Auto remove profles over 5 days old on system restart #Windows10 #Local/GroupPolicy

[MatthewL]

Can anyone shed some light on this, we want kids local profiles to be deleted at log off, and if i make the children's AD accounts members of "Domain Guests" they do seem to be deleted at log off. Is there any negatives/pit falls to using this method for clearing local profiles?

 

Just going back to this point, no reason why that wouldn't work but on the machines the students use I would add the students group to the guests group on the local machine as some PC's you may wish to keep their profiles. As long as they can save to a shared area it should work ok.

[Patrick]

I have been using my method since i deployed windows 10 and it works fine for me. Sure the machines have to build a new profile for students every time they log in, but it only takes around 25 seconds, and we have been getting a consistent experience every time.

[rosslaing]

Does disabling automatic Windows Store app updates make any difference?

 

I haven't tried but it does modify the DAT file with Certain standard updates as well, mostly cumulative updates, so would be a bit pointless. I might give it a try though just to prove that it at least helps a bit. main thing for me is to clear them out periodically, im not needing them wiped every day, just removes the need to schedule it some other way and maintain that. I do like the apps kept up to date though, some nice updates have come out what with stickynotes now syncing with 365 etc. (again, crazy why they shouldnt be included with Windows UPdate sources rather than direct from the store?!?

 

At the moment, the DAT files could lie untouched for anywhere between 1 day and 14 days is the most ive seen, and that was only once in the last 18 months! Most of the time it is around 4,5 or 6 days.

 

Absolutely maddening.

Edited November 27, 2018 by rosslaing

[rosslaing]

**Bump**

Still broken in 1903, ntuser.dat still modified regularly by updates.

 

Also noticed a slight problem in using the ntuser.ini file to determine profile age. When you feature update a Windows 10 machine, all profiles are obviously still there (Copied/converted) and all contents are there, apart from................yeah, ntuser.ini, until they log on again.

 

In the absence of a ntuser.ini file the profile is deleted, so if you are running delprof on startup, prepare for all profiles to go bye bye after a feature update.

[free780]

Clear the profiles before an upgrade. Use delprof2 speeds the upgrade up.

[rosslaing]

That is the reason for it in the first place to be honest, but I would rather keep stuff that has at least been used in the last 2 months, otherwise id be just as well re-imaging the PC's. Plus we have a bizarre issue with Xerox drivers not working correctly for secure print and auditron when profiles are deleted, so again would rather keep recently used profiles. We normally re-image machines during the summer but our estate has doubled with mobile devices in the last 18 months and it is now unworkable to do this, so feature updates will help a lot, but trying to keep users experience as good as possible. It has always been a complaint when they come back and have to rebuild profiles, UEV is not all its cracked up to be!

[free780]

I did look at Enterprise State Roaming but last time I checked it didn't work on hybrid devices. UEV is very hit and miss you also need templates to roam settings everytime you deploy/update an application. Some programs don't roaming settings well such as Autocad. It does feel like 1:1 may happen with all these little steps making shared devices harder. We only wipe profiles using delprof2 in Library areas as specialist support software usually has settings students have configured so we recommend they use the same PC.

[rosslaing]

To be honest ive been waiting on this dropping for the last year to do away with both. I know its mostly VDI, but I believe this is what Microsoft are going to push for "roaming Profiles" on physical machines too. Hopefully it drops in June like the article says so I can have a looky, will be free to me on my subscription thankfully.

 

https://www.christiaanbrinkhoff.com/2019/03/21/the-future-of-roaming-profiles-add-fast-logon-performance-and-office-365-support-to-your-virtual-desktop-vdi-daas-environment-with-microsoft-fslogix-profile-container-including-existing-uem-sol/

Edited June 14, 2019 by rosslaing

[ChrisMiles]

Not sure if you guys are seeing the same thing, but my ntuser.ini has the same modified date as creation date, nearly a year ago despite logging in and out of my account every day.

[rosslaing]

I hadn't until you mentioned it, but you appear to be correct, marvellous, now have no way of deleting profiles older than X days, i'm away to open a new MS premier support call so I can get the actual GPO setting working.

So using delprof with ntuser.ini is deleting based on the creation date instead of last used, feel like curling up in the fetal position.

[ChrisMiles]

I've been looking at solutions but so far theyre all pretty rubbish. I considered enabling account auditing and using the last event log entry for login to get the last date and a login script to just write the date/touch a file in the profile folder.

[rosslaing]

yeah, Im hoping the fslogix profile container stuff bares some fruit, quite frankly, Microsoft seem to have given up on supporting roaming users. Edited June 14, 2019 by rosslaing

[rosslaing]

Ok so moved on a bit here, got this working with the GPO, but have a script that looks at the last write time of the profile folder, which always seems to be accurate and then changes the ntuser.dat file last write time to match. Profiles delete.

 

However, now that it is working, the number of days counter is not accurate, seems to be smart enough to not count weekends!, so operating on a 5 day week principle. took me ages to figure that one out!

[DavR]

My two-penneth..... after being confronted with an almost tearful teacher this lunchtime, who's work crashed at lack of disk space, I finally gave in and put something in place to manage this.

 

As with everyone else, both my ntuser.dat and ntuser.ini files were not giving useful dates that I could use DelProf2 to work with, so I've gone with the nuclear option - a full clear down of roaming profiles, four times a year.

 

I've done this with DelProf2.exe /r /u, pushed as a scheduled task via group policy. It'll ignore any logged on user and any local profiles, the only inconvenience is that other users will have a slower logon once a quarter.

[rosslaing]

the script i use to change the last write dates to what they should actually be can be found here:

https://techcommunity.microsoft.com/t5/Windows-10-deployment/Issue-with-date-modified-for-NTUSER-DAT/m-p/102438

 

I changed it around a bit to run it remotely as its designed to be run on the machine locally. but it does indeed do the job.

Script is about half way down the thread.

 

If you use this to fix the dates then the GPO setting or Delprof2 works fine.

[mavhc]

the script i use to change the last write dates to what they should actually be can be found here:

https://techcommunity.microsoft.com/t5/Windows-10-deployment/Issue-with-date-modified-for-NTUSER-DAT/m-p/102438

 

I changed it around a bit to run it remotely as its designed to be run on the machine locally. but it does indeed do the job.

Script is about half way down the thread.

 

If you use this to fix the dates then the GPO setting or Delprof2 works fine.

 

It's still not setting the right dates though, just a slightly better date than before, my account that I logged into locally was set to 2 months ago, even though I just logged in today