I am trying to create a script that looks for all user profiles. Profiles that havent been accessed in 90 days or more get deleted. I also want to delete their folders from C:\Users to free up hdd space.
cd C:\Users\
foreach ($dir in $OlderDays) { Get-CimInstance -ComputerName $ComputerName -Class Win32_UserProfile -ErrorAction Stop | Where-Object {$_.Special -eq $false} Get-CimInstance -ComputerName $profile.ComputerName -ClassName Win32_UserProfile -ErrorAction Stop | Where-Object {$_.SID -eq $profile.RegKey.SID -and $_.LocalPath -eq $profile.RegKey.LocalPath} | Remove-CimInstance -ErrorAction Stop Remove-item -force -Path $dir -recurse
}I get access denied on every folder that is attempted to be deleted from C:\Users.
I am using the admin account. The only solution I have found so far is takeown but some work stations have 50+ accounts that need to be deleted and that is not very time efficient when right clicking on the folder and clicking delete takes 10 seconds. Takeown took around 10 minutes per account.
remove-item : Access to the path 'C:\Users\test5456\AppData\Local\Application Data' is denied.
At line:59 char:5
+ remove-item -force -Path C:\Users\$dir -recurse
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : PermissionDenied: (C:\Users\test5456:String) [Remove-Item], UnauthorizedAccessExcepti on + FullyQualifiedErrorId : RemoveItemUnauthorizedAccessError,Microsoft.PowerShell.Commands.RemoveItemCommand4 Answers
Even though you're running it as admin, you will still have to take ownership of the folder (and its contents) before you'll be able to delete it.
Takeown took around 10 minutes per account.
TakeOwn is notoriously slow, using PowerShell's Get-ACL and Set-ACL is quicker.
To set the owner on the folder, and all its contents, to the built in Administrators group, it'd be something like this (not tested):
$Group = New-Object System.Security.Principal.NTAccount("Builtin", "Administrators")
$ACL = Get-ACL $dir
$ACL.SetOwner($Group)
Get-ChildItem $dir -Recurse -Force | % { Set-ACL -AclObject $ACL -Path $_.fullname
}Put that inside your Foreach loop, before the Remove-Item command.
You don’t need to do this. Windows will do it for you with the group policy called:
Delete user profiles after a specified number of days.
In addition, there is already a tool provided to do this called delprof and delprof2 if you want to do it manually. It can execute on a remote computer as well.
The recommended solution mostly worked for me, but:
- Mostly, meaning close to 50% of the profiles would still fail to get the permissions, hence not getting deleted.
- The time spent per item was pretty high compared to the following solution:
What worked for me was using cmd /c "rmdir $dir /s /q" as the deletion command, so in your case it would be:
cd C:\Users\
foreach ($dir in $OlderDays) { Get-CimInstance -ComputerName $ComputerName -Class Win32_UserProfile -ErrorAction Stop | Where-Object {$_.Special -eq $false} Get-CimInstance -ComputerName $profile.ComputerName -ClassName Win32_UserProfile -ErrorAction Stop | Where-Object {$_.SID -eq $profile.RegKey.SID -and $_.LocalPath -eq $profile.RegKey.LocalPath} | Remove-CimInstance -ErrorAction Stop cmd /c "rmdir $dir /s /q"
}This solution is way faster, and so far, it has deleted over a hundred profiles in one computer without a single failure. With how powerful PowerShell is, it is a shame that we have to resort to call cmd to do the work, but...
Solution was found here:
As commented by @Ramhound, if what you're trying to do is remove old user profiles, don't do it by deleting C:\Users\username . First, remove the profiles from the PC and wait a few minutes. If it works properly, removing the profile will remove the folder structure automatically. If the profile still exists, then attempting to delete the folder like you're trying to do will raise a variety of permissions errors.
Please see related content at
