Empty user folders left behind after profile deletion via Group Policy

On a server running Windows Server 2008 SP2, we are using Group Policy to delete user profiles more than 14 days old on a mix of Vista and Windows 7 PCs. The user profile is deleted and no longer shows up in the list of profiles on the machine (under System Properties, Advanced, User Profiles). The SID in the registry is removed properly as well, but the user's folder is left behind under C:\Users. There are no files in the folders that are left behind, just empty folders. There is no consistency in the folders that are left behind on the PCs being affected. Each PC seems to leave behind a different set of folders under the user, but the folders are always empty.
I would like to figure out why the folders are being left behind and how I can make sure that the profile is completely removed, including the entire user folder.
RSUMattAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

centervCommented:
Check your settings against this

http://social.technet.microsoft.com/Forums/en/w7itprogeneral/thread/bae17e9f-a8cf-4c7f-8357-97571b659ca2 

Also, did you delete the user account as well as profile?
Cheers
0
RSUMattAuthor Commented:
The Group Policy appears to be set up correctly. We currently delete profiles more than 14 days old and the policy is being applied at the right time to the right profiles. Our only issue is the empty folders being left behind.
The user accounts are not being deleted, just the profiles. We are at a university with several computer labs, and the students typically log in at different machines each time they come into the lab. Deleting the profiles is just part of ongoing maintenance used to keep the machines cleaned up.

I was able to pull the following from the Application Log.
"Windows cannot delete the profile directory C:\Users\facultysmith\. This error may be caused by files in this directory being used by another program.
DETAIL - The directory is not empty."
When I check the folders under facultysmith, there are no files in the folders, hidden or otherwise.
0
centervCommented:
Don't know for sure but it may be the  issue that you're deleting the profile and not the user account.
When user logs in again, do those folders get used?
Also run chkdsk on the frive.
0
Introducing Cloud Class® training courses

Tech changes fast. You can learn faster. That’s why we’re bringing professional training courses to Experts Exchange. With a subscription, you can access all the Cloud Class® courses to expand your education, prep for certifications, and get top-notch instructions.

RSUMattAuthor Commented:
If it has been more than 14 days since the last time the user has logged in to a specific machine, then their profile is created again as if they were logging in to the machine for the first time. If they log in before the 14 day window has passed then their profile and folders will be used. This is due to our environment where several people will use PCs in a lab over the course of a semester. We are not using roaming profiles at this time. We clean the profiles out every couple of weeks because if we don't the hard drives run out of space in a fairly short time.
Chkdsk is not really a factor because we see this on all our Vista and 7 machines that have this profile deletion policy applied.
We do have XP machines as well but we use Delprof to remove profiles from those machines. Delprof is not supported on Vista or 7 since the same functionality has been built into Group Policy.
0
centervCommented:
There must be something hanging back, obviously. I don't have a system to use to check against or replicate
so getting limited with options. Check the last item on the link and see if you have that option.

http://blogs.technet.com/heyscriptingguy/archive/2009/03/13/quick-hits-friday-the-scripting-guys-respond-to-a-bunch-of-questions-03-13-09.aspx

Could be a bug with mixed versions of windows. Win7 does not play well with other systems.
Will keep trying but I'm drawing a blank at the moment.
There is third party to take place of delprof and utilities to delete empty folders but that would defeat the purpose.
Perhaps those folders were protected with bitlocker or similar.
0
RSUMattAuthor Commented:
The issue appears to be isolated to our Windows 7 machines. The folders are definitely not using Bitlocker or any other encryption. I've also looked into replacements for DelProf and the only one I can find was RemProf. We tried RemProf and had lots of issues and since then the group that created it has removed the Vista/Win 7 compatibility info on their web site.
The Group Policy method is great because it does everything DelProf did without adding additional scripts or batch files. We just can't seem to get past the empty folders that are being left behind after the policy is applied to our Windows 7 machines.
0
centervCommented:
You're not alone. My feeling is that the gpo is not doing a complete job. The fact that they are not always the same folders, leads me to think that perhaps its a permission issue, of which win7 is famous.
Look at this software and also the script.  You may want to run this question at the techNet site forum as well.
Plenty of gripes there as well but I've seen no good results.

http://www.delprof.eu/index.php#

http://hardforum.com/showthread.php?p=1035591420
0
centervCommented:
Scroll down the ist link and look for Remote Profile Cleaner.
0
centervCommented:
An interesting issue I just ran across. In win7 the thumbs.db cache is located centrally in one folder vrs
same folder previously. In the server they're still in same folder as xp.
Delete folder, delete cache. Or not.
Are those folders still locked on to the local cache or some other tag?

