GPO Windows 7 - Automatically Delete Local User Profiles Older Than X number of Days

[nsuljic]

Hello Everyone - I know that some of you probably use scripts to delete old profiles, but I wanted to see if anyone has been able to get the Group Policy working that is supposed to delete user profiles older than X number of days?

 

Computer Configuration

-Policies

--Administrative Templates

---System/User Profiles

----"Delete user profiles older than a specified number of days on system restart"

 

I run a couple of computer labs at a Medical School and we have a lot of students logging in to the machines. Within a short period of time, a lot of local profiles build up and degrade the performance of the computers. Any suggestions would be much appreciated.

 

Thanks,

Nermin

[3s-gtech]

How are you finding they're degrading performance? Are you using Local Profiles? With a roaming or mandatory profile, you can allow huge numbers of profiles to build up - the system won't appreciably slow down unless the HDD is filling up.

[bossman]

@nsuljic:

 

We don't rely on the GPO which does this as it is not very reliable and as you have mentioned we run a script at logoff which reads the users profiles from a txt file which we wish to have deleted. This runs every time they logoff so very little impact on the logon times and keeps the workstations clean.

 

We do run with roaming profiles so this is a great help as they can increase in size over time and when a profile becomes greater than 2Mb in size it can easily become corrupt so a regular cleaning of peoples profiles does have an increased effect on the logon times.

 

Edited January 25, 2011 by bossman

[nsuljic]

We are using local profiles. The computers are slowing down and when we run virus scans it takes so much longer to finish scanning because there are so many useless profiles to scan through. Ideally, I'd like to delete all profiles that are older than 30 days. Delprof in XP worked really well. This group policy setting would be great if I could only get it to work...

[5tu]

I'm sure I read something about this. When AV software (and/or Windows Defender) scans the local disk it "touches" the profiles and alters their modified time. Therefore if your clients run a daily scan, profiles will never be older than 24hrs.

 

See http://support.microsoft.com/kb/983544

Edited January 25, 2011 by gybe78

[nsuljic]

Thanks for the useful info, I will try the hotfix and will report back with results...

[kennysarmy]

We are using local profiles. The computers are slowing down and when we run virus scans it takes so much longer to finish scanning because there are so many useless profiles to scan through. Ideally, I'd like to delete all profiles that are older than 30 days. Delprof in XP worked really well. This group policy setting would be great if I could only get it to work...

 

Why do you need to scan local pc's?

I only scan the servers each night and just ensure the clients A/V are upto date.

[3s-gtech]

I run a weekly scan - alot of nasties find their way into the user profiles on the local PCs.

[nsuljic]

Same here, students tend to download all kinds of stuff and our IT security department mandates that we run daily "Quick Scans" and weekly "Full Scans" on all of the machines... Whenever infections are detected, they are usually located in user profiles, so eliminating those at a regular basis would definitely help. One of the random machines that I selected in one of my labs and installed the hotfix, it has 193 local profiles!

[kennysarmy]

Same here, students tend to download all kinds of stuff and our IT security department mandates that we run daily "Quick Scans" and weekly "Full Scans" on all of the machines... Whenever infections are detected, they are usually located in user profiles, so eliminating those at a regular basis would definitely help. One of the random machines that I selected in one of my labs and installed the hotfix, it has 193 local profiles!

 

Do you have to leave your PC's on all night then?

How do you schedule your scans for times when they are ON but not being used?

[nsuljic]

The Lab is open 24/7 so the computers stay on all the time. We schedule the scans during off peak hours (4:00 in the morning).

[burgemaster]

I found that GP setting to be a bit flakey..

Sometimes it would not delete they profile and at other times delete everything but the appdir folder.

[carvjo]

Add your users to the 'Domain Guests' global group - those users won't leave any profile on your computers.. it works!

[srochford]

We run this script every night to clean up. The check at the start is to exclude certain machines (the ones in lecture theatres)

 

The next section uses a WMI call to get a list of profiles other than the "special" ones (localsystem etc) and delete them (this is what you see when you go to the control panel and delete profiles)

 

This will sometimes leave bits behind so the next step is to get a list of folders which shouldn't be deleted by reading the existing profiles from the registry - this list is built in a dictionary. To this is then added things like "public" and "default".

 

The script then scans c:\users and checks each folder it finds against the dictionary. If the folder isn't listed then it gets deleted (because it doesn't need to be there)

 

const HKEY_LOCAL_MACHINE = &H80000002

set oDic=createobject("scripting.dictionary")
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
Set oWMIService = GetObject("winmgmts:\\.\root\cimv2")
set oFSO=createobject("scripting.filesystemobject")
set oShell=createobject("wscript.shell")

on error resume next

'are we on an AV machine? if so, quit - leave profiles alone in theatres
if ofso.fileexists("c:\windows\av") then wscript.quit

Set colItems = oWMIService.ExecQuery("Select * from Win32_UserProfile where special=false and loaded=false",,48)
For Each oItem in colItems
 sSid=oItem.SID
 Set oUserProfile = GetObject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2:Win32_UserProfile.SID='" & sSID &"'")
 oUserProfile.Delete_
Next

'now clean up directories not attached to profiles
'and profiles not completely deleted by first step
'build a list of the directories used by profiles

sPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
oReg.EnumKey HKEY_LOCAL_MACHINE, sPath, arrSubKeys
For Each subkey In arrSubKeys
 lRc=oReg.GetStringValue(HKEY_LOCAL_MACHINE, sPath & "\" & subkey ,"ProfileImagePath",sDir)
 sDir=lcase(sDir)
 oDic.add sDir, subkey
Next

