Deleting user profiles via powershell at shutdown via GPO

[IT_Man_Dan]

Afternoon all,

 

I'm looking at deleting local profiles on workstations so they don't fill up the SSD.

I tried manually running delprof2 but kept getting the following error even when run as administrator.

Could not delete key . Error: Access is denied.

 

Having a read on here it seems Powershell might be better for the job with win 10.

I can successfully run the following command through powershell (as admin),

Get-CimInstance win32_userprofile -verbose | Where {$_.LastUseTime -lt $(Get-Date).Date.AddDays(-7)} | Remove-CimInstance -Verbose

The above successfully deletes profiles older than 7 days completely.

 

My question is how best to proceed to set the script to run at shutdown via GPO? I've never set a powershell script to run at shut down, Please tell me if the following steps are incorrect (they must be as it's not working ).

 

1. I put the above command into notepad and saved as deleteprofiles7days.ps1

2. Created a new GPO linked to TEST ou.

3. Edited GPO like this - Computer Config > Win Settings > Scripts > Shutdown (here I copied the script into relevant location and selected it as the script to run).

 

I've placed a workstation into test ou (run gp update) and it isn't working.

Do I need to add to the script or do I need to edit anything else in the GPO?

I did wonder if I need to do anything under Win powershell in Win components? (eg enable script execution) but thought I'd ask first for advice from someone who has done it.

 

Thanks

[mavhc]

Probably due to powershell execution policy being enforced.

 

I end up just running a bat file to run the ps file, as it's easier, but you can also do it this way Running PowerShell Startup (Logon) Scripts Using GPO | Windows OS Hub

 

Better way is to sign your scripts https://www.hanselman.com/blog/signing-powershell-scripts

[psydii]

Do you need to delete profiles like this? We've have had great success in keeping plenty of disk space available though enabling Storage Sense and configuring profiles older that a few weeks to be deleted. It doesn't always leave a clean set of folders, but it gets the job done and ensures there is always enough disk space for the next user or updates to run.

 

More recently we've been running devices configured through EndPoint Manager (nee InTune) with the "Shared PC" profile. This can be set via windows configuration designer if you don't have a licence for intune. It does similar to the above settings, but seems to be more effective at properly cleaning up.

 

https://searchenterprisedesktop.techtarget.com/definition/Microsoft-Windows-10-Shared-PC-Mode

https://docs.microsoft.com/en-us/mem/intune/configuration/shared-user-device-settings-windows

[IT_Man_Dan]

Do you need to delete profiles like this? We've have had great success in keeping plenty of disk space available though enabling Storage Sense and configuring profiles older that a few weeks to be deleted. It doesn't always leave a clean set of folders, but it gets the job done and ensures there is always enough disk space for the next user or updates to run.

 

More recently we've been running devices configured through EndPoint Manager (nee InTune) with the "Shared PC" profile. This can be set via windows configuration designer if you don't have a licence for intune. It does similar to the above settings, but seems to be more effective at properly cleaning up.

 

https://searchenterprisedesktop.techtarget.com/definition/Microsoft-Windows-10-Shared-PC-Mode

https://docs.microsoft.com/en-us/mem/intune/configuration/shared-user-device-settings-windows

 

Thanks but I'm wanting to fully clean-up the profiles including the file structure.

[IT_Man_Dan]

Probably due to powershell execution policy being enforced.

 

I end up just running a bat file to run the ps file, as it's easier, but you can also do it this way Running PowerShell Startup (Logon) Scripts Using GPO | Windows OS Hub

 

Better way is to sign your scripts https://www.hanselman.com/blog/signing-powershell-scripts

 

Thank you for your reply.

I shall now explore using a batch file to run the script.

 

Do I need to add anything to hide the PowerShell script above whilst it runs or set a timer to stop the computer shutting down before it finishes or will it run the script fully before closing down?

 

Thanks

[ticktock]

I had a lot of problems with using Ciminstance to delete profiles. It actually killed some machines by putting them into an automatic recovery loop (I had to re-image). I ran it at startup and thought that timing might be the issue but the same thing happened when running manually. It was ok most of the time but every now and then would corrupt the machine.

[mavhc]

There's probably a script time limit of 30 mins or so hidden somewhere. First run will be slower than the rest, so maybe you'd have to run that manually.

 

Remove-ciminstance has worked for me, to clean up shared machines that were moving to be one to one, so not tested at scale if removed profiles can log in again

[ticktock]

When I ran it manually on one machine it just hung, I rebooted and then it went into the automatic recovery loop. Tried all sorts to fix but had to re-image. Really weird.

[mavhc]

It is really slow, 1000s of files to remove per user

[IT_Man_Dan]

Running it manually I've had great success and it has ticked through in under 30 mins on first run.

I've been side tracked but will look at the batch file option shortly. @mavhc, I may ask you for a view of the script you run if that's ok?

[ticktock]

This is the one I have used, please feel free to tell me if it's wrong!

