Delprof2 – User Profile Deletion Tool
2018-10-09: Delprof2 has issues with UWP apps on Windows 10. Why? Windows 10 stores per-user settings in per-machine database files that are exclusively locked (almost?) all of the time. I consider this a design flaw on the part of Microsoft and I am not going to waste my time trying to work around that.
Delprof2 is the unofficial successor to Microsoft’s Delprof which does not work with operating systems newer than Windows XP. Here are the main facts:
- Delprof2 is syntax compatible to the original Delprof, but more powerful
- Delprof2 lets you explicitly specify which profiles to delete
- Delprof2 bypasses security to delete profiles regardless of current permissions/owner
- Delprof2 supports very long paths
- Delprof2 works on all modern versions of Windows
- Delprof2 is free for personal and commercial use
What Does it Do?
Delprof2 deletes inactive user profiles. If you want to reclaim disk space just run it without parameters and it will delete all profiles except your own and some special profiles needed by the operating system (like “Default”).
Delprof2 has additional filtering options: you might want to delete locally cached copies of roaming profiles only or delete only those profiles that have not been used in a specified number of days. Delprof2 does it all, both on the local system and remotely.
Special Features
Exclusions and Inclusions with Wildcards
It is a frequent requirement to delete all profiles except one or two which should be left unchanged. With version 1.5 of Delprof2 that is easily possible: profiles can be excluded from deletion using a wildcard notation. If, on the other hand, only a few known profiles are to be deleted, use the inclusion feature and Delprof2 ignores everything else. Combining excludes and includes is possible, too, of course.
Bypassing Security
User profiles often have permissions set on them in such a way that not even administrators have access without prior ACL manipulation. Delprof2 circumvents this requirement by making use of backup and restore privileges to analyze and delete even the most tightly secured profiles.
Long Paths
Some programs store files in paths with more than 260 characters. Most tools cannot deal with such paths that are longer than the value of MAX_PATH (260). Windows Explorer is a prominent example. Delprof2, on the other hand, makes use of special APIs to be able to delete files in the remotest areas of your hard drive.
Syntax and Examples
The program’s help screen describes the available options in detail:
Delprof2 by Helge Klein (https://helgeklein.com)
Delprof2 deletes inactive Windows user profiles (profiles that are not currently loaded).
Delprof2 is syntax compatible with the original Delprof by Microsoft. Unlike the original it works on all modern versions of Windows.
If possible, Delprof2 uses the backup and restore privileges to bypass security and delete even profiles the executing user does not
normally have access to.
Delprof2 has no problem whatsoever deleting files in very long paths (longer than MAX_PATH, 260 characters).
Delprof2 also cleans up stale ProfileList SID.bak registry entries, a common cause of temporary profiles.
Usage: delprof2 [/l] [/u] [/q] [/p] [/r] [/c:[\\]<computername>] [/d:<days> [/ntuserini]] [/ed:<pattern>] [/id:<pattern>] [/i]
/l List only, do not delete (what-if mode)
/u Unattended (no confirmation)
/q Quiet (no output and no confirmation)
/p Prompt for confirmation before deleting each profile
/r Delete local caches of roaming profiles only, not local profiles
/c Delete on remote computer instead of local machine
/d Delete only profiles not used in x days
/ntuserini
When determining profile age for /d, use the file NTUSER.INI
instead of NTUSER.DAT for age calculation
/ed Exclude profile directories whose name matches this pattern
Wildcard characters * and ? can be used in the pattern
May be used more than once and can be combined with /id
/id Include only profile directories whose name matches this pattern
Wildcard characters * and ? can be used in the pattern
May be used more than once and can be combined with /ed
/i Ignore errors, continue deleting
Examples:
Delprof2 /c:computername
Deletes inactive profiles on 'computername'.
Delprof2 /c:computername /l
Lists inactive profiles on 'computername' without deleting them.
Delprof2 /d:30
Deletes profiles older than 30 days on the local computer.
