<\/p>\n\n\n
Table of Contents<\/h2>\n\n- Use and customize package<\/a>\n\n\n
- \nCreate Intune package (monitoring and\/or cleanup)<\/a>\n\n<\/li>\n<\/ul>\n
- Monitoring with and without deletion<\/a>\n\n<\/li>\n
- Explanation of the PowerShell scripts<\/a>\n\n\n
- \nDetection (Check for old profiles)<\/a>\n\n<\/li>\n
- Remediation (Remove the profiles)<\/a>\n<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n
<\/p>\n\n\n
Use and customize package<\/h2>\n\n\n
You can use the pack in two different ways. Either just to get an overview of the old profiles or to clean them up.
The detection script is just enough for an overview, for profile cleanup via Intune you also distribute the remediation script.<\/p>\n\n\n\n
The first line of Detection and Remediation defines which profiles are considered \"too old\". The value is to be specified in days:<\/p>\n\n\n\n![\"maximales](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-6.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n
Create Intune package (monitoring and\/or cleanup)<\/h3>\n\n\n
To use the package in Intune, create a new one at:
Intune > Reports > Endpoint analytics > Proactive remediations > +Create script package<\/strong><\/p>\n\n\n\nIn the first step you assign a meaningful name such as \"WIN oldProfile Monitor<\/strong>\" or \"WIN-oldProfile-Cleanup<\/strong>\".<\/p>\n\n\n\n\n\n![\"Proactive](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-7.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n<\/div>\n<\/div>\n\n\n\nThen you only upload the detection script for pure monitoring. If you also want to do the cleanup, upload the remediation script as well.
(I recommend that you only activate the monitoring at first and only activate the cleanup when the result is as desired.)<\/em><\/p>\n\n\n\n\n\n![\"Detection](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-8.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n<\/div>\n<\/div>\n\n\n\nYou only have to set a scope tag if your environment allows it.<\/p>\n\n\n\n
With the assignment, you assign the configuration to a desired target group with a reasonable interval.<\/p>\n\n\n\n
\n\n![\"Proactive](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-9.png\")
<\/a><\/figure>\n<\/div>\n\n\n\n<\/div>\n<\/div>\n\n\nMonitoring with and without deletion<\/h2>\n\n\n
In order to have everything displayed in the evaluation, you must first display all columns:<\/p>\n\n\n\n![\"Proactive](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-10.png\")
<\/a><\/figure>\n\n\n\nIt is important to know that only the last run is saved. For example, if you run the package every hour, you only have one hour to track the action.<\/em><\/p>\n\n\n\nDo you only have the Detection <\/strong>rolled out, you will only find results in the column \"Pre-remediation detection outputs\" or at most \"Pre-remediation detection error\". Remediation will not and cannot be initiated.
But you can see very clearly on which device the profiles are too old:<\/p>\n\n\n\n![\"\"](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-12-1200x276.png\")
<\/a>Post-remediation detection output<\/figcaption><\/figure>\n\n\n\nAre\u00a0detection and remediation<\/strong>\u00a0in action, in the event of a detection, you will also see the output after applying the remediation:<\/p>\n\n\n\n![\"\u00dcbersicht,](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-17-1200x205.png\")
<\/a>Ger\u00e4te \u00dcbersicht<\/figcaption><\/figure>\n\n\n\n![\"Pre-remediation](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-14-1200x190.png\")
<\/a>Pre-remediation detection output<\/figcaption><\/figure>\n\n\n\n![\"Post-remediation](\"https:\/\/scloud.work\/wp-content\/uploads\/2023\/03\/image-15-1200x207.png\")
<\/a>Post-remediation detection output<\/figcaption><\/figure>\n\n\nExplanation of the PowerShell scripts<\/h2>\n\n\n
Within the detection and remediation script I don't use the \"LastUseTime\" from the profile query. This is because it is often corrupted by antivirus programs and shows the date of the last scan for all users. That's why I read the modification date of the individual profile folders.<\/p>\n\n\n\n
The basis of both scripts is identical and uses the \"Profile_age\" variable to read out the profile folders that are older than x days, compares them with the current profiles and saves them in the \"Profiles_2remove\" variable.
This is done with the following command, excluding the Default, Windows, Public, and Admin folders: <\/p>\n\n\n
# Get all User profile folders older than X days<\/span>\n $LastAccessedFolder<\/span> = Get-ChildItem<\/span> \"C:\\Users\"<\/span> | Where-Object<\/span> {$_<\/span> -notlike<\/span> \"*Windows*\"<\/span> -and<\/span> $_<\/span> -notlike<\/span> \"*default*\"<\/span> -and<\/span> $_<\/span> -notlike<\/span> \"*Public*\"<\/span> -and<\/span> $_<\/span> -notlike<\/span> \"*Admin*\"<\/span>} | Where LastWriteTime -lt<\/span> (Get-Date<\/span>).AddDays(-$Profile_age<\/span>)\n\n # Filter the list of folders to only include those that are not associated with local user accounts<\/span>\n $Profiles_notLocal<\/span> = $LastAccessedFolder<\/span> | Where-Object<\/span> { $_<\/span>.Name -notin<\/span> $<\/span>(Get-LocalUser<\/span>).Name }\n\n # Retrieve a list of user profiles and filter to only include the old ones<\/span>\n $Profiles_2remove<\/span> = Get-CimInstance<\/span> -Class<\/span> Win32_UserProfile | Where-Object<\/span> { $_<\/span>.LocalPath -in<\/span> $<\/span>($Profiles_notLocal<\/span>.FullName) }<\/code><\/span>Code language:<\/span> PowerShell<\/span> (<\/span>powershell<\/span>)<\/span><\/small><\/pre>\n\nDetection (Check for old profiles)<\/h3>\n\n\n
- \nCreate Intune package (monitoring and\/or cleanup)<\/a>\n\n<\/li>\n<\/ul>\n
- Monitoring with and without deletion<\/a>\n\n<\/li>\n
- Explanation of the PowerShell scripts<\/a>\n\n\n
- \nDetection (Check for old profiles)<\/a>\n\n<\/li>\n
- Remediation (Remove the profiles)<\/a>\n<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n
<\/p>\n\n\n
Use and customize package<\/h2>\n\n\n
You can use the pack in two different ways. Either just to get an overview of the old profiles or to clean them up.