'now add the "fixed" profiles

lRc=oReg.GetStringValue(HKEY_LOCAL_MACHINE, sPath ,"ProfilesDirectory",sRoot)
sRoot=lcase(oShell.expandenvironmentstrings(sRoot))
sRoot=sRoot & "\"

oDic.add sRoot & "public","public"
oDic.add sRoot & "all users", "all users"
oDic.add sRoot & "default","default"
oDic.add sRoot & "default user", "default user"


set oFolder=ofso.getfolder("c:\users")
for each oSubFolder in oFolder.subfolders
 sFolder=sRoot & lcase(oSubFolder.name)
 if not(oDic.exists(sFolder)) then
   'orphaned folder so delete it
   ofso.deletefolder sFolder, true
 end if
next

[Chunks_]

we also run a script when the computers remotely shut down of an evening that deletes the profiles. However you could just link the gp during the holidays force a couple of reboots then unlink the gp. Bit of house keeping but might be a solution.

[tsolinas]

We run this script every night to clean up. The check at the start is to exclude certain machines (the ones in lecture theatres)

 

The next section uses a WMI call to get a list of profiles other than the "special" ones (localsystem etc) and delete them (this is what you see when you go to the control panel and delete profiles)

 

This will sometimes leave bits behind so the next step is to get a list of folders which shouldn't be deleted by reading the existing profiles from the registry - this list is built in a dictionary. To this is then added things like "public" and "default".

 

The script then scans c:\users and checks each folder it finds against the dictionary. If the folder isn't listed then it gets deleted (because it doesn't need to be there)

 

const HKEY_LOCAL_MACHINE = &H80000002

set oDic=createobject("scripting.dictionary")
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
Set oWMIService = GetObject("winmgmts:\\.\root\cimv2")
set oFSO=createobject("scripting.filesystemobject")
set oShell=createobject("wscript.shell")

on error resume next

'are we on an AV machine? if so, quit - leave profiles alone in theatres
if ofso.fileexists("c:\windows\av") then wscript.quit

Set colItems = oWMIService.ExecQuery("Select * from Win32_UserProfile where special=false and loaded=false",,48)
For Each oItem in colItems
 sSid=oItem.SID
 Set oUserProfile = GetObject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2:Win32_UserProfile.SID='" & sSID &"'")
 oUserProfile.Delete_
Next

'now clean up directories not attached to profiles
'and profiles not completely deleted by first step
'build a list of the directories used by profiles

sPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"
oReg.EnumKey HKEY_LOCAL_MACHINE, sPath, arrSubKeys
For Each subkey In arrSubKeys
 lRc=oReg.GetStringValue(HKEY_LOCAL_MACHINE, sPath & "\" & subkey ,"ProfileImagePath",sDir)
 sDir=lcase(sDir)
 oDic.add sDir, subkey
Next

'now add the "fixed" profiles

lRc=oReg.GetStringValue(HKEY_LOCAL_MACHINE, sPath ,"ProfilesDirectory",sRoot)
sRoot=lcase(oShell.expandenvironmentstrings(sRoot))
sRoot=sRoot & "\"

oDic.add sRoot & "public","public"
oDic.add sRoot & "all users", "all users"
oDic.add sRoot & "default","default"
oDic.add sRoot & "default user", "default user"


set oFolder=ofso.getfolder("c:\users")
for each oSubFolder in oFolder.subfolders
 sFolder=sRoot & lcase(oSubFolder.name)
 if not(oDic.exists(sFolder)) then
   'orphaned folder so delete it
   ofso.deletefolder sFolder, true
 end if
next

 

Hi There

 

I was wanting to use this script but cannot get it to work in Windows 7, nothing seems to happen.

 

I was hoping you could advise further

 

Thanks

[Steve21]

Would help if you could expand a bit

 

What's not working? What users aren't being deleted? Do you have the AV folder that breaks out of the script?

 

etc etc

 

Steve

[tsolinas]

Would help if you could expand a bit

 

What's not working? What users aren't being deleted? Do you have the AV folder that breaks out of the script?

 

etc etc

 

Steve

 

I removed the AV section as it didn't apply, and i have run the script manually and it seems to be doing something for a couple of minutes but all the profiles are still there, even in the registry.

 

any ideas

[chrirule]

It's been a while since you posted this question. Sorry for the slow response.

 

The GPO to delete user profiles works, all too well I'm afraid. We set this up for precisely the reason you state and because we have some terminal servers we didn't want to have hundreds and hundreds of user profiles taking space and slowing the server. So I set this to 30 days. Until August everything was just great and we had forgotten about even making the change. Now as teachers return they are missing a bunch of stuff they saved because it was on their laptops and/or computers instead of their network drive.

 

We have been able to use Recuva to retrieve the deleted files.

 

This also works well for viruses that delete or move the contents of the desktop.

 

Now we set the X number of days to 180...

 

Chris

 

 

 

Hello Everyone - I know that some of you probably use scripts to delete old profiles, but I wanted to see if anyone has been able to get the Group Policy working that is supposed to delete user profiles older than X number of days?

 

Computer Configuration

-Policies

--Administrative Templates

---System/User Profiles

----"Delete user profiles older than a specified number of days on system restart"

 

I run a couple of computer labs at a Medical School and we have a lot of students logging in to the machines. Within a short period of time, a lot of local profiles build up and degrade the performance of the computers. Any suggestions would be much appreciated.

 

Thanks,

Nermin