Delprof2 – User Profile Deletion Tool
2018-10-09: Delprof2 has issues with UWP apps on Windows 10. Why? Windows 10 stores per-user settings in per-machine database files that are exclusively locked (almost?) all of the time. I consider this a design flaw on the part of Microsoft and I am not going to waste my time trying to work around that.
Delprof2 is the unofficial successor to Microsoft’s Delprof which does not work with operating systems newer than Windows XP. Here are the main facts:
- Delprof2 is syntax compatible to the original Delprof, but more powerful
- Delprof2 lets you explicitly specify which profiles to delete
- Delprof2 bypasses security to delete profiles regardless of current permissions/owner
- Delprof2 supports very long paths
- Delprof2 works on all modern versions of Windows
- Delprof2 is free for personal and commercial use
What Does it Do?
Delprof2 deletes inactive user profiles. If you want to reclaim disk space just run it without parameters and it will delete all profiles except your own and some special profiles needed by the operating system (like “Default”).
Delprof2 has additional filtering options: you might want to delete locally cached copies of roaming profiles only or delete only those profiles that have not been used in a specified number of days. Delprof2 does it all, both on the local system and remotely.
Special Features
Exclusions and Inclusions with Wildcards
It is a frequent requirement to delete all profiles except one or two which should be left unchanged. With version 1.5 of Delprof2 that is easily possible: profiles can be excluded from deletion using a wildcard notation. If, on the other hand, only a few known profiles are to be deleted, use the inclusion feature and Delprof2 ignores everything else. Combining excludes and includes is possible, too, of course.
Bypassing Security
User profiles often have permissions set on them in such a way that not even administrators have access without prior ACL manipulation. Delprof2 circumvents this requirement by making use of backup and restore privileges to analyze and delete even the most tightly secured profiles.
Long Paths
Some programs store files in paths with more than 260 characters. Most tools cannot deal with such paths that are longer than the value of MAX_PATH (260). Windows Explorer is a prominent example. Delprof2, on the other hand, makes use of special APIs to be able to delete files in the remotest areas of your hard drive.
Syntax and Examples
The program’s help screen describes the available options in detail:
Delprof2 by Helge Klein (https://helgeklein.com)
Delprof2 deletes inactive Windows user profiles (profiles that are not currently loaded).
Delprof2 is syntax compatible with the original Delprof by Microsoft. Unlike the original it works on all modern versions of Windows.
If possible, Delprof2 uses the backup and restore privileges to bypass security and delete even profiles the executing user does not
normally have access to.
Delprof2 has no problem whatsoever deleting files in very long paths (longer than MAX_PATH, 260 characters).
Delprof2 also cleans up stale ProfileList SID.bak registry entries, a common cause of temporary profiles.
Usage: delprof2 [/l] [/u] [/q] [/p] [/r] [/c:[\\]<computername>] [/d:<days> [/ntuserini]] [/ed:<pattern>] [/id:<pattern>] [/i]
/l List only, do not delete (what-if mode)
/u Unattended (no confirmation)
/q Quiet (no output and no confirmation)
/p Prompt for confirmation before deleting each profile
/r Delete local caches of roaming profiles only, not local profiles
/c Delete on remote computer instead of local machine
/d Delete only profiles not used in x days
/ntuserini
When determining profile age for /d, use the file NTUSER.INI
instead of NTUSER.DAT for age calculation
/ed Exclude profile directories whose name matches this pattern
Wildcard characters * and ? can be used in the pattern
May be used more than once and can be combined with /id
/id Include only profile directories whose name matches this pattern
Wildcard characters * and ? can be used in the pattern
May be used more than once and can be combined with /ed
/i Ignore errors, continue deleting
Examples:
Delprof2 /c:computername
Deletes inactive profiles on 'computername'.
Delprof2 /c:computername /l
Lists inactive profiles on 'computername' without deleting them.
Delprof2 /d:30
Deletes profiles older than 30 days on the local computer.
Delprof2 /r
Deletes locally cached roaming profiles only.