Delprof2 /r
Deletes locally cached roaming profiles only.
Delprof2 /ed:admin* /ed:pmiller
Deletes all inactive profiles on the local computer except those starting with 'admin' and the one called 'pmiller'.Here is an example of Delprof2 in action, deleting user profiles remotely on a Windows XP computer (Windows 7 / 2008 R2 work just as well):
D:\>DelProf2.exe -c:192.168.175.130 -p
DelProf2 by Helge Klein (https://helgeklein.com)
Delete inactive profiles on '192.168.175.130'? (Yes/No) y
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\All Users' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\Default User' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\LocalService' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\NetworkService' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\Administrator.WINXP' (reason: in use)
The following user profiles match the deletion criteria:
\\192.168.175.130\C$\Dokumente und Einstellungen\administrator.HK
\\192.168.175.130\C$\Dokumente und Einstellungen\Helge
\\192.168.175.130\C$\Dokumente und Einstellungen\test01
\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal
\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal2
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\administrator.HK'? (Yes/No) y
Deleting profile '\\192.168.175.130\C$\Dokumente und Einstellungen\administrator.HK' ...
... done.
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\Helge'? (Yes/No) n
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\test01'? (Yes/No) n
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal'? (Yes/No) n
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal2'? (Yes/No) n
Changelog
Version 1.6.0
a) New features
- Support for Windows 8, 8.1 and Server 2012 (R2)
================================================
Version 1.5.4
a) Bugfixes
- Mandatory profiles were not detected as being in use
================================================
Version 1.5.3
a) New features
- Client side rendering print provider data is now deleted, too.
================================================
Version 1.5.2
a) Bugfixes
- Fixed incorrect messages "not old enough to be deleted" which happened if: profile age < time zone offset
(for negative time zone offsets larger than one, e.g. the USA)
================================================
Version 1.5.1
a) Bugfixes
- Version 1.5 introduced a bug which prevented Delprof2 from working on Windows XP. This has been fixed.
================================================
Version 1.5
a) New features
- Inclusion and exclusion of profile directories
- Delprof2 now also cleans up these registry locations:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileGuid\<GUID> [where SidString equals the current profile user's SID]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\<SID>
- NTUser.ini can be used instead of NTUser.dat for profile age calculation. This is useful if your antivirus product regularly mounts user
profile registry hives, updating their timestamps in the process.
- Delprof2 is now digitally signed
- Changed license. Please consult the product's website for details.
b) Changed features
- Delprof2 needs the Remote Registry service on remote computers. Added a concise error message if the service is not started
- When only listing (not deleting) permissions the text printed on the screen now clearly states that fact
- The Systemprofile was ignored previously, now it is explicitly excluded (just in case)
c) Bugfixes
- Profiles with "access denied" were not ignored although that was printed on the screen
================================================
Version 1.0.1
a) New features
- Added unattended mode (invoked with /u on the command line) where Delprof2 does not ask for confirmation
b) Bugfixes
- Delprof2 did not work on Vista and Server 2008 due to incorrect OS version checking
System Requirements
Delprof2 has works on Windows 7 / Server 2008 or newer.
Please note that Delprof2 comes as a 32-bit binary only, but works correctly on both 32-bit and 64-bit Windows, locally and remotely.
Download
Download Delprof2 here.
51 Comments
Can i saved multiple computer names in the text file and point that text file remote computer is it possible?
I had the exact same question! Thank you for your work on this and your response!
This is basic scripting know-how that I am not going to cover in detail. Use something like
for /F %i in (filename) do COMMAND %i– or PowerShell, of course.Hello,
When running delprof2 /c:remote computer name and when local profiles are being deleted, receiving the following key cannot be deleted – Could not delete key <SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps. Is this something that is would be classified as UWP?
