Delete registry key on certain condition

Question

I have a troublesome problem to solve. Browsed internet for some time now but so far haven't got even close to resolving it. Apologies if this has been answered somewhere else.

I look after a call centre. We have around 70 PCs on our domain. There are around 120 staff using these PCs every day. When they login to a PC for the first time a user profile is created.

We use call centre specific software from different vendors. Most of them operates on "per profile" rather than on "per PC" basis. This means that all the settings are stored on user profiles. This turned to a huge mess over time, as each user set their software differently. Now, when I want to implement a setting, it doesn't work for all users/profiles/PCs as some settings are contradictory and cannot be used simultaneously. I need to treat the case on per profile basis. Imagine the nightmare - 70 PCs x 120 users - it is simply infeasible.

I want/need to unify the settings. For this purpose, I started developing a script that can copy the desired setting to a profile; however, I quickly realised there are too many variables and the list of "if" statements goes forever.

I figured out the best solution to clear the mess is to delete all the users from each PC. This will allow me to copy the desired settings automatically the next time a domain user logs into a PC (upon creation of their profile).

This will also allow me to recover some HDD space - we have a very high staff turnover and while the old users are deleted from the domain, their user profiles are still existing on each machine. Going through some PCs I discovered there are hundreds of obsolete users.

I figured out I can kill two birds with one stone by deleting user profiles from each computer. The thing is I want to do it properly. I found out there were two ways of doing it. One way is to use Windows GUI - allows to select only one profile at a time; therefore, totally unsuitable for my case.

The other way is to simply delete all desired folders and then the relevant registry keys. The thing is that I want to delete all profiles but three. They exist on every PC - "Default", "piotr" (my profile) and "confirmit" (a profile we use for certain tasks).

I have covered the first bit (folders deletion) with a .bat file. Now I need to do the second bit (registry keys deletion); however, I have no clue where to start, whatsoever.

The trouble is that I need to delete all but five subkeys in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" key. First 