Delete old enough AzureAD profiles from local laptop. (wich was not signed in more them 30 days)

Question

Delete old enough AzureAD profiles from local laptop. (wich was not signed in more them 30 days)

Ivan Rieznyk 20

We manage a large number of schools under our education trust. Across all schools, we use Windows 10/11 as the primary OS and Microsoft 365 for email, account management, and device management. OneDrive is used for cloud file storage, so we do not need to worry about users' data.

We also have many laptops that are shared by multiple users. Because hard drive space is limited, we often run into issues where storage becomes full. Cleaning up old user profiles manually can take a lot of time.

I tried creating a script to detect profiles that haven’t signed in for 30 days on the current laptops, but I ran into a problem with the “last local login” property. It seems that only local profiles have this property, while all our Microsoft 365 (Azure AD) users show nothing in LastUseTime.

For example:

PowerShell

Get-CimInstance Win32_UserProfile | FL LocalPath, LastUseTime

This returns empty values for LastUseTime for our 0365 users.

Is there any other way to achieve this? Ideally, I’d like to have a script that can be deployed via Intune, but even a script that can run locally would be helpful.

Thank you

0 comments

Answer accepted by question author

Quinnie Quoc 11,855 Independent Advisor

Hello Ivan Rieznyk ,

Thank you for your message and for outlining your environment so clearly. You're correct—Azure AD accounts often do not populate the LastUseTime property in Win32_UserProfile, which makes identifying inactive profiles more challenging.

As a workaround, we recommend using the Get-LocalUser and Get-ItemProperty cmdlets to check profile folders under C:\Users and correlate them with the LastWriteTime of the NTUSER.DAT file. This file is updated during user logon and can serve as a proxy for last activity.

You can also deploy a PowerShell script via Intune that checks NTUSER.DAT timestamps and flags profiles older than 30 days for cleanup. Be sure to exclude system and default profiles to avoid unintended deletions.

If this guidance helps resolve your issue, feel free to click “Accept Answer” so others can benefit too.

Thank you so much!!!

Best regards,

QQ.

0 comments

1 additional answer

Your answer

Answer 1

To delete old Azure AD profiles from local laptops that haven't been signed in for more than 30 days, you can use a combination of PowerShell and the User Profile Service settings. Since Azure AD profiles do not populate the LastUseTime property, you will need to implement a different approach to track the usage of these profiles.

Here’s a general outline of how you can achieve this:

Use the CleanupProfiles Policy: You can configure the CleanupProfiles policy through Intune or Group Policy to automatically delete user profiles that have not been used within a specified number of days. This policy can be set to delete profiles on the next system restart if they haven’t been accessed in the defined timeframe.
- Path: Computer Configuration > Administrative Templates > System > User Profiles
- Setting: Delete user profiles older than a specified number of days on system restart.
PowerShell Script: If you prefer a script-based approach, you can create a PowerShell script that checks for user profiles and deletes those that meet your criteria. Since Azure AD profiles do not have LastUseTime, you might need to maintain a separate log or use a different method to track sign-in activity.
- You can utilize the Get-CimInstance Win32_UserProfile command to list profiles and their local paths, but you will need to implement additional logic to determine usage based on your own criteria (like checking for file activity or using logs).
Deployment via Intune: Once you have your script ready, you can deploy it through Intune as a PowerShell script to run on all managed devices. Ensure that the script has the necessary permissions to delete user profiles.

This approach allows you to manage storage effectively by removing unused profiles without needing to manually check each one.

References: