Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- $profilelist = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" -Exclude S-1-5-18,S-1-5-19,S-1-5-20
- Remove-Variable SIDsToDelete -ErrorAction SilentlyContinue
- $SIDsToDelete = foreach ($p in $profilelist) {
- try {
- $objUser = (New-Object System.Security.Principal.SecurityIdentifier($p.PSChildName)).Translate([System.Security.Principal.NTAccount]).value
- } catch {
- $objUser = "[UNKNOWN]"
- }
- Remove-Variable -Force LTH,LTL,UTH,UTL -ErrorAction SilentlyContinue
- $LTH = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileLoadTimeHigh -ErrorAction SilentlyContinue).LocalProfileLoadTimeHigh
- $LTL = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileLoadTimeLow -ErrorAction SilentlyContinue).LocalProfileLoadTimeLow
- $UTH = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileUnloadTimeHigh -ErrorAction SilentlyContinue).LocalProfileUnloadTimeHigh
- $UTL = '{0:X8}' -f (Get-ItemProperty -Path $p.PSPath -Name LocalProfileUnloadTimeLow -ErrorAction SilentlyContinue).LocalProfileUnloadTimeLow
- $LoadTime = if ($LTH -and $LTL) {
- [datetime]::FromFileTime("0x$LTH$LTL")
- } else {
- $null
- }
- $UnloadTime = if ($UTH -and $UTL) {
- [datetime]::FromFileTime("0x$UTH$UTL")
- } else {
- $null
- }
- [pscustomobject][ordered]@{
- User = $objUser
- SID = $p.PSChildName
- Loadtime = $LoadTime
- UnloadTime = $UnloadTime
- } | Where-Object {($_.Loadtime -lt (Get-Date).AddDays(-30))} | Select-Object -Property SID
- }
- foreach ($SID in $SIDsToDelete) {
- $Profilez = Get-CimInstance -ClassName Win32_UserProfile | Where-Object {$_.Special -eq $false -and $_.SID -eq $SID}
- if ($Profilez) {
- Remove-CimInstance -InputObject $Profilez
- }
- }
Advertisement
Add Comment
Please, Sign In to add comment