| name | windows-storage-files-services |
| description | Use when diagnosing or planning Windows disks, volumes, NTFS/ReFS, SMB/DFS, ACLs, handles, VSS, services, or scheduled tasks; use windows-iis for IIS-specific workload state. |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"]} |
Windows Storage, Files, and Services
Use when
- Inspect capacity, disk/volume health, filesystem, VSS, SMB/DFS, or permissions.
- Diagnose a Windows service, dependency, account, path, or scheduled task.
- Perform the engine's bounded local service-state proof.
Do not use when
- Formatting/resizing/destructive cleanup lacks R5 authority and backup proof.
- Permission correctness is being inferred from ACL text without effective access.
Inputs
Target/role, disk/volume/share/path/service/task stable identifier, intended
outcome, owner, active dependencies, access principal, window, and recovery.
Platform and privilege boundary
Discovery is R0. Service start/stop is R2. ACL/share/storage mutations range
R2-R5 and remain blocked unless a specific lab row passes.
Workflow
- Run
Get-WseStorageServiceSnapshot with the narrowest scope.
- Map disks to partitions/volumes/mounts/workloads before a storage decision.
- For access, combine share and NTFS rules, inheritance, groups, deny rules,
ownership, and effective-access evidence.
- For service/task, inspect dependencies, account, binary/action, signatures,
triggers, history, events, and workload probe.
- Use
Invoke-WseServiceState only with authority, window, preview, and evidence.
Mutation, verification, and recovery
Verify filesystem/share/service user outcome, not configuration alone. Restore
service state on failed verification. Storage/ACL recovery needs known-good
metadata and must preserve confidentiality as well as availability.
Stop conditions
Stop on unknown disk mapping, active workload/cluster, full-volume write risk,
missing backup, permission-owner ambiguity, unsigned service binary concern, or
no effective-access test.
Capability contract and degraded mode
Read collectors are available locally. Only service state has a controlled
mutation command in 0.1; return BLOCKED for other changes.
Outputs
Storage/share/service/task snapshot, dependency and access analysis, risk,
change preview, verification, rollback artefact, and evidence pack.
Decision rules
| Condition | Action |
|---|
| Low capacity | Diagnose owner/growth; never delete automatically |
| Service stopped but role unknown | Investigate before start |
| Share allows but NTFS denies | Effective access is denied |
| Destructive storage request | R5 backup and typed decision |
Quality standards
Use stable IDs, byte counts, and object output. A second service-state run is
NoChange. Sensitive file contents are never collected by default.
Anti-patterns
- Deleting “old” files blindly. Fix: owner/retention evidence.
- Using checkpoints as backup. Fix: approved recovery system.
- Restarting dependencies together. Fix: one bounded change.
- Reading ACL text only. Fix: calculate effective access.
- Changing service account casually. Fix: identity and dependency plan.
References