 

$Exclusions = “NetworkService”,”LocalService”,”systemprofile” Get-CimInstance win32_userprofile -filter "special = false"| Where-Object { $_.LocalPath.split('\')[-1] -notin $Exclusions} | Remove-CimInstance

[mavhc]

I also have

 

Get-CimInstance -Class Win32_UserProfile | Where-Object { $_.localpath -match '^c:\\users\\.*' } 

to avoid removing system profiles

[IT_Man_Dan]

Sorry to bring this back up, I got side tracked on another task.

 

Can someone put their complete powershell script up that they use to delete profiles as the one I posted above now doesn't seem to be working, I'm sure it's just my brain not in gear this morning but would like clarification.

 

Thanks

[BOOT]

If you just want to clear them all...

Shameless plug:

https://github.com/SN29856L/UserProfileRemover/releases

[Patrick]

We just set the pupils AD accounts to be members of guests as well as the usual AD memberships. It clears the profile at log off, and they get a nice clean profile every time they login. Not found any issues of doing this so far.

[Mako]

We just set the pupils AD accounts to be members of guests as well as the usual AD memberships. It clears the profile at log off, and they get a nice clean profile every time they login. Not found any issues of doing this so far.

 

That's a big-brain concept I'd never even considered. Genius.

[Jaan]

That's a big-brain concept I'd never even considered. Genius.

 

I agree... this has blown my mind lol such a simple solution. Does it increase login time?

 

Our users are members of the "domain users" builtin group. Would i add them to the guest group in addition to, or instead of?

 

Gonna give this a go i think.

 

i started this thread about an issue we were having with local profiles.

 

http://www.edugeek.net/forums/windows-10/218759-how-you-guys-removing-old-stale-local-profiles-windows-10-ltsb-1809-a.html

[Patrick]

Yes, it'll increase login times as it has to build a new profile each time you login, but on modern kit it's really not that bad. it's only the same as manually or scripting the deletion though. Basically you'll have your AD pupil accounts members of the usual things you'd have (Domain user, Pupils, etc) I just add Domain guests to the list, so in addition to your normal groups. I cant say what implications it will have for you, so test thoroughly, but our networks are rather simple and are just small primaries, but it works well for us. I only do it for the student accounts, the teachers don't really roam around between rooms. Edited November 26, 2020 by Patrick

[psydii]

It breaks Store apps though.

[Patrick]

such as calcuator and video editor? They work ok for us. I do have the store restricted though as we don't use it.

[mavhc]

Blocking the store app itself doesn't stop the UWP apps updating.

 

Every time a new user logs in it sets up a registry hive and other files for each UWP app installed, that's the main slowness, which is why they bought FSlogix

[sonofsanta]

Can't you just do it via GPO? Policies > Admin Templates > System > User Profiles > Delete user profiles older than a specified number of days on system restart

 

Has always worked okay for me. Currently set to 15 days for us to accomodate the two week timetable; we were starting to get SSDs fill up from teachers roaming between classrooms cos of that COVID bubble thing and getting the Teams client in every new room. (Kids have mandatory profiles anyway, so nothing gets stored for them)

[evasion]

I have set up scheduled task that runs delprof2 from server share when user logs off (triggered by log off event ID), easy to deploy in power shell. works 100%.

[petben]

Do you need to delete profiles like this? We've have had great success in keeping plenty of disk space available though enabling Storage Sense and configuring profiles older that a few weeks to be deleted. It doesn't always leave a clean set of folders, but it gets the job done and ensures there is always enough disk space for the next user or updates to run.

 

More recently we've been running devices configured through EndPoint Manager (nee InTune) with the "Shared PC" profile. This can be set via windows configuration designer if you don't have a licence for intune. It does similar to the above settings, but seems to be more effective at properly cleaning up.

 

https://searchenterprisedesktop.techtarget.com/definition/Microsoft-Windows-10-Shared-PC-Mode

https://docs.microsoft.com/en-us/mem/intune/configuration/shared-user-device-settings-windows

 

Hello, do you find this setting deletes the C:\users\username folder too?

Thanks

[mbedford]

I use this quite frequently on a TS server used by hundred's of logins every day

 

$profiles = Get-CimInstance Win32_UserProfile | Where-Object { $_.Loaded -eq $False}

foreach ($item in ($profiles | select LocalPath, LastUseTime, SID | Sort-Object LastUseTime | where {$_.LastUseTime -lt ((get-date).AddDays(-4))})){


   Get-CimInstance Win32_UserProfile | Where-Object { $_.SID -eq $item.SID} | Remove-CimInstance 
   Write-Host "Deleted"
}

Change the AddDays(-4) to any number of days you want (it deletes any profile over x days old, 4 in this case)

 

Takes about 20 - 25 mins to run and recovers easily 20-30gb of space each time for me. Been running this for months with no reported ill effects. You can omit the "Write-Host "Deleted", i put that in so I could see the script was actually doing something.

Edited January 18, 2022 by mbedford