Thank You,
Please try this…
Start-Process SetACL.exe -ArgumentList ‘-on “\\COMPUTERNAME\HKLM\SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps” -ot reg -actn setowner -ownr “n:Administratoren” -rec yes’ -NoNewWindow -PassThru -Wait; Start-Process SetACL.exe -ArgumentList ‘-on “\\COMPUTERNAME\HKLM\SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps” -ot reg -actn ace -ace “n:Administratoren;p:full” -rec yes’ -NoNewWindow -PassThru -Wait; Start-Process delprof2.exe -ArgumentList “/u /c:\\COMPUTERNAME /id:USERNAME” -NoNewWindow -PassThru -Wait
When using the Delprof2 1.6 version, is there a way to recover data that has been deleted? We have an instance where the utility deleted the current users profile. There was a year of cadiovascular research delted that we need to try and recover. Any suggestions would be great.
Delprof2 does not delete into the recycle bin, so you’d need an undelete tool. I’ve heard good things about Recuva, but I’ve never used it.
I have to add that working for a year on a research project without ever backing up your files is more than a bit careless.
We agree. They have shared drives that they were suppose to be using. Thanks for the information. We will review Recuva.
Hello, I saw in the sample code that it apparently ignores the special machine profiles (system, administrator, etc.) if that’s really great. I would like to know if it is possible to specify a variable of specific logins to be excluded even if this profile was created today or recently, in the company I work the users we want to exclude follow the same pattern, they are employees who do not belong to the staff, these users start with the digit number 4 followed by another 6 digits also numeric, example: 4170895. Is it possible to specify delprof2 with some parameter that I can quote 4 as a variable to be excluded or something? I’m very grateful. If you have skype, follow my user: marcosantoscs, I’m from Brazil.
I believe you could just type /ed:41*. Username starts with 41, * everything after wildcard.
Hi Helge
Attempting to use delprof2 as a clean-up tool in a Windows 2016 cvad infrastructrure with anonymous users.
(sometimes the local profiles are not removed at logoff).
However – the profiles folders are removed perfectly, but the corresponding entries under HKLM\software\microsoft\windows nt\currentversion\profilelist and HKLM\software\microsoft\windows nt\currentversion\profileGUID remain ?
Using Delprof2 to delete multiple profiles in an education settings, so teacher/student profiles are roaming.
The script doesn’t seem to want to work remotely, but when on the offending PC, have to run as admin even though I am already logged in as Admin, and can only delete one profile before the next profile gets the ‘Could not delete key <SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps.' error.
I have to close it down and then open it up again, it start from that profile and will delete it and then continue to the next and repeat the same cycle.
Anything I can do to fix this?
Not touching on why it won’t work remotely…
However, yes, it sounds like your computers have UAC enabled, which they should. This is a basic security feature requiring you to physically acknowledge and give an application administrative priv’s. Google: “Windows UAC” for further clarification.
Simplest solution is to use the task scheduler, running as the system account, possibly on startup for no or at least hopefully less potential file locks. Be smart and set permissions on any files / executable so that non-admins cannot modify them, otherwise a bad guy could easily do some bad things. There’s also plenty of other ways to accomplish this with GPO, service accounts, etc.
Hello,
Our default user profile is saved in the D drive of our terminal servers
Can this be tweaked to cater this scenario as well?
Thank you
Delprof2 does not touch the default user profile. Or are you referring to the default location for newly created user profiles? Delprof2 should pick that up automatically.
By the way, I would strongly advise against moving the user profile location from C: to another drive. It causes all kinds of issues.
Hi Helge,
I have a generic Windows 10 account whose profile I would like to be deleted on scheduled restarts. I can use Windows task scheduler to time the restarts. Can Delprof2 scripting delete the profile if the account is already logged on before the restart? or can Delprof2 delete the profile after the PC restarts.
I’m happy to consider any workarounds/alternatives you are aware of
Regards,
Mike
Mistake with Deleting Profiles from Server 2012R2 – does not work!
Always i see “in use” – but profile is not in use – Bug….
Hi,
What date does Delprof use to determine profile age with both ntuser.dat and ntuser.ini? Does it use last accessed date, or last modified?
