@MB_99 , @Ryan Pertusio , @Ryan Pertusio
This is an OK idea, but I would not fully rely on it. The best you could hope for is to put this at the top of your IF statement to use IF the file exists. Because inevitably this will run on a workstation that does not have this file and your script will be looking for it and it won't be found--what happens then? A bunch of stuff that you did not want to be deleted is now gone.
Again, my Org does not use the Group Policy to delete profiles. We're using a script on a "on run" basis, or sometimes via Task Scheduler to do the cleanup. This is the operation I landed on. The $UserProfileThreshold is set outside of the scriptblock as a script parameter. The basis for deletion is determined one of two ways. If the User's LocalProfileLoadTime is able to be determined via the registry, this timestamp is used first. If these registry properties don't exist, I take the newest of the IconCache.db and the LastWriteTime of the user profile directory. These are the three values I trust the most, the LocalProfileLoadTime value being the most accurate out of the bunch.
OldUserProfiles {
$DeleteProfile = (Get-Date).AddDays(-$UserProfileThreshold)
$ExcludedUsers = @('Administrator','Public','Default',"$ComputerName")
$UserFolders = "C:\Users" | Get-ChildItem -Directory -Exclude $ExcludedUsers
$CimProfiles = Get-CimInstance -Class Win32_UserProfile
$RegProfiles = Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\*"
$NA = [datetime] "11/11/1111 11:11:11 AM"
$Valid = [datetime] "2/2/2000 22:22:22 PM"
$ProfileData = ForEach ($UserFolder in $UserFolders) {
$UserName = $UserFolder.Name
$UserProfileTime = $UserFolder.LastWriteTime
$CimProfile = $CimProfiles | Where-Object { $_.localpath -eq $UserFolder.FullName }
if ($CimProfile) { $CimProfileTime = $CimProfile.LastUseTime } else { $CimProfileTime = $NA }
#$NTUsr = Get-Item "$UserFolder\NTUSer.dat" -Force
#if ($NTUsr) { $NTUsrTime = $NTUsr.LastWriteTime } else { $NTUsrTime = $NA }
#$UsrClass = Get-Item "$UserFolder\AppData\Local\Microsoft\Windows\UsrClass.dat" -force
#if ($UsrClass) { $UsrClassTime = $UsrClass.LastWriteTime } else { $UsrClassTime = $NA }
$IconCache = Get-Item "$UserFolder\AppData\Local\IconCache.db" -Force
if ($IconCache) { $IconCacheTime = $IconCache.LastWriteTime } else { $IconCacheTime = $NA}
$RegProfile = $RegProfiles | Where-Object { $_.ProfileImagePath -eq $UserFolder.FullName }
$ProfileLoadHighDec = $RegProfile.LocalProfileLoadTimeHigh
$ProfileLoadLowDec = $RegProfile.LocalProfileLoadTimeLow
# Convert Decimal to Hex string, Example: ProfileLoadHighHex = 01d8fd57 / ProfileLoadLowHex = 86b1d3bc
$ProfileLoadHighHex = [System.Convert]::ToString($ProfileLoadHighDec,16)
$ProfileLoadLowHex = [System.Convert]::ToString($ProfileLoadLowDec,16)
# Concatenate hex strings, Example: 01d8fd5786b1d3bc
$ProfileHexJoined = -join ($ProfileLoadHighHex,$ProfileLoadLowHex)
# Convert to DateTime format, Example: 11/21/2022 03:15:37
$TimestampInt = [Convert]::ToInt64($ProfileHexJoined,16)
$ProfileLoadTime = [DateTime]::FromFileTimeutc($TimestampInt)
# If ProfileLoadTime exists, use that as the newest timestamp, if not use the newest of UserProfileTime and IconCacheTime
if ($ProfileLoadTime -gt $Valid) {
$LastUpdated = $ProfileLoadTime
} else { $LastUpdated = $UserProfileTime,$IconCacheTime | Sort-Object | Select-Object -Last 1 }
if ($LastUpdated -lt $DeleteProfile) { $Delete = $True } else { $Delete = $False }
[PSCustomObject]@{
UserName = $UserName
ProfileFullname = $UserFolder.FullName
UserProfileTime = $UserProfileTime
CimProfileTime = $CimProfileTime
# NTUsrTime = $NTUsrTime
# UsrClassTime = $UsrClassTime
IconCacheTime = $IconCacheTime
ProfileLoadTime = $ProfileLoadTime
LastUpdated = $LastUpdated
Delete = $Delete
}
# Remove all iteration data as to not corrupt datastream
'UserName','UserProfileTime','CimProfile','CimProfileTime','NTUsr','NTUsrTime','UsrClass','UsrClassTime','IconCache','IconCacheTime','LastUpdated','Delete' | ForEach-Object { Remove-Variable $_ }
'RegProfile','ProfileLoadHighDec','ProfileLoadLowDec','ProfileLoadHighHex','ProfileLoadLowHex','ProfileHexJoined','TimestampInt','ProfileLoadTime'| ForEach-Object { Remove-Variable $_ }
}
ForEach ($UserProfile in $ProfileData) {
if ($UserProfile.Delete) {
if ($UserProfile.CimProfileTime) {
$CimProfile = $CimProfiles | Where-Object { $_.LocalPath -eq $UserProfile.ProfileFullName }
Remove-CimInstance $CimProfile
Write-Log "User OS profile permanently deleted: $($UserProfile.ProfileFullname)" $LogFile
} else { # If the profile found in C:\Users does not exist in Win32_UserProfiles
#Remove-Item $UserProfile.ProfileFullName -Recurse -Force -ErrorAction Stop
#Write-Log "User OS profile permanently deleted: $($UserProfile.ProfileFullname)" $LogFile
Write-Log "USER OS PROFILE DOES NOT EXIST IN THE REGISTRY: $($UserProfile.ProfileFullname)" $LogFile
}
}
}
Write-Log "END OldUserProfiles cleanup" $LogFile
}
. I am, however, confident in the logic having been weaned on K&R.