Delprof2 /ed:admin* /ed:pmiller
Deletes all inactive profiles on the local computer except those starting with 'admin' and the one called 'pmiller'.Here is an example of Delprof2 in action, deleting user profiles remotely on a Windows XP computer (Windows 7 / 2008 R2 work just as well):
D:\>DelProf2.exe -c:192.168.175.130 -p
DelProf2 by Helge Klein (https://helgeklein.com)
Delete inactive profiles on '192.168.175.130'? (Yes/No) y
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\All Users' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\Default User' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\LocalService' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\NetworkService' (reason: special profile)
Ignoring profile '\\192.168.175.130\C$\Dokumente und Einstellungen\Administrator.WINXP' (reason: in use)
The following user profiles match the deletion criteria:
\\192.168.175.130\C$\Dokumente und Einstellungen\administrator.HK
\\192.168.175.130\C$\Dokumente und Einstellungen\Helge
\\192.168.175.130\C$\Dokumente und Einstellungen\test01
\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal
\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal2
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\administrator.HK'? (Yes/No) y
Deleting profile '\\192.168.175.130\C$\Dokumente und Einstellungen\administrator.HK' ...
... done.
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\Helge'? (Yes/No) n
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\test01'? (Yes/No) n
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal'? (Yes/No) n
Delete profile '\\192.168.175.130\C$\Dokumente und Einstellungen\testlocal2'? (Yes/No) n
Changelog
Version 1.6.0
a) New features
- Support for Windows 8, 8.1 and Server 2012 (R2)
================================================
Version 1.5.4
a) Bugfixes
- Mandatory profiles were not detected as being in use
================================================
Version 1.5.3
a) New features
- Client side rendering print provider data is now deleted, too.
================================================
Version 1.5.2
a) Bugfixes
- Fixed incorrect messages "not old enough to be deleted" which happened if: profile age < time zone offset
(for negative time zone offsets larger than one, e.g. the USA)
================================================
Version 1.5.1
a) Bugfixes
- Version 1.5 introduced a bug which prevented Delprof2 from working on Windows XP. This has been fixed.
================================================
Version 1.5
a) New features
- Inclusion and exclusion of profile directories
- Delprof2 now also cleans up these registry locations:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileGuid\<GUID> [where SidString equals the current profile user's SID]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\<SID>
- NTUser.ini can be used instead of NTUser.dat for profile age calculation. This is useful if your antivirus product regularly mounts user
profile registry hives, updating their timestamps in the process.
- Delprof2 is now digitally signed
- Changed license. Please consult the product's website for details.
b) Changed features
- Delprof2 needs the Remote Registry service on remote computers. Added a concise error message if the service is not started
- When only listing (not deleting) permissions the text printed on the screen now clearly states that fact
- The Systemprofile was ignored previously, now it is explicitly excluded (just in case)
c) Bugfixes
- Profiles with "access denied" were not ignored although that was printed on the screen
================================================
Version 1.0.1
a) New features
- Added unattended mode (invoked with /u on the command line) where Delprof2 does not ask for confirmation
b) Bugfixes
- Delprof2 did not work on Vista and Server 2008 due to incorrect OS version checking
System Requirements
Delprof2 has works on Windows 7 / Server 2008 or newer.
Please note that Delprof2 comes as a 32-bit binary only, but works correctly on both 32-bit and 64-bit Windows, locally and remotely.
Download
Download Delprof2 here.
21 Comments
Can i saved multiple computer names in the text file and point that text file remote computer is it possible?
I had the exact same question! Thank you for your work on this and your response!
This is basic scripting know-how that I am not going to cover in detail. Use something like
for /F %i in (filename) do COMMAND %i– or PowerShell, of course.Hello,
When running delprof2 /c:remote computer name and when local profiles are being deleted, receiving the following key cannot be deleted – Could not delete key <SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps. Is this something that is would be classified as UWP?
Thank You,
Please try this…
Start-Process SetACL.exe -ArgumentList ‘-on “\\COMPUTERNAME\HKLM\SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps” -ot reg -actn setowner -ownr “n:Administratoren” -rec yes’ -NoNewWindow -PassThru -Wait; Start-Process SetACL.exe -ArgumentList ‘-on “\\COMPUTERNAME\HKLM\SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps” -ot reg -actn ace -ace “n:Administratoren;p:full” -rec yes’ -NoNewWindow -PassThru -Wait; Start-Process delprof2.exe -ArgumentList “/u /c:\\COMPUTERNAME /id:USERNAME” -NoNewWindow -PassThru -Wait
When using the Delprof2 1.6 version, is there a way to recover data that has been deleted? We have an instance where the utility deleted the current users profile. There was a year of cadiovascular research delted that we need to try and recover. Any suggestions would be great.
