Delprof [Either Log off or Startup]

[IAMCloud_Curt]

Hi,

 

Trying to get to the bottom of this as it doesn't always work.

 

I want delprof to run either on log off or start up, I don't really mind. I am currently testing this within my Test OU and it deletes some profiles but not ALL profiles that I have stored on the C:\Users

 

I have deployed the script via GPO and tried Log Off Scripts and also Start Up scripts (not at the same time)

 

Any ideas why it doesn't delete every user profile? I have set exceptions up for Administrator/Public/Default as I don't need delprof to run on these.

 

Could anyone share their knowledge on this one, or even share your script/gpo setup to see how yours is different.

 

Shed some light, please.

 

Thanks all!

[djm968]

Can you post a copy of the script you are using to run delprof.

[IAMCloud_Curt]

Can you post a copy of the script you are using to run delprof.

I have tried copying delprof2.exe to Workstations C:\ which is has completed on a test workstation..

 

cd c:delprof2.exe /u /q /i /ed:Administrator /ed:Public /ed:Default

 

I have also tried

 

\\mydomain\netlogon\delprof2.exe /u /q /i /ed:Administrator /ed:Public /ed:Default

[Norbert]

Try putting /d:0 in there as well

[MatthewL]

I would run on startup, I've tried to use this and delete profiles once logged off but they don't fully close. Startup, no one has used it so all good to go.

[minimoo]

Hi Guys,

 

I'm late to the party, but I moved to using a powershell script to delete profiles - so I could apply different rules for teachers vs students- I then set that to run as a scheduled task at 12:30 each day as i've found profile deletion can be quite slow! I can post a copy here if someone wants

[jamiedonaldson1]

Hi Guys,

 

I'm late to the party, but I moved to using a powershell script to delete profiles - so I could apply different rules for teachers vs students- I then set that to run as a scheduled task at 12:30 each day as i've found profile deletion can be quite slow! I can post a copy here if someone wants

 

If you can post your script that be awesome?

[IAMCloud_Curt]

Hi Guys,

 

I'm late to the party, but I moved to using a powershell script to delete profiles - so I could apply different rules for teachers vs students- I then set that to run as a scheduled task at 12:30 each day as i've found profile deletion can be quite slow! I can post a copy here if someone wants

Yeah that would be great mate!

[Davit2005]

I used to do this at startup at the last place

 

Pretty sure I used to run the command from the local C drive. The startup script would delete the existing batch file, replace it with the new one and then execute it. Pretty reliable and really helped the C drives from getting to full.

 

I might have the batch file somewhere, I will have to dig.

[JATSO]

Hi Guys,

 

I'm late to the party, but I moved to using a powershell script to delete profiles - so I could apply different rules for teachers vs students- I then set that to run as a scheduled task at 12:30 each day as i've found profile deletion can be quite slow! I can post a copy here if someone wants

 

Great if you could pass it on.

Thanks

[speckytecky]

Fab, thanks were duly given, in advance @minimoo

 

Hi Guys,

 

I'm late to the party, but I moved to using a powershell script to delete profiles - so I could apply different rules for teachers vs students- I then set that to run as a scheduled task at 12:30 each day as i've found profile deletion can be quite slow! I can post a copy here if someone wants

[minimoo]

Note: This is modified code of some scripts that are already on the internet - was just trying to find original source, but could only find https://www.experts-exchange.com/questions/26888678/Profile-Fragments-after-Removal-Windows-7.html

and https://github.com/Fuzzwah/powershell-scripts/blob/master/Get-PCsUserProfileInfo.ps1

 

I think I trimmed down to only work on localhost (as I run it as a group policy preference scheduled task (as local system)) over lunch

 

1) get profiles on local pc

2) skip loaded profiles or special profiles

3) grab the account SID details and try and work out if the account has been used in last 90 days [i think I added this later to tidy up 'staff profiles as I skip them

4) we had accounts for controlled assignements with 1516 / 1617 in the name - so always skipped deleting them in case a student saved work locally by mistake

5) 7 days grace for students before profile deletion

6) all our student accounts have year they joined in name - so only delete if it contains '0' or '1'

 

Looking at script I should really tidy it up and make it more generic - but you get the idea. I was originally running this as a startup/shutdown before moving it to a scheduled task - we found that startup/shutdown script just delayed things!

