Guest User

Untitled

a guest
Oct 31st, 2023
337
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. $profilelist = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" -Exclude S-1-5-18,S-1-5-19,S-1-5-20
  2.  
  3. Remove-Variable SIDsToDelete -ErrorAction SilentlyContinue
  4.  
  5. $SIDsToDelete = foreach ($p in $profilelist) {
  6.     try {
  7.         $objUser = (New-Object System.Security.Principal.SecurityIdentifier($p.PSChildName)).Translate([System.Security.Principal.NTAccount]).value
  8.     } catch {
  9.         $objUser = "[UNKNOWN]"
  10.     }
  11.  
  12.     Remove-Variable -Force LTH,LTL,UTH,UTL -ErrorAction SilentlyContinue
  13.     $LTH = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileLoadTimeHigh -ErrorAction SilentlyContinue).LocalProfileLoadTimeHigh
  14.     $LTL = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileLoadTimeLow -ErrorAction SilentlyContinue).LocalProfileLoadTimeLow
  15.     $UTH = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileUnloadTimeHigh -ErrorAction SilentlyContinue).LocalProfileUnloadTimeHigh
  16.     $UTL = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileUnloadTimeLow -ErrorAction SilentlyContinue).LocalProfileUnloadTimeLow
  17.  
  18.     $LoadTime = if ($LTH -and $LTL) {
  19.         [datetime]::FromFileTime("0x$LTH$LTL")
  20.     } else {
  21.         $null
  22.     }
  23.     $UnloadTime = if ($UTH -and $UTL) {
  24.         [datetime]::FromFileTime("0x$UTH$UTL")
  25.     } else {
  26.         $null
  27.     }
  28.     [pscustomobject][ordered]@{
  29.         User = $objUser
  30.         SID = $p.PSChildName
  31.         Loadtime = $LoadTime
  32.         UnloadTime = $UnloadTime
  33.     } | Where-Object {($_.Loadtime -lt (Get-Date).AddDays(-30))} | Select-Object -Property SID
  34. }
  35.  
  36. foreach ($SID in $SIDsToDelete) {
  37.     $Profilez = Get-CimInstance -ClassName Win32_UserProfile | Where-Object {$_.Special -eq $false -and $_.SID -eq $SID}
  38. if ($Profilez) {
  39.     Remove-CimInstance -InputObject $Profilez
  40.     }
  41. }
Advertisement
Add Comment
Please, Sign In to add comment