Deleting Server 2008 R2 profiles: NTUSER.DAT

Question

Having an issue with deleting user profiles on server 2008 when they become corrupt, we have successfully done this now by closing a process but it killed the server and forced a restart, not to bad as we are testing this server and only had 2 users on.

Is there any safe/quick way to do this via a script ?

the profile is being held open most likely by the client, uphclean (client side) can be used to close this connection automatically. When a users logs out it doesn't disconnect from the profile for a while otherwise. — tony roth, Aug 08 '12 at 15:29

score 0 · Answer 1 · answered Aug 08 '12 at 11:55

0

You can do this in Powershell:

get-wmiobject win32_userprofile -filter "localpath='c:\\users\\BadProfile'" -computer MyServer | remove-wmiobject

That should do it for you. Obviously, replace "BadProfile" with the user's username and MyServer with the name of your server. The -computer switch lets you do it remotely if necessary. You can omit that switch if you're working with a local profile.

answered Aug 08 '12 at 11:55

squillman

37,883
12
92
146

won't work if the profile is being held open, which in this case is more then likely. – tony roth Aug 08 '12 at 15:31

score 0 · Accepted Answer · answered Aug 08 '12 at 16:21

ntuser.dat is a registry hive file that contains the registry entries associated with the profile. The kernel itself has the file open; the hive has to unloaded to unlock the file. You can force it to unload with reg unload, though you'll need the SID of the user that owns the profile. There is a related "classes" hive that expands HKEY_CLASSES_ROOT for each profile as well.

reg unload HKEY_USERS\S-1-5-21-1555713158-3015222722-1959872020-2924
reg unload HKEY_USERS\S-1-5-21-1555713158-3015222722-1959872020-2924_Classes

This applies to all versions of Windows since XP and there is something similar in all the previous versions of WinNT as well.

In general, it would be better to let Windows unload the profile itself, by removing the open references to it.

prior to win7 the process to clean these issues up was a download by ms called uphclean — tony roth, Aug 08 '12 at 16:30

Deleting Server 2008 R2 profiles: NTUSER.DAT

2 Answers2