Alexander’s Blog

A few years ago I wrote this article Deleting Old User Profiles in Windows 2000/XP/2003 about a User Profile Deletion utility called DelProf.exe. This tool is part of the Windows Server 2003 Resource Kit. Because it was written for older operating systems it won’t work on Windows Vista or later operating systems.

Lucky for us, Microsoft MVP Helge Klein has written a successor utility called DelProf2 that works with newer operating systems, such as Windows 7. DelProf2 works with Windows XP/2003/Vista/Windows 7/Windows 2008/Windows 2008R2.

DelProf2 will even handle profiles that use long paths (i.e. MAX_PATH values of longer than 260). This tool is great if you want to get rid of old profiles that are taking disk space. It will delete all profiles except the current profile. It will leave the necessary system profiles (e.g. Default profile) alone. Default profile is used by the operating system to create a profile for a new user by making a copy of the Default profile. You also have the option to delete locally cached copies of roaming profiles or delete older profiles that have not been used for a certain period of time, such as older than 90 days.

Here is the syntax used by DelProf2.

Usage: delprof2 [/u] [/q] [/i] [/p] [/r] [/c:[\\]<computername>] [/d:<days>]

       /u   Unattended (no confirmation)
       /q   Quiet (no output and no confirmation)
       /i   Ignore errors, continue deleting
       /p   Prompt for confirmation before deleting each profile
       /r   Delete local caches of roaming profiles only, not local profiles
       /c   Delete on remote computer instead of local machine
       /d   Delete only profiles not used in x days
       /l   List only, do not delete (what-if mode)

Helge has some nice examples on his site. You can use DelProf2 to delete inactive profiles remotely (including Windows 7 computers) using their IP addresses.

DelProf2 is a free utility that can be downloaded from Helge’s Web site here. While you are at it, you might want to check out some additional tools that he has written.

There is a free Wake-On-LAN GUI tool available that you can use to wake a remote computer up by either using it’s IP address or it’s Fully Qualified Domain Name (FQDN). You can use the Wake-On-LAN feature to start a computer either on the LAN or through the Internet.

You can download the tool here.

The Shutdown command can be used to remotely restart or shutdown a Windows 2000 or later computer.

For example, you can remotely reboot a Windows 7 computer from a Windows XP computer as long as you have administrative privileges. On the destination computer, you may need to ensure that your account has the user right “Force shutdown from a remote system.” You can run gpedit.msc at the Start, Run and then add your account to that user right, as shown in the screenshot below.

The shutdown is especially handy for Network Administrators and PC Support professionals in a domain environment. Here’s the syntax used by the shutdown utility.

C:\> shutdown /?

Usage: shutdown [-i | -l | -s | -r | -a] [-f] [-m \\computername] [-t xx] [-c "comment"] [-d up:xx:yy]

No args                 Display this message (same as -?)
-i                      Display GUI interface, must be the first option
-l                      Log off (cannot be used with -m option)
-s                      Shutdown the computer
-r                      Shutdown and restart the computer
-a                      Abort a system shutdown
-m \\computername       Remote computer to shutdown/restart/abort
-t xx                   Set timeout for shutdown to xx seconds
-c “comment”            Shutdown comment (maximum of 127 characters)
-f                      Forces running applications to close without warning
-d [u][p]:xx:yy         The reason code for the shutdown
u is the user code
p is a planned shutdown code
xx is the major reason code (positive integer less than 256)
yy is the minor reason code (positive integer less than 65536)

To restart a computer make sure you use -r, to shutdown the computer use -s. As mentioned earlier, the shutdown command can be used on a local or a remote computer. To restart a remote computer use -m \\computername. For example, if you have a computer that’s hung on a certain process and you can’t even remote desktop into it, you can try to restart the computer remotely and force running applications to close without warning by using the following command.

shutdown -m \\computername -r -f

If you want to use the GUI version, simply type shutdown -i to bring up the graphical interface. Here you can add, one or more computers, configure the option to Restart, Shutdown, or Loggoff, display a warning notice on the computer, configure the computer to reboot after a specific interval, and configure the option for Shutdown Event Tracker that will record the reason for the action in the Event Viewer.

