today, it decided to write more than 1GB to the file for no clear reason.

Most of the records seem to be due to "AppTimelineProvider" and eeprov.dll. I'm not sure why its writing so much though...anyone have any ideas? All the search results ive found just say to delete srudb.dat, they dont say how to stop it from growing so large constantly. Edit: To clarify, i cannot use process monitor or any other similar utility to capture it because it does not happen all the time, and i cannot predict or control when windows writes to the srudb.dat file. sfc scannow doesnt work either.

0 comments

2 answers

Your answer

Answer 1

To see what is being written to the SRUDB.dat database, you can use Eric Zimmerman's SrumECmd tool.

https://www.cyberengage.org/post/how-to-use-srumecmd-to-parse-and-analyze-srudb-dat-files

If your SRUDB.dat file is too huge, I'm not sure if the tool will handle it. You may need to delete the dat file, then collect it whilst it's still < 200 MB.

To copy the dat file and SOFTWARE hive, open an admin Command Prompt and copy/paste/run the following commands:

cmd /c "mkdir C:\triage 2>nul & esentutl /y C:\Windows\System32\sru\SRUDB.dat /vss /d C:\triage\SRUDB.dat"

cmd /c "esentutl /y C:\Windows\System32\config\SOFTWARE /vss /d C:\triage\SOFTWARE"

Both files will be saved to the C:\triage folder.

Collected data from SrumECmd can be viewed in excel or similar app.

SrumECmd - https://ericzimmerman.github.io/#forensic-tools

Answer 2

Emma1-N 14,895 Microsoft External Staff Moderator

Welcome Question,

Thank you for the detailed description. SRUDB.dat is the System Resource Usage Monitor database, which records app usage data in the background. Before narrowing this down, I need a bit more information, and I've included some quick tests you can try in the meantime.

Which Windows 11 version and build do you have? Press "Windows key + R", type "winver" and press Enter. Are you on a Windows Insider build?
Are you signed in with a personal Microsoft account on this PC?
When you say "sfc /scannow" doesn't work, what exact message does it show?

Step 1: Repair the Windows image first, then run SFC

Right-click Start and select Terminal (Admin) or Command Prompt (Admin)
Type DISM.exe /Online /Cleanup-image /Restorehealth and press Enter. Wait until it shows "The operation completed successfully."
Then type sfc /scannow and press Enter.

Step 2: Turn off Activity history and clear it

Go to Settings > Privacy & security >Activity history
Turn Store my activity history on this device to Off, then select Clear history
Restart the PC and watch whether the file still grows quickly.

Step 3: Install all pending updates

Go to Settings > Windows Update and select Check for updates
Install everything offered, including the items under "Advanced options" > "Optional updates". Then restart.

Step 4: Run a Microsoft Defender Offline scan

Go to Settings > Privacy & security > Windows Security > Virus & threat protection > Scan options
Select "Microsoft Defender Antivirus (offline scan)" and select "Scan now". The PC will restart and scan

Please reply with the answers above and the results of each step, and I'll continue from there.

Question 0 Reputation points

2026-11-04T07:05:31.8033333+00:00

I am running win11 23H2 build 22631.6199.

SFC and DISM make no difference, thats what i meant.

Im not sure why activity history would affect this? It does not cause writes to the srudb.dat file. Do you have any documentation there that says it DOES acutally write to srudb.dat?

I have no results for viruses or anything like that.

Wouldnt it be more efficient to look into the srudb.dat file and see what is being written there? That would give a clue on what is triggering the writes.
Emma1-N 14,895 Reputation points Microsoft External Staff Moderator

2026-11-05T04:54:58.8766667+00:00
Hello Question,

Thank you for your update. Please try a clean boot

Press Windows key + R, type msconfig and press Enter.

On the Services tab, select Hide all Microsoft services, then select Disable all.

Open Task Manager > Startup apps and disable all startup items.

Restart and use the PC normally for a day, then check the file size again.

When you're done testing, go back to msconfig, select Normal startup and re-enable your startup apps.
Emma1-N 14,895 Reputation points Microsoft External Staff Moderator

2026-11-06T04:40:46.31+00:00

Hello Question,

Is there any update from you? Please let me know, I will be here to assist you
Question 0 Reputation points

2026-11-06T05:46:51.6566667+00:00

Emma, im not sure if these are realistic troubleshooting steps, i cannot use my PC normally if i disable all non microsoft services. Can you please explain how to check the srudb.dat file to see what is being written there?