+
+ | Business impact |
+ Usually low. A ghost folder that nothing references is
+ cosmetic. High if anything still references it: solution
+ updates can fail mid-flight, ARB VMs can fail to start or redeploy, and
+ checkpoint merges can break because a virtual disk's parent is resolved through
+ the wrong mount point. |
+
+
+ | Who owns this |
+ The customer's cluster administrator. This is not a
+ networking issue, and no OEM, BIOS, or firmware action is ever
+ required. If the only references are under
+ Infrastructure_1 (ARB or platform-managed content), stop and
+ engage Microsoft Support rather than self-remediating. |
+
+
+ | Typical time to resolve |
+ Detection: minutes, and read-only. Repointing a workload VM: tens of
+ minutes, and it moves data. Cleanup after verification: minutes. |
+
+
+ | Downtime / maintenance window |
+ All detection in this guide is read-only and online.
+ Repointing VM storage moves data and should be scheduled; depending on the VM
+ and the amount of data it may require the VM to be offline. |
+
+
+
+## Terms used on this page
+
+If you are new to failover clustering, read this first. The safety decisions later
+on depend on these words.
+
+| Term | What it means here |
+| --- | --- |
+| **CSV** (Cluster Shared Volume) | Shared cluster storage that every node can access at the same time. Each CSV appears as a folder under `C:\ClusterStorage`. |
+| **CSV root** | The folder `C:\ClusterStorage` itself. The Cluster service owns it and puts one folder inside it per CSV. |
+| **Ghost root / ghost folder** | A leftover copy of the CSV root that the Cluster service renamed to a numbered name such as `C:\ClusterStorage.000`. |
+| **Mount point** | A folder that is really a doorway into a whole disk volume. Opening it shows that volume's contents. Deleting it can affect real data. |
+| **Junction / reparse point** | The Windows mechanism behind a mount point: a folder that redirects somewhere else. A `-Recurse` delete can follow one into live data. |
+| **Open handle** | A file or folder currently held open by a running program. Windows will not let you rename or move something while a handle is open on it. |
+| **SMB** | The Windows file-sharing protocol. `Get-SmbOpenFile` shows which files other machines currently have open. |
+| **ARB** (Arc Resource Bridge) | An Azure Local platform component that runs as a VM on the cluster. Managed by the platform, not by you. |
+| **MOC / MocArb** | The platform layer underneath ARB. Its working files live on the infrastructure volume. Platform-managed, not customer-managed. |
+| **`Infrastructure_1`** | The reserved Azure Local infrastructure volume. It holds platform configuration and working data, is not for customer workloads, and the platform blocks you from placing storage on it. |
+
+## Before you start
+
+### What you need
+
+- **An elevated PowerShell session** (Run as Administrator) **on one of the cluster
+ nodes**. Every command on this page assumes that.
+- **Cluster administrator rights** on the cluster.
+- The **FailoverClusters** and **Hyper-V** PowerShell modules, present by default on
+ Azure Local nodes.
+- **PowerShell remoting working between nodes**, because the cluster-wide checks use
+ `Invoke-Command`.
+
+Confirm all of that before going further:
+
+```powershell
+# Every value below must be True before you continue.
+$id = [Security.Principal.WindowsIdentity]::GetCurrent()
+[pscustomobject]@{
+ RunningAsAdmin = ([Security.Principal.WindowsPrincipal]$id).IsInRole(
+ [Security.Principal.WindowsBuiltInRole]::Administrator)
+ FailoverClustersAvail = [bool](Get-Module -ListAvailable FailoverClusters)
+ HyperVAvail = [bool](Get-Module -ListAvailable Hyper-V)
+ ClusterReachable = [bool](Get-Cluster -ErrorAction SilentlyContinue)
+} | Format-List
+```
+
+### Safety rules
+
+> [!WARNING]
+> **Never delete a `C:\ClusterStorage.00X` folder until every check in
+> [Step 3](#step-3-classify-what-you-found) reports no references.**
+> A ghost folder can still contain, or still redirect to, live data. Deleting it
+> while something points at it can take virtual machines or Arc Resource Bridge
+> offline, and the resulting failure will not obviously point back at the deletion.
+
+> [!IMPORTANT]
+> [Step 1](#step-1-find-the-ghost-roots) and
+> [Step 2](#step-2-prove-whether-anything-references-them) are **read-only**. Run the
+> whole detection pass first and decide afterwards. Do not scroll ahead and run a
+> cleanup block on its own: the cleanup in
+> [Path A](#path-a-no-references-found-safe-to-clean-up) assumes you have completed
+> Steps 1 to 3 in order.
+
+## Quick triage (start here)
+
+> [!IMPORTANT]
+> This is a fast first look, **not a clearance**. It covers the per-node checks
+> only. Zero references here does **not** mean the cluster is clear, because the
+> cluster-wide resource check and the mount-point check have not run yet. Treat a
+> clean result as "keep going", never as "safe to delete".
+
+Run this on **any one node**. It fans out to every running node.
+
+```powershell
+# The canonical ghost-path pattern used throughout this guide.
+# It matches a literal dot followed by one or more digits after "ClusterStorage",
+# for example C:\ClusterStorage.000\... or C:\ClusterStorage.001\...
+# It deliberately does NOT match the real root C:\ClusterStorage\...
+$GhostPathPattern = '[\\/]ClusterStorage\.\d+([\\/]|$)'
+
+$nodes = (Get-ClusterNode | Where-Object State -eq 'Up').Name
+
+Invoke-Command -ComputerName $nodes -ArgumentList $GhostPathPattern -ScriptBlock {
+ param($Pattern)
+
+ $findings = New-Object System.Collections.Generic.List[string]
+
+ $ghostRoots = Get-ChildItem -Path 'C:\' -Directory -Filter 'ClusterStorage.*' -ErrorAction SilentlyContinue |
+ Where-Object { $_.Name -match '^ClusterStorage\.\d+$' } |
+ Select-Object -ExpandProperty FullName
+
+ foreach ($vm in (Get-VM -ErrorAction SilentlyContinue)) {
+ foreach ($d in ($vm | Get-VMHardDiskDrive -ErrorAction SilentlyContinue)) {
+ if ($d.Path -match $Pattern) { $findings.Add("VMHardDisk: $($vm.Name) -> $($d.Path)") }
+ }
+ foreach ($prop in 'ConfigurationLocation', 'SnapshotFileLocation', 'SmartPagingFilePath') {
+ $v = $vm.$prop
+ if ($v -and ($v -match $Pattern)) { $findings.Add("VMConfig: $($vm.Name).$prop -> $v") }
+ }
+ }
+
+ foreach ($f in (Get-SmbOpenFile -ErrorAction SilentlyContinue)) {
+ if ($f.Path -match $Pattern) {
+ $findings.Add("SmbOpenFile: $($f.ClientUserName)@$($f.ClientComputerName) -> $($f.Path)")
+ }
+ }
+
+ [pscustomobject]@{
+ Node = $env:COMPUTERNAME
+ GhostRoots = if ($ghostRoots) { $ghostRoots -join '; ' } else { '