Thanks!
Delprof2 uses the last write time with NTUSER.DAT, NTUSER.INI, and/or NTUSER.MAN to determine the profile age.
Is it possible to add another method?
Our Windows 10 PCs have started displaying an issue where ALL ntuser.dat files get updated to the same timestamp – regardless of whether they’ve logged on or not.
I’m working around it just now using some AutoIt script to parse the output of netusers utility, which shows the correct last login time of each user.
I’m not sure which method it uses to determine this – but it’s not interrogating ntuser.dat.
Many thanks!
Gerard
I was interested in this as well since neither of the DelProf2 methods for last logon date are working correctly. Netusers.exe is using the hidden LastWriteTime registry value on the keys in the profile list. It also does some domain queries to see if the users are still valid or not and can show the full name if so.
If DelProf2 could be modified to use that hidden reg value, it would be a huge benefit. I’m doing the same, trying to either parse the output of netusers, or pulling that hidden reg value directly using powershell, but it’s just more hoops to jump through.
In our case, we’re trying to clean out old profiles that maybe came from our help desk or other temporary usage, and as it turns out, having a lot of profiles on a machine can make Windows feature updates run slower because it spends a lot of time going through each user’s registry hive looking for things it may want to update (default shortcuts for instance).
Does this tool supports Windows Server 2016 ?
Im also struggling to understand this at the moment, the date modified stamps on my ntuser.ini, ntuser.dat and profile folder all seem to bear no correlation to my last login time.. I’m reluctant to use this tool across the network with /d: switch without a reliable method of identifying a correct last login time.
This issue seems to present difficulties for a lot of people, whether they are using DelProf2, GPO or Powershell.. I’ve tried all 3 and feel like I’m getting nowhere.
As I said above, and RJones has said – something is modifying the dates of NTUSER.DAT to the date that the PC last updated its GPOs..
EG – a user who logged on last week has NTUSER.DAT of today. NTUSER.ini for that user is dated 2018.
I can find no trace of NTUSER.man.
My only workaround at the moment is an AutoIT script which parses the freeware application NETUSERS – which correctly identifies when the user last logged on.
I parse that, work out the dates which are over 90 days (my current time), and feed that as /ID: to DelProf2.
Years ago there was another application called Remprof.exe that had the added feature to ONLY remove profiles of domain accounts that no longer existed. From a pruning perspective this is was amazing because you could schedule it weekly and any user that left the company were removed immediately instead of waiting X days. Any chance that could be incorporated into future versions of Delprof2?
Good Morning – great utility and works to what i need it to.
My only concern is something that was raised above and appears not to be handled in the live version as of today. There was an error thrown “Could not delete key <SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps\{SID}"
I sat here waiting for it to proceed however the program appears to have just halted and stalled. Any chance that you can ensure that the program continues with the same profile or maybe attempts the same step again and if it fails then skip to the next profile so that it can continue running?
We use powershell transcripts for all our logging and such and review and we call this from within powershell and grab the outputs but it just seems that it stalls on that error message but doesnt say that it has stalled just that it was access denied but nothing else, again when we restarted the process it went back to the user and worked fine (hence the retry step maybe after a small delay?)
Does this app look at the NTUSER.DAT modified date? As this now seems to be modified every day!
I’ve also checked in the registry for the user and the “LastUseTime” shows the same date and time as the modified date on the NTUSER.DAT file.
As Gerard suggested, I’ve downloaded the NETUSERS tool and this seems to pick up the correct last logon but I’ll need to script this alongside Delprof2. Unless you’re already looking at changing the last logon check in the Delprof2 app?
Please let me know if you’re looking into this and I’ll wait to download your updated app :)
Hi
Apparently I deleted a profile that a user still uses. Is it possible to recover the deleted data from that user.
We have used delprof2 for some years now and it worked perfectly but because the ntuser.dat file date gets changed with windows update
it isn’t picking up the unused profiles anymore. We have tried it with the ntuserini switch but ntuser.ini doesn’t appear in Windows 10 user profiles.
