Just another Writecache Thread.. i modified @Chris Twiest Control Up script a bit, to compare the actual findings with the mcsdif.vhdx. It filters out only writes on C:\ and also includes only data since the last reboot. I cannot find what causes my cache to grow, as the scripts data finds about 2943 MB, the cache size is 7707 MB. And yes, the cache initially starts after reboot with 4096kb. The sum itself is based on all entries, not only the top 200. I modified my mcs template with every tweak i found (and also did it without any tweaks). So Disabled NTFS Last access timestamps, disabled system optimize / defrag tasks etc., Updates, etc. When sth is misconfigured here it would also show up as "visible" data to c:\, so my issue is the "invisible" data. This image is running on sophos central, also this is optimized for VDI, no scheduled scans, etc.

When you don't see what is causing it, it's usually the AV. If you can remove it to prove the point, it would help to rule it out.

and i thought its always DNS 😉 Will see if i have a chance to try without Sophos.

@Marco Zimmermann did you get any further with this?