User Configuration > Administrative Templates > Windows Components > Windows Explorer > 
has the thumbnails options for local and servers.  Wild stab if you want to look at it.
0
RSUMattAuthor Commented:
Thanks for the tip. I will check that out today to see what it's set to.
0
RSUMattAuthor Commented:
We turned on the policy to not cache thumbnails and that did not help with the empty folders being left behind.

I also dug around in the event logs and found the following: "Windows cannot delete the profile directory C:\Users\facjohndoe\. This error may be caused by files in this directory being used by another program.
 DETAIL - The directory is not empty."

We get this message for any users whose folders are left behind after the policy to delete user profiles runs.
0
centervCommented:
Are you using Altiris or citrix by any chance?
0
RSUMattAuthor Commented:
No, we are not using Altiris or Citrix. I have read posts on other forums about issues with them and our issue seems very similar, but we don't use either one.
It certainly appears that some program is not allowing all the folders to be deleted when Windows attempts to delete the profile. Unfortunately the folders left behind are rarely the same folders and there are never any files left behind, hidden or otherwise. If I had any file to look at I could trace back to the program or process that is preventing the deletion.
0
centervCommented:
Agreed, as I mentioned earlier, and because of the different folders it ties it to the user somehow. maybe!
Perhaps the folder path on the server is different than the users or corrupt?
Try some of these utilities to try and find what process is locking those folders.


http://technet.microsoft.com/en-us/sysinternals/bb896655.aspx

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/net_file.mspx?mfr=true

http://technet.microsoft.com/en-us/library/bb490711.aspx

http://ss64.com/nt/net_share.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
RSUMattAuthor Commented:
Thanks. I think I should be able to use Handle to try and pinpoint what is locking the folders.
0
centervCommented:
Thanks and good luck. I would appreciate feedback on this as to what's locking them.
0
RSUMattAuthor Commented:
I will definitely post my results. Thanks for your help.
0
wingkchanCommented:
Hi RSUMatt,

I have a group of users that uses roaming profile are also experiencing this issue.  The profiles are wiped out from the policy, but the folder remains.  Just wondering if you have found out a solution that you may share with me.  Thanks in advance.
0
RSUMattAuthor Commented:
Hi Wingkchan,

Unfortunately we never did figure this out. We keep it on our to-do list to remind us to check for new information on the web, but I haven't looked in a while. Sorry I don't have anything better for you.
0
wingkchanCommented:
Thanks RSUMatt for your followup.  I knew this post has been closed for a while, but wanted to give it a try.

From what I noticed, there are hidden folders left behind inside the user's profile.
C:\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache

This CryptnetUrlCache folder, however, contains nothing. People suggested running a command (see below) to remove the system files that are left behind.  But I found these system files are gone when the Group Policy kicks off.  when I run that command in normal domain accounts, I  see a list of https cache URLs being deleted. so, i conclude that theose are https and certifcates cache.

certutil -urlcache * delete

I had tried using logoff scripts to remove these folders but with no success.  I'll keep on searching and hoping can share an solution with you soon.  thanks
0
wingkchanCommented:
Just want to post a solution that our IT admin had found.  He simply added a GPO logoff script to stop the CryptSvc service, and then the roaming profile folders gets deleted successfully from the other GPO.

(eg. net stop CryptSvc)

Hopefully it will be helpful with other people having this issue too.
0
RSUMattAuthor Commented:
Thanks very much. We'll give that a shot to see if we can clear those folders.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.