Is there any way of getting this working again for Windows 10? Cheers Dan
Hello, I’ve found this tool very helpful. I made a script that logs out all users except admin and then proceeds to execute delprof2 but some users are not being deleted (reason: in use).. after the logout command I have a sleep 600 (10 min) to make sure all users are logged out.. i also tried using PowerShell but same error.. any idea what could be the issue?? thank you very much for this tool
After a restart it did worked, maybe some file was locked if you have any tips on how to prevent this without restarting I will appreciate it thanks.
Hello, this app is great and does just what I require. I am trying to set it up to run via SCCM at the end of the month on all machines. However, although it copies the folder and contents into ccmcache, it doesn’t then run it. Is this possible and I am doing it wrong or will I need to set up a scheduled task? Thank you.
I am having trouble running delprof2 in PowerShell (5.1). It works fine in the CMD interpreter, but calling cmd /c”delprof2″ form PowerShell only works with the WhatIf (/l). Once we try to RUN the deletion fails to complete by just removing the ‘/l’ the command fails to complete.
Help?
I work in the IT department at a high school and hard drives filling up from user profiles was a real problem. Delprof2 alone was a close fix but because the NTUser.dat file was being changed by the system, it threw a wrench into the problem.
About 8 months ago, I deployed Delprof2, but tweaked how we went about the NTUser.dat date problem. We use Active Directory and Group Policy. I pushed out a script that runs when a user logs into the computer and all it does is append the username and current time/date to a hidden text file (Logon.txt) in their profile. This is also nice to be able to easily see when a user logged into a computer without trying to interpret the system event viewer.
We have a scheduled task to have all the computers in the school reboot during the 1am hour. When the computer starts to reboot, it runs a shutdown script from Group Policy. The first part of the script sets the NTUser.dat date modified to the same date and time of the Logon.txt file. It does this for all user profiles. In the case where the Logon.txt file doesn’t exist for a user, the script creates the Logon.txt file and sets the date of the Logon.txt file to the date of the user’s NTUser.dat file. The script then runs Delprof2 to delete the profiles that are older than a set number of days. It’s seemed to work good for us so far.
Thank you Helge Klein for your work with Delprof2
Have you got any detailed instructions on how you set this up? We are a school with the same issues you had. Many thanks in advance.
We have the same problem as well. Could you pass on the scripts etc. to solve this please
from my testing, if you successfully log on to a windows 11 machine using a domain account, and then log off and have delprof2 clear out the profiles, the next time that same user tries to log on, the profile will not load correctly and be unusable
See the very first sentence of the article (in italic).
I’ve had a similar issue on windows 11 though I tried to force it into a temp profile as I can’t get delprof to work. On windows 10 this works well, but on windows 11 it just freezes at “preparing windows”. When a profile eventually appears it’s unusable. Same issue seems
Ah this tools been working fine and we’re now on 20H2 w10 or possible some scanning software liek lansweeper is interferring with the tool ?
Basically it’s not picking up the profiles even if I set to delete profiles older than 1 day it does’nt pick them up anymore as being old enough even though in c:\users they dates much older. very strange, was fine until last few months something with 20h2 has possibly changed or something is messing with the date of the profile in the registry ?
Helge, im using the delprof2 by GPO (shutdown) is there anyway we can log what profiles has been deleted?
Hello Helge, great tool.
I have a question, after i deployed on my environment, some users who wasnt on the rule of number of days got the profile deleted, but i think it wasnt the tool. Is there some way we can log (by shutdown script/GPO) what users delprof2 deleted?
Would you consider posting this script to GitHub and including the underlying source?
Hi Helge,
very nice Tool. Thank You! :-)
love delprof2 thankyou for creating it!
I’ve found some hosts will refuse to delete profiles due to them being “in use”
i’ve tried the script on system startup and on logoff (security event 4647) and as said this works on 99% of hosts I use it on. but some hosts will constantly say profile in use regardless of state.