I mentioned at the beginning of the article that you can use Shutdown utility on Windows 2000 and later computers. Microsoft’s KB article 317371 explains how to use Shutdown tool in Windows 2000. However, notice that the older utility used a forward slash (/) instead of a hyphen (-) for the switches.

Microsoft’s Active Directory relies on Domain Name System (DNS) so it’s important to have a good understanding of DNS concepts and terms. Here’s a glossary of DNS terminology in alphabetical order.

You can also download a PDF version of this glossary here.

In Windows Server 2003 Active Directory domains, there is a concept of immediate and urgent replication. Certain types of information gets replicated immediately, rather than waiting for the standard Active Directory replication. One such example is user account lockout. If an administrator locks a user account, the information is replicated to the PDC emulator immediately. Microsoft recommends that you define account lockout and password policies in only one Group Policy object (GPO) for every domain (in the Default Domain policy settings).

Microsoft explains the concepts of immediate and urgent replications in this TechNet article:

Account lockout relies on the replication of lockout information between domain controllers to ensure that all domain controllers are notified of an accounts status. In addition, password changes must be communicated to all domain controllers to ensure that a user’s new password is not considered incorrect. This data replication is accomplished by the various replication features of Active Directory and is also discussed in this section.

Immediate Replication
When you change a password, it is sent over Netlogon’s secure channel to the PDC operations master. Specifically, the domain controller makes a remote procedure call (RPC) to the PDC operations master that includes the user name and new password information. The PDC operations master then locally stores this value.

Immediate replication between Windows 2000 domain controllers is caused by the following events:
- Lockout of an account
- Modification of a Local Security Authority (LSA) secret
- State changes of the Relative ID (RID) Manager

Urgent Replication
Active Directory replication occurs between domain controllers when directory data is updated on one domain controller and that update is replicated to all other domain controllers. When a change in directory data occurs, the source domain controller sends out a notice that its directory store now contains updated data. The domain controller’s replication partners then send a request to the source domain controller to receive those updates. Typically, the source domain controller sends out a change notification after a delay. This delay is governed by a notification delay. (The Windows 2000 default notification delay is 5 minutes; the Windows Server 2003 default notification delay is 15 minutes.) However, any delay in replication can result in a security risk for certain types of changes. Urgent replication ensures that critical directory changes are immediately replicated, including account lockouts, changes in the account lockout policy, changes in the domain password policy, and changes to the password on a domain controller account. With urgent replication, an update notification is sent out immediately, regardless of the notification delay. This design allows other domain controllers to immediately request and receive the critical updates. Note, however, that the only difference between urgent replication and typical replication is the lack of a delay before the transmission of the change notification. If this does not occur, urgent replication is identical to standard replication. When replication partners request and subsequently receive the urgent changes, they receive, in addition, all pending directory updates from the source domain controller, and not only the urgent updates.

When either an administrator or a delegated user unlocks an account, manually sets password expiration on a user account by clicking User Must Change Password At Next Logon, or resets the password on an account, the modified attributes are immediately replicated to the PDC emulator operations master, and then they are urgently replicated to other domain controllers that are in the same site as the PDC emulator. By default, urgent replication does not occur across site boundaries. Because of this, administrators should make manual password changes and account resets on a domain controller that is in that user’s site.

The following events are not urgent replications in Windows 2000 domains:
- Changing the account lockout policy
- Changing the domain password policy
- Changing the password on a computer account
- Domain trust passwords

Note: There is an error in TechNet’s article quoted above. The default notification delay for Windows Server 2003 listed under Urgent Replication should be 15 seconds, not 15 minutes, as pointed out by Rickard Nobel. The KB article 214678 confirms that the default notification period is 15 seconds in Windows Server 2003.