Migrating Windows: What data contains your roaming profiles? – Use Powershell to analyze Profile Shares

A lot of companies use Windows Roaming Profiles to share user data across client systems and server systems. The technology of roaming profile makes sure that your desktop settings, Internet Explorer favorites and passwords “move”, that your Word, Excel, Outlook, etc. is configured correctly and more. If a company uses roaming profiles in a fat client infrastructure, administrators are able to change the client device in case of a failure without the losing of hundreds or thousands settings and documents.

Don’t use old profiles – use new ones with specific settings

If a company plans to change the client or server operating system in a migration project, they don’t care about the user data in the profiles – in the past! Fortunately the users come more and more into the focus because they’re the ones doing the business. I’m sure that the old way of deleting all the user profiles in a migration project is obsolete, because we are able to generate new profiles from the scratch with (!) selected settings from the old profiles (take a look at sepago’s Profile Migrator, it converts additional application setting across different versions).

Analyze your profile share data (and analyze it with Excel)

But what do you lose if you delete or don’t migrate the users’ roaming profiles? Data and their importance differ from situation to situation. Profiles contain more unrecoverable data if you don’t use the technology of folder redirection. I wrote a powershell script to scan roaming profiles and generate a report with some important data. Because it’s a simple script, everybody is able to adjust this script to generate more data.

My script scans a profile share and automatically sends the data to an excel file. The data are summarized in the sheet “Summary” and contain the following positions:

Overview

  • Count of read profiles
    • Resolved and unresolved user account SID of the profile (it’s a good way to identify orphaned profiles)

image

General statistic information

  • Profile size average
  • Profile size min and max size
  • Profile file count average
  • Profile file min and max count
  • Size of ntuser.dat average
  • Size of ntuser.dat min and max

image

Important user data

  • Dictionary count and size, e.g. from Winword & Co
  • Count of saved passwords from Internet Explorer (best guess)
  • Count of cookies from Internet Explorer
  • Documents count and size (regular expression for file appendix like .doc)
  • PST file count and size
  • URL links
  • Everybody can expand the script for further data

image

Some charts about:

  • Range of profile sizes
  • Range of last save to the profiles
  • And more (if data exist in the user’s registry: last used language, Windows build)

imageimage

How to use the script

First I must say that my script is not perfect and there is still much to improve (see next steps and to do’s).

You need a workstation where you have the following requirements:

  • Powershell 2
  • Ability to execute scripts with Powershell
  • Microsoft Excel installed
  • Local administrative rights (to hive ntuser.dat files)
  • Read permission in the roaming profile share

Download the zip file from the bottom of this blog. It contains the script file and an Excel template which will be used by the script to fill it with data.

Unzip the two files to a folder, like d:\Data\Profile\Get-ProfileInformation.

Open a CMD with administrative rights (special for Windows 7) and change to the folder and start the script:

powershell.exe .\Get-ProfileInformation\Get-ProfileInformation.ps1 \\fileserver\profiles

Expected folder structure (Update: It’s now possible to enumerate in combined profile and data structures. Take a look into the script) :

\\fileserver\profiles\User1

\\fileserver\profiles\User2

\\fileserver\profiles\UserN

 

The script starts Excel, reads all the containing profiles and puts the data in the Excel file (please don’t click into Excel).

clip_image012

The data collection will take a while. In a future step it will collect the data parallel to increase the performance. Please note that all ntuser.dat files are copied to the folder with the script file. I have seen that unmounting the copied ntuser.dat(s) sometimes fails and you have mounted copies of the ntuser.dat in HKLM (_HIVE-PI_<GUID>). I will fix it in a future release, but the script gets the expected information anyway.

After completion of the data collection save the Excel template under a new name. You have two sheets in the Excel file. The data-sheet contains the data of each profile and the summary-sheet the summarization.

clip_image014

image

Next steps and to do’s

  • Implement a multi-threaded operation of profile folder
  • Make it more stable
  • Use a different output format
  • Implement more functions
  • Support for Citrix UPM format
  • ….

To the reader of this blog

If you have any improvements or suggestions, feel free to mail me. If you have some Excel reports of your profiles, It would be nice, if you could send me a copy.

Special thanks to David for proofreading this blog.

Updates (2011/02/15)

Fixes:

  • There was an error counting the  "problems hiving ntuser.dat" in the Excel file and the script
  • The script uses now the script folder automaticaly
  • It is now possible to to enumerate combined profile and data structures like \\fileserver\share\UserN\Profile where \\fileserver\share  is the parameter (use $vAppendixPath within the script)

Downloads