The detection script is just enough for an overview, for profile cleanup via Intune you also distribute the remediation script.<\/p>\n\n\n\nThe first line of Detection and Remediation defines which profiles are considered \"too old\". The value is to be specified in days:<\/p>\n\n\n\n
<\/figure>\n\n\n\n<\/p>\n\n\n
Create Intune package (monitoring and\/or cleanup)<\/h3>\n\n\n
To use the package in Intune, create a new one at:
Intune > Reports > Endpoint analytics > Proactive remediations > +Create script package<\/strong><\/p>\n\n\n\nIn the first step you assign a meaningful name such as \"WIN oldProfile Monitor<\/strong>\" or \"WIN-oldProfile-Cleanup<\/strong>\".<\/p>\n\n\n\n
\n\n<\/a><\/figure>\n<\/div>\n\n\n\n<\/div>\n<\/div>\n\n\n\nThen you only upload the detection script for pure monitoring. If you also want to do the cleanup, upload the remediation script as well.
(I recommend that you only activate the monitoring at first and only activate the cleanup when the result is as desired.)<\/em><\/p>\n\n\n\n\n\n<\/a><\/figure>\n<\/div>\n\n\n\n<\/div>\n<\/div>\n\n\n\nYou only have to set a scope tag if your environment allows it.<\/p>\n\n\n\n
With the assignment, you assign the configuration to a desired target group with a reasonable interval.<\/p>\n\n\n\n
\n\n<\/a><\/figure>\n<\/div>\n\n\n\n<\/div>\n<\/div>\n\n\nMonitoring with and without deletion<\/h2>\n\n\n
In order to have everything displayed in the evaluation, you must first display all columns:<\/p>\n\n\n\n
<\/a><\/figure>\n\n\n\nIt is important to know that only the last run is saved. For example, if you run the package every hour, you only have one hour to track the action.<\/em><\/p>\n\n\n\n
Do you only have the Detection <\/strong>rolled out, you will only find results in the column \"Pre-remediation detection outputs\" or at most \"Pre-remediation detection error\". Remediation will not and cannot be initiated.
But you can see very clearly on which device the profiles are too old:<\/p>\n\n\n\n<\/a>Post-remediation detection output<\/figcaption><\/figure>\n\n\n\n Are\u00a0detection and remediation<\/strong>\u00a0in action, in the event of a detection, you will also see the output after applying the remediation:<\/p>\n\n\n\n
<\/a>Ger\u00e4te \u00dcbersicht<\/figcaption><\/figure>\n\n\n\n <\/a>Pre-remediation detection output<\/figcaption><\/figure>\n\n\n\n <\/a>Post-remediation detection output<\/figcaption><\/figure>\n\n\n Explanation of the PowerShell scripts<\/h2>\n\n\n
Within the detection and remediation script I don't use the \"LastUseTime\" from the profile query. This is because it is often corrupted by antivirus programs and shows the date of the last scan for all users. That's why I read the modification date of the individual profile folders.<\/p>\n\n\n\n
The basis of both scripts is identical and uses the \"Profile_age\" variable to read out the profile folders that are older than x days, compares them with the current profiles and saves them in the \"Profiles_2remove\" variable.
This is done with the following command, excluding the Default, Windows, Public, and Admin folders: <\/p>\n\n\n# Get all User profile folders older than X days<\/span>\n $LastAccessedFolder<\/span> = Get-ChildItem<\/span> \"C:\\Users\"<\/span> | Where-Object<\/span> {$_<\/span> -notlike<\/span> \"*Windows*\"<\/span> -and<\/span> $_<\/span> -notlike<\/span> \"*default*\"<\/span> -and<\/span> $_<\/span> -notlike<\/span> \"*Public*\"<\/span> -and<\/span> $_<\/span> -notlike<\/span> \"*Admin*\"<\/span>} | Where LastWriteTime -lt<\/span> (Get-Date<\/span>).AddDays(-$Profile_age<\/span>)\n\n # Filter the list of folders to only include those that are not associated with local user accounts<\/span>\n $Profiles_notLocal<\/span> = $LastAccessedFolder<\/span> | Where-Object<\/span> { $_<\/span>.Name -notin<\/span> $<\/span>(Get-LocalUser<\/span>).Name }\n\n # Retrieve a list of user profiles and filter to only include the old ones<\/span>\n $Profiles_2remove<\/span> = Get-CimInstance<\/span> -Class<\/span> Win32_UserProfile | Where-Object<\/span> { $_<\/span>.LocalPath -in<\/span> $<\/span>($Profiles_notLocal<\/span>.FullName) }<\/code><\/span>Code language:<\/span> PowerShell<\/span> (<\/span>powershell<\/span>)<\/span><\/small><\/pre>\n\nDetection (Check for old profiles)<\/h3>\n\n\n
- Remediation (Remove the profiles)<\/a>\n<\/li>\n<\/ul>\n<\/li><\/ul>\n\n\n
- Monitoring with and without deletion<\/a>\n\n<\/li>\n