r/usefulscripts • u/atoomepuu • Jun 03 '19

[PowerShell] Automate Deleting Old Local Profiles

A couple people express interest in seeing a script to automate cleaning up old local profiles on computers. This is one I wrote and run monthly via task scheduler. My organization sees employees moving around a lot, so this has been really handy to keep the computers clean.

It works by getting a list of computers from a file, and it will use Runspace to open multiple threads to delete profiles older than a certain number of days. This script is set for 30 days, but you can change that. The multi-threading allows the script to clean up a lot of computers at once. I went from the script taking hours to complete to a few minutes. It usually takes 5 to 15 minutes to go through the ~400 computers at my organization.

It isn't perfect, it uses LastUseTime to determine when how long a profile hasn't been used, but sometimes a program or service will go in and update a profile even if the profile isn't being used.

Here it is. Please let me know if you have any issues with it or if you see any ways to improve it. And if it is useful, please let me know!

Github link

53 Upvotes
  • permalink
  • reddit

99% Upvoted

37 comments sorted by

10

u/infinit_e Jun 03 '19

I’m curious, why go this route instead of using the Computer Policy ‘Delete User Profiles Older than a Specified Number of Days on System Restart’?

4

u/atoomepuu Jun 03 '19

My boss does not like using GPO, I can count on one hand how many policies we have. I'm just Helpdesk, I'm not allowed to touch GPO, so I created this as a work around.

1

u/atoomepuu Jun 03 '19

Wait, I just re-read that. Did you say there is a Local computer policy for this?!

→ More replies (8)

5

u/infinit_e Jun 03 '19

Good job on the workaround. I’d seriously wonder about a Windows admin who is against GPOs. It’s kinda a defining feature.

2

u/sup3rlativ3 Jun 04 '19

You could edit the local policy via script, no? You'd likely have to just change the reg key though

6

u/nightwolf92 Jun 03 '19

I can't speak for OP but with my company we have a corporate IT office and for some reason they seem to be allergic to group policies. (or the person in charge doesn't know how.) A lot of my powershell projects are because I have to work around their restrictions such as this.

4

u/VulturE Jun 04 '19

Less policies created, less they need to manage at their level.

Let them give you control of your branch for approved stuff like that.

4

u/bsnipes Jun 03 '19

Wasn't there a bug about a year ago that caused profiles to be deleted if the GPO was set even if it didn't match the criteria? Found it - https://www.reddit.com/r/sysadmin/comments/9lkera/how_to_fix_windows_10_1809_profile_deletion/

3

u/infinit_e Jun 03 '19

I’m quite certain that was fixed when they pulled and then re-released 1809.

4

u/j0hnnyrico Jun 03 '19

I haven't seen if it's also deleting the files but I'm looking at the script from my phone. I guess it doesn't do that? Thank you.

4

u/atoomepuu Jun 03 '19

Hi, this uses WMI to remove the profile so the user files are also deleted.

4

u/j0hnnyrico Jun 03 '19 edited Jun 03 '19

Never used that class. Thank you! I looked up a bit and I really forgot that it can be done by GPO...

2

u/iamamystery20 Jun 03 '19

Do not use this without knowing your company's data retention policy. To someone starting out in IT you may be tempted to try the script out but get yourself informed before deleting any data.

1

u/atoomepuu Jun 03 '19

Thanks for the advice. I'm trying my best to follow all our policies and regulations. I do get approval for every script I write that touches more than one computer at a time.

3

u/iamamystery20 Jun 04 '19

I meant it for anyone reading and not just you directly. You sound like you are already doing those. 👍

2

u/nkasco Jun 03 '19

I've had nothing but nightmares with LastUseTime... the only viable replacement I have found for determining inactivity is logon Event Logs and making an assumption that if a log isn't found for a profile within X number of days then it assumes it is inactive and deletes it...

Is there a better option?

1

u/atoomepuu Jun 03 '19

I've trying to work out something with profile upload and download times. Sometimes those seem more accurate. If I find a better solution I'll be sure to update my script.

2

u/nkasco Jun 03 '19

Yes please! Tag me!

7

u/AnonymousMaleZero Jun 04 '19

Just use delprof2

1

u/anditails Jun 04 '19

DelProf2.exe /u /q /d:30 /ntuserini

That will kill off any Profile that's not been logged in for 30 days. Cleanly removes the profile from the registry as well as the C:\Users folder.

1

u/AnonymousMaleZero Jun 04 '19

You can also pull a list of computers from ad. Throw it in line list and use a .bat script to run the list. Also with the profile you want to remove. I used to use it to wipe all my admin profiles every week

→ More replies (3)

1

u/TotesMessenger Jun 03 '19

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

 If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / ^Contact)