Group Policy: Automatically Delete User Profiles Older Than Certain Number of Days Win 10 not working.

P. Amila Mahesh Muthukumarana 26

I enabled Computer Configuration\Administrative Templates\System\User Profiles\Delete User Profiles Older Than xxx GPO and apply to Windows 10 PCs.
Dayes set to 90.
Unfortunately, this didn't remove old data folders in C:\user.
I checked the registry HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System was added the REG_DWORD
I'm using Win 2019 domain and Win 10 client PC's.
Can someone help me to fix this?
The link which I use is https://social.technet.microsoft.com/wiki/contents/articles/28647.group-policy-how-to-automatically-delete-user-profiles-older-than-certain-number-of-days.aspx

Kr,
Amila.

DonnaSmith 156 Reputation points

2022-11-02T11:37:40.033+00:00

was there a fix for this - ntuser.dat is getting updated preventing the GPO from working
Is there a way around this to achieve profile removal?
DonnaSmith 156 Reputation points

2023-01-04T16:03:57.943+00:00

Any update on this. I can use the script to update ntuser.dat timestamp with the date from usrclass.dat - this works but the GPO is still not removing any old profiles?
John Curtiss 81 Reputation points

2023-04-01T22:50:40.42+00:00

if you're going to write and schedule a script to change the dates on ntuser.dat anyway, why still depend on the GPO to delete the old profiles? just add another line in the script to delete them.

this one deletes AD profiles when they are older than three months. change the sid prefix to match your AD's sid prefix

(Get-WmiObject win32_userprofile | ? {$.sid -like "S-1-5-21-something-something-*" -and $($.converttodatetime($_.lastusetime)) -le (get-date).AddMonths(-3)}).delete()
Moulay A Rahhali 0 Reputation points

2024-02-22T17:02:34.6966667+00:00

this doesn't work and i don't have cleanup profile on the Registry

Answer accepted by question author

Anonymous

Hello @P. Amila Mahesh Muthukumarana ,

Thanks for posting here.

I did the testing in my lab, and below are the findings.

The group policy was configured as shown below.

This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. Note: One day is interpreted as 24 hours after a specific user profile was accessed.

If you enable this policy setting, the User Profile Service will automatically delete on the next system restart all user profiles on the computer that have not been used within the specified number of days.

So I restarted the system and then checked the folders under C:\Users and User profiles were deleted.

Hope it helps. For any question, please post here.

Best regards,
Hannah Xiong

Anonymous

2021-06-21T01:49:55.02+00:00

Hello @P. Amila Mahesh Muthukumarana ,

II have replied to you with the testing carried out by me last week. In my testing, it may need to wait for several minutes and then check the overtime user profiles will be deleted or not. Hope the information will be of some help to you.

For any update or question, welcome to post here. Thanks a lot.

Best regards,
Hannah Xiong
P. Amila Mahesh Muthukumarana 26 Reputation points

2021-06-21T05:40:16.63+00:00

Hi @Anonymous ,

Thank you for your valuable reply. I checked my environment, User profile data folder (C:\Users\abc) is older than 30 days (last modified date 18/02/2018) but NTUSER.DAT was recently updated.
That is why GPO didn't remove old user profile from the PC. When i check the user profile sign-in tab, user profile modified the same as NTUSER.DAT date.
The same day windows update was installed.

Kr,
Amila.
Susan Pieroni 0 Reputation points

2023-02-24T17:59:37.8366667+00:00

What would be the steps to only remove the Azure profiles but keep the local accounts?
Anant Bera 271 Reputation points

2025-02-12T07:04:02.9666667+00:00

Hi @Anonymous

Is the local administrator account also deleted? I have tested this in my test lab, and as i see in your environment, the local admin profile is also deleted. Is this the expected behavior?
Anant Bera 271 Reputation points

2025-02-12T07:19:52.8766667+00:00

Hi @Anonymous

Is the local administrator account also deleted? I have tested this in my test lab, and in your environment, the local admin profile is also deleted. Is this the expected behavior?

