Forum Discussion

Joe_Friedel's avatar
Joe_Friedel
Brass Contributor
Aug 31, 2017
Solved

Issue with date modified for NTUSER.DAT

Is Microsoft aware of an issue with various Windows 10 processes causing the date modified timestamp on the NTUSER.DAT file in unused profiles to change? We have specifically noticed that installatio...
  • Joe_Friedel's avatar
    Joe_Friedel
    Feb 23, 2018

    Here is the code from the script:

     

    #Purpose: Used to set the ntuser.dat last modified date to that of the last modified date on the user profile folder.
    #This is needed because windows cumulative updates are altering the ntuser.dat last modified date which then defeats
    #the ability for GPO to delete profiles based on date and USMT migrations based on date.

    $ErrorActionPreference = "SilentlyContinue"
    $Report = $Null
    $Path = "C:\Users"
    $UserFolders = $Path | GCI -Directory

    ForEach ($UserFolder in $UserFolders)
    {
    $UserName = $UserFolder.Name
    If (Test-Path "$Path\$UserName\NTUSer.dat")
        {
        $Dat = Get-Item "$Path\$UserName\NTUSer.dat" -force
        $DatTime = $Dat.LastWriteTime
        If ($UserFolder.Name -ne "default"){
            $Dat.LastWriteTime = $UserFolder.LastWriteTime
        }
        Write-Host $UserName $DatTime
        Write-Host (Get-item $Path\$UserName -Force).LastWriteTime
        $Report = $Report + "$UserName`t$DatTime`r`n"
        $Dat = $Null
        }
    }

matthew hansen's avatar
matthew hansen
Copper Contributor
Jan 11, 2018

I'm currently running into this exact issue. Was there a bug report submitted or were you able to find a fix? 

  • Joe_Friedel's avatar
    Joe_Friedel
    Brass Contributor
    Jan 19, 2018

    I did submit this in the Feedback Hub app 5 months ago. It has 1 upvote and no comments. I have not tested to see if this was fixed in 1709. We developed a PowerShell script that loops through the user profiles and sets the ntuser.dat date modified value to the date modified value from the user profile folder. We just run this on a set schedule for any computers where we're using the profile deletion GPO setting.

    • bcoldiron's avatar
      bcoldiron
      Copper Contributor
      Aug 27, 2019

      Joe_Friedel I realize you posted this a year and a half ago but would you mind sharing that powershell script that loops through user profiles and updates the ntuser.dat last modified date?

    • Hilde Claeys's avatar
      Hilde Claeys
      Copper Contributor
      Feb 20, 2018

      hi Joe

       

      We struggle with the same problem in our school.  Could you share the powershell script with us?

       

      • Joe_Friedel's avatar
        Joe_Friedel
        Brass Contributor
        Feb 23, 2018

        Here is the code from the script:

         

        #Purpose: Used to set the ntuser.dat last modified date to that of the last modified date on the user profile folder.
        #This is needed because windows cumulative updates are altering the ntuser.dat last modified date which then defeats
        #the ability for GPO to delete profiles based on date and USMT migrations based on date.

        $ErrorActionPreference = "SilentlyContinue"
        $Report = $Null
        $Path = "C:\Users"
        $UserFolders = $Path | GCI -Directory

        ForEach ($UserFolder in $UserFolders)
        {
        $UserName = $UserFolder.Name
        If (Test-Path "$Path\$UserName\NTUSer.dat")
            {
            $Dat = Get-Item "$Path\$UserName\NTUSer.dat" -force
            $DatTime = $Dat.LastWriteTime
            If ($UserFolder.Name -ne "default"){
                $Dat.LastWriteTime = $UserFolder.LastWriteTime
            }
            Write-Host $UserName $DatTime
            Write-Host (Get-item $Path\$UserName -Force).LastWriteTime
            $Report = $Report + "$UserName`t$DatTime`r`n"
            $Dat = $Null
            }
        }

Resources