Delprof2 does not delete into the recycle bin, so you’d need an undelete tool. I’ve heard good things about Recuva, but I’ve never used it.
I have to add that working for a year on a research project without ever backing up your files is more than a bit careless.
We agree. They have shared drives that they were suppose to be using. Thanks for the information. We will review Recuva.
Hello, I saw in the sample code that it apparently ignores the special machine profiles (system, administrator, etc.) if that’s really great. I would like to know if it is possible to specify a variable of specific logins to be excluded even if this profile was created today or recently, in the company I work the users we want to exclude follow the same pattern, they are employees who do not belong to the staff, these users start with the digit number 4 followed by another 6 digits also numeric, example: 4170895. Is it possible to specify delprof2 with some parameter that I can quote 4 as a variable to be excluded or something? I’m very grateful. If you have skype, follow my user: marcosantoscs, I’m from Brazil.
Hi Helge
Attempting to use delprof2 as a clean-up tool in a Windows 2016 cvad infrastructrure with anonymous users.
(sometimes the local profiles are not removed at logoff).
However – the profiles folders are removed perfectly, but the corresponding entries under HKLM\software\microsoft\windows nt\currentversion\profilelist and HKLM\software\microsoft\windows nt\currentversion\profileGUID remain ?
Using Delprof2 to delete multiple profiles in an education settings, so teacher/student profiles are roaming.
The script doesn’t seem to want to work remotely, but when on the offending PC, have to run as admin even though I am already logged in as Admin, and can only delete one profile before the next profile gets the ‘Could not delete key <SOFTWARE\Microsoft\Windows Search\UninstalledStoreApps.' error.
I have to close it down and then open it up again, it start from that profile and will delete it and then continue to the next and repeat the same cycle.
Anything I can do to fix this?
Not touching on why it won’t work remotely…
However, yes, it sounds like your computers have UAC enabled, which they should. This is a basic security feature requiring you to physically acknowledge and give an application administrative priv’s. Google: “Windows UAC” for further clarification.
Simplest solution is to use the task scheduler, running as the system account, possibly on startup for no or at least hopefully less potential file locks. Be smart and set permissions on any files / executable so that non-admins cannot modify them, otherwise a bad guy could easily do some bad things. There’s also plenty of other ways to accomplish this with GPO, service accounts, etc.
Hello,
Our default user profile is saved in the D drive of our terminal servers
Can this be tweaked to cater this scenario as well?
Thank you
Delprof2 does not touch the default user profile. Or are you referring to the default location for newly created user profiles? Delprof2 should pick that up automatically.
By the way, I would strongly advise against moving the user profile location from C: to another drive. It causes all kinds of issues.
Hi Helge,
I have a generic Windows 10 account whose profile I would like to be deleted on scheduled restarts. I can use Windows task scheduler to time the restarts. Can Delprof2 scripting delete the profile if the account is already logged on before the restart? or can Delprof2 delete the profile after the PC restarts.
I’m happy to consider any workarounds/alternatives you are aware of
Regards,
Mike
Mistake with Deleting Profiles from Server 2012R2 – does not work!
Always i see “in use” – but profile is not in use – Bug….
Hi,
What date does Delprof use to determine profile age with both ntuser.dat and ntuser.ini? Does it use last accessed date, or last modified?
Thanks!
Delprof2 uses the last write time with NTUSER.DAT, NTUSER.INI, and/or NTUSER.MAN to determine the profile age.
Is it possible to add another method?
Our Windows 10 PCs have started displaying an issue where ALL ntuser.dat files get updated to the same timestamp – regardless of whether they’ve logged on or not.
I’m working around it just now using some AutoIt script to parse the output of netusers utility, which shows the correct last login time of each user.
I’m not sure which method it uses to determine this – but it’s not interrogating ntuser.dat.
Many thanks!
Gerard
Does this tool supports Windows Server 2016 ?
Im also struggling to understand this at the moment, the date modified stamps on my ntuser.ini, ntuser.dat and profile folder all seem to bear no correlation to my last login time.. I’m reluctant to use this tool across the network with /d: switch without a reliable method of identifying a correct last login time.
This issue seems to present difficulties for a lot of people, whether they are using DelProf2, GPO or Powershell.. I’ve tried all 3 and feel like I’m getting nowhere.