CmdID

CmdID / Commands

wbadmin delete systemstatebackup

Deletes the system state backups that you specify. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Deletes the system state backups that you specify. If the specified volume contains backups other than system state backups of your local server, those backups will not be deleted. To delete a system state backup using this command, you must be a member of the Backup Operators group or the Administrators group, or you must have been delegated the appropriate permissions. In addition, you must run wbadmin from an elevated command prompt, by right-clicking Command Prompt, and then selecting Run as administrator. NOTE: Windows Server Backup does not back up or recover registry user hives (HKEY_CURRENT_USER) as part of system state backup or system state recovery.

wbadmin delete systemstatebackup {-keepVersions:<numberofcopies> | -version:<versionidentifier> | -deleteoldest} [-backupTarget:<volumename>] [-machine:<backupmachinename>] [-quiet]

To delete the system state backup created on March 31, 2013 at 10:00 AM, type

wbadmin delete systemstatebackup -version:03/31/2013-10:00Identify
-versionSpecifies the version identifier of the backup in MM/DD/YYYY-HH:MM format. Windows commands reference

Trips 1 Sigma rule: mediumWindows Backup Deleted Via Wbadmin.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

To delete all system state backups, except the three most recent, type

wbadmin delete systemstatebackup -keepVersions:3Identify
-keepVersionsSpecifies the number of the latest system state backups to keep. Windows commands reference

Trips 1 Sigma rule: mediumWindows Backup Deleted Via Wbadmin.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

To delete the oldest system state backup stored on disk f:, type

wbadmin delete systemstatebackup -backupTarget:f:\ -deleteOldestIdentify
-backupTargetSpecifies the storage location for the backup that you want to delete. Windows commands reference
-deleteOldestDeletes the oldest system state backup. Windows commands reference

Trips 1 Sigma rule: mediumWindows Backup Deleted Via Wbadmin.EXE by frack113, Nasreddine Bencherchali (Nextron Systems)

-keepVersionsSpecifies the number of the latest system state backups to keep. The value must be a positive integer. The parameter value -keepversions:0 deletes all the system state backups.
-versionSpecifies the version identifier of the backup in MM/DD/YYYY-HH:MM format. If you don't know the version identifier, run the wbadmin get versions command. Versions made up of exclusively system state backups can be deleted using this command. Run the wbadmin get items command to view the version type.
-deleteOldestDeletes the oldest system state backup.
-backupTargetSpecifies the storage location for the backup that you want to delete. The storage location for disk backups can be a drive letter, a mount point, or a GUID-based volume path. This value only needs to be specified for locating backups that are not on the local computer. Information about backups for the local computer is available in the backup catalog on the local computer.
-machineSpecifies the computer whose system state backup you want to delete. Useful when multiple computers were backed up to the same location. Should be used when the -backupTarget parameter is specified.
-quietRuns the command without prompts to the user.