[1909, ou] NTUSER.DAT - Local profile modified for disabled user - Breaking DelProf2

[CHiLL]

I've come across an issue where our machines are filling up storage due to profiles. We have DelProf2 configured as a shutdown script (with the /u /i /q /d:60 parameters), however, we've noticed it isn't deleting profiles, even for staff who left a year ago and their AD accounts are disabled.

 

After some digging, I've found that DelProf2 reports:

(reason: not old enough to be deleted)

 

Looking at one of the affected profiles on the machine, the profile is still there and the folder has a modification date of 06/03/2020, so well over a year ago. However, looking at NTUSER.DAT, I'm seeing that it has a modification date of 05/07/2021, so yesterday. I assume DelProf2 is looking at the modification date of this file, but I don't understand why NTUSER.DAT is being modified at all on that computer, on a local profile that's for a long disabled user (August 2020 was the disabled date - and it is definitely disabled).

 

Has anyone else come across this?

 

Edit: Could this be caused by our AV (Windows Security by SCCM/SCEP)?

Edited July 6, 2021 by CHiLL

[MartinByard]

Is it worth trying out the /ntuserini switch when running delprof, to see if that makes a difference ?

 

       /ntuserini
           When determining profile age for /d, use the file NTUSER.INI
           instead of NTUSER.DAT for age calculation

[CHiLL]

Is it worth trying out the /ntuserini switch when running delprof, to see if that makes a difference ?

 

       /ntuserini
           When determining profile age for /d, use the file NTUSER.INI
           instead of NTUSER.DAT for age calculation

Ahah! That's the one, I've just used that switch and it's now detecting those profiles as old enough to delete. I haven't had to use that switch up until now and honestly forgot it existed! Thanks!

Edited July 6, 2021 by CHiLL

[CHiLL]

I didn't want to have to bump this thread, but here we are! I'm finding that the /ntuserini is deleting all profiles, which is the exact opposite issue I was having!

 

"Delprof2.exe /u /i /q /d:60" - Deletes no profiles, even those older than 60 days

"Delprof2.exe /u /i /q /d:60 /ntuserini" - Deletes all profiles, even those younger than 60 days

 

Anyone encountered this behaviour before?

[BOOT]

Don't use delprof2. It doesn't work in Windows 10.

Profiles are much more complicated now that app containers exist.

It doesn't keep the AppX provisioning in sync with profiles if they're simply deleted.

[CHiLL]

I have seen that comment for a few years, but I don't know what people are doing instead. Our PCs only have 120GB SSDs, and they're quickly filled by profiles.

[round2it]

group policy should delete after x amount of days i have that set somewhere i have it set for 2 months to cover the summer holidays

[CHiLL]

group policy should delete after x amount of days i have that set somewhere i have it set for 2 months to cover the summer holidays

I thought that policy didn't work, or it did in XP days but not on more recent versions of Windows.

[BOOT]

I thought that policy didn't work, or it did in XP days but not on more recent versions of Windows.

That's because old profiles can be loaded during updates etc. and never go stale.

[psydii]

Uncomfortable truth: 120Gb is too small for shared devices in a traditional AD set up. The cost to upgrade (assuming 2.5" SSD or similar) is worth it in improved productivity for user and preventing IT spending time (at 2K+ per year) on a Sisyphean task.

 

The fix is to spend money, or to move to pure Intune managed shared devices which keep profiles pretty much ephemeral.

 

You may not have the budget for it, but the Head can find it they understand how important it is.