7 additional answers

Paul Eddy 0 Reputation points

2023-02-02T18:15:42.4966667+00:00

I was able to get this powershell to work when assigned to GPO as a startup script
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Joseph Riling 6 Reputation points

2023-01-05T13:41:33.867+00:00

Hi Donna,

We have been testing this across some of our sites and it seems to be working.
Was this answer helpful?
DonnaSmith 156 Reputation points

2023-01-05T16:09:46.91+00:00

OK thanks for that lol. It is not working for me with the ntuser.dat showing the right dates - I was hoping for further advice but I will keep digging

Justin 0 Reputation points

2023-01-18T14:57:20.56+00:00

Hey Donna I'm having issues with the GPO not working as well but I did get it to show the correct date I had to use a different .dat. Change it to this one and it will be the right date. After that I'm not sure its still not deleting the profiles for me even with the profiles showing the right date if you have luck let me know.

AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat

DonnaSmith 156 Reputation points

2023-01-22T19:35:03.3633333+00:00

Hi Justin - same issue myself... everything shows the GPO applying but nothing being removed so I cant see why such mixed results for people. Will save a note of your one too and might test this today - I was updating ntuser.dat from usrclass.dat which generally worked ok but not 100% confident its as accurate as it could be,

Thanks!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Adam No name 6 Reputation points

2022-11-29T10:47:50.097+00:00

MS have sat on this problem for years now. Even the third party solution, DelProf2 doesn't work anymore due to NTUSER.DAT and ntuser.ini getting updated outside of user logon.

The only current way is to copy the timestamp from another (currently) working file: UsrClass.dat using the script below, then your GPO for removing stale profiles, which tests on NTUSER.DAT's timestamp, will work.

Set the script below to run daily as a Scheduled Task. This will then solve the problem of NTUSER.DAT getting its timestamp updated when patched, etc.

$ErrorActionPreference = “SilentlyContinue”
$Report = $Null
$Path = "C:\Users"
$ExcludedUsers = "Default", "Public", "Administrator"
$UserFolders = $Path | Get-ChildItem -Directory -Exclude $ExcludedUsers

ForEach ($UserFolder in $UserFolders)
{
$UserName = $UserFolder.Name
If (Test-Path “$Path\$UserName\NTUser.dat”)
{
$NTUserDat = Get-Item "$Path\$UserName\NTUSER.DAT" -force
$NTUserDatTimeStamp = $NTUserDat.LastWriteTime
$UsrClassDat = Get-Item "$Path\$Username\AppData\Local\Microsoft\Windows\UsrClass.dat" -force
$UserClassTimeStamp = $UsrClassDat.LastWriteTime
$NTUserDat.LastWriteTime = $UserClassTimeStamp
Write-Host $UserName $NTUserDatTimeStamp
Write-Host (Get-item $Path\$UserName\AppData\Local\Microsoft\Windows\UsrClass.dat -Force).LastWriteTime
$Report = $Report + “$UserNamet$NTUserDatTimeStampr`n”
$NTUserDat = $Null
$UsrClassDat = $Null
}
}
Was this answer helpful?

1 person found this answer helpful.
Joseph Riling 6 Reputation points

2022-12-19T18:08:33.113+00:00

@Adam No name

Hi there. I appreciate your input. I ran the GPO successfully on a couple of test machines, and it works, kind of.

After I found your post here I created a PowerShell script with the contents and rebooted. This does not seem to work and fully resolve the issue making the profile deletable.

Let me know if I am missing something. I am also performing updates on the machines now for good measure.

Thanks

Joe

DonnaSmith 156 Reputation points

2022-12-21T14:23:26.64+00:00

This seems to be ok - only one thing which is the account ive been logging in with including numerous times today has updated the timestamp to a date two days earlier..All other profiles accurate.
I can see updated timestamps and that the GPO is applied in gpresult /r but the profiles arent being removed. I only have a 1 day period set as running against a test machine only
any ideas what im missing here?

Anonymous

2024-08-15T21:14:50.3533333+00:00

So this did not work for me. I have a user that has been gone for 3 months. This user's usrClass.dat file has today's date on it. If I run this script it will give the ntuser.dat file today's date. What updates the date on usrClass.dat
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Group Policy: Automatically Delete User Profiles Older Than Certain Number of Days Win 10 not working.

7 additional answers

Your answer