Tried various workarounds such as timeouts before running etc, but none help.
Is there any possible solution?
Really need some profiles deleted between each use. mandatory profiles not an option as no roaming domain profile.
I can see loads of people having issues with the age of profiles not being determined correctly from either DAT or INI files. Has this been resolved yet – or do we know if its on the cards of being resolved?
While testing Delprof2 I’ve noticed an issue – while the profile is removed from the profiles list in system and the profile directory is removed, and next time that user logs in they get the “please wait” screens while the new profile is set up, all the previously connected per-user printers saved in their user profile return.
However if I delete the profile manually using the normal windows GUI this does not happen – the printers are gone next time they log in, which is what I expect to happen. So it seems Delprof2 is leaving printer connection settings behind, presumably in the registry somewhere.
Has anyone else noticed this or found a solution to it ? The point of clearing a user profile is to remove all user specific settings that are stored locally, so I wonder what else is being left behind if printer settings belonging to that profile are not being removed ?
Just wondering if anyone knows of a similar utility to DelProf that works on MacOS computers. We have AD users from our Windows environment logging into iMac’s that are JOINed to our domain. So we end up with many USER folders and data accumulating on the drives.
I have been using your tool for some time (33+ years in IT). I use it in our labs at our College of New Caledonia that as instructors we are responsible for installing maintaining and upkeep. I use this tool in conjunction with PDQ (another great set of tools – form old Novel team).
I have one thing that started happening with the Windows 10 (build 20H2) and after rebooting the users that had admin level get a error and build a temp profile instead. I guessing a reg something? Anyone else have this issue.
I’ve been testing DelProf2 as it seemed to be the only solution to removing old profiles from a huge Windows estate.
However all the problems associated with scripting this yourself, seem to be plaguing this utility too. It makes no difference what I set the number of days to, I get the same list of profiles to delete (and not to delete). I’ve even see profiles to delete that I know are currently logged in and in use.
I’m running testing this on Server 2019 and Server 2022. The clients logging in are all using Windows 10. Has something changed to stop this utility working correctly?
Without it’s ability to remove profiles according to how old they are. This utility’s only use is removing ALL profiles prior to upgrading (for speed).
Can someone from the company please comment on these date issues. I’m not the first to mention this on this thread.
It’s a great utility, but currently almost useless to any sysadmin.
I found this PS script… when run on Win 10 immediately before DelPRof2 deletions work as expected; registry keys as noted above remain and do not seem to cause trouble. Always use the /l list (simulation mode) switch first and confirm.
#Purpose: Used to set the ntuser.dat last modified date to that of the last modified date on the users UsrClass.dat file.
#This is needed because windows cumulative updates are altering the ntuser.dat last modified date which then defeats
#the ability for GPO to delete profiles based on date and USMT migrations based on date.
$ErrorActionPreference = “SilentlyContinue”
$Report = $Null
$Path = “C:\Users”
$ExcludedUsers =”Default”, “Public”, “Administrator”
$UserFolders = $Path | GCI -Directory -Exclude $ExcludedUsers
ForEach ($UserFolder in $UserFolders)
{
$UserName = $UserFolder.Name
If (Test-Path “$Path\$UserName\NTUser.dat”)
{
$Dat = Get-Item “$Path\$UserName\NTUSer.dat” -force
$DatTime = $Dat.LastWriteTime
$Db = Get-Item “$Path\$Username\AppData\Local\Microsoft\Windows\UsrClass.dat” -force
$UserClass = $Db.LastWriteTime
$Dat.LastWriteTime = $UserClass
Write-Host $UserName $DatTime
Write-Host (Get-item $Path\$UserName\AppData\Local\Microsoft\Windows\UsrClass.dat -Force).LastWriteTime
$Report = $Report + “$UserName`t$DatTime`r`n”
$Dat = $Null
$Db = $Null
}
}