 

function Remove-Profiles
{
   process {
	$ErrorActionPreference = "SilentlyContinue"
	# Get the userprofile list and then filter out the built-in accounts
	$profiles = Get-WmiObject win32_userprofile -computer localhost  | ?{$_.SID -like "s-1-5-21*"}
	if ($?) {
		foreach ($profile in $profiles) {
			if( $profile.Loaded -eq "True" ) {
				Write-Host ("Skipping User Profile (as it is loaded) for "+ $profile.path);
				continue;
			}
			if( $profile.Loaded -eq "Special" ) {
				Write-Host ("Skipping User Profile (as it is special) for "+ $profile.path);
				continue;
			}

			$user = $null
			$objUser = $null
			#Create output objects
			$Output = New-Object PSObject
			# create a new secuity identifier object
			$ObjSID = New-Object System.Security.Principal.SecurityIdentifier($profile.SID)
			# Try to link the user SID to an actual user object (can fail for local accounts on remote machines, 
			#  or the user no long exists but the profile still remains)
			Try { 
				$objUser = $objSID.Translate([system.Security.Principal.NTAccount]) 
			}
			catch { 
				$user = "ERROR: Not Readable"
				
				$MaxAge = (Get-Date).AddDays(-90) 
				$lastused = (([WMI]'').ConvertToDateTime($profile.LastUseTime)).ToString("u")
				if([DateTime]::Parse($lastused) -gt $MaxAge){ 
				   Write-Host ("Skipping Unreadable User profile (recently used) for "+ $profile.path);
				   continue;
				}
				$success = $true
				try { $profile.Delete() }
				catch { $success=$false }
				if($success) {
					Write-Host ("Deleted Profile SID:" +$profile.SID +"for" +$profile.path)
				}
				else {
					Write-Warning ("Unable to Delete or Fully Delete Profile (possibly logged in, or file in use) with SID: " + $profile.SID)
				}
				continue;
			}

			if ($objUser.Value) { $user = $objUser.Value }
		
			$success = $true

			if ( $user.Like("*1516*") -or $user.Like("*1617*") ) {
				Write-Host ("Skipping Possible CA Account: "+ $user);
				continue;
			}

			$MaxAge = (Get-Date).AddDays(-7) 
			$lastused = (([WMI]'').ConvertToDateTime($profile.LastUseTime)).ToString("u")
			if([DateTime]::Parse($lastused) -gt $MaxAge){ 
				   Write-Host ("Skipping Recent profile for "+ $user);
				   continue;
			}


			# note, this wont skip controlled assignment logons						
			if (   $user -like 'DOMAIN\*0*' 
				   -or $user -like 'DOMAIN\*1*' 
				   -or $user.ToLower() -eq "domain\demo" "
				) { 
				# Write-Host ("Attempting to delete profile for SID: " + $profile.SID)
				# The delete process can take some time per profile, timeout is also very high, be patient. 
				try { $profile.Delete() }
				catch { $success=$false }

				if($success) {
					Write-Host ("Deleted Profile SID:" +$profile.SID +" for " +$user)
				}
				else {
					Write-Warning ("Unable to Delete or Fully Delete Profile (possibly logged in, or file in use) with SID: " + $profile.SID)
				}
			} else {
				Write-Host ("Skipping User Profile for " +$user+ " SID: "+ $profile.SID)
			}
		}
	}
	else {
		Write-Warning "Unable to communicate with - $computer"; 
	}
}
}

Remove-Profiles

[minimoo]

If you do decide to do this and run stuff as scheduled tasks - you need to be careful what you call the system account when updating/editing - see:

 

https://maddog2050.wordpress.com/2014/09/11/gpo-issue-deploying-a-scheduled-task-running-as-system/

[ReadTheNetwork]

Have you looked at using mandatory profiles? Isn't this a similar experience that you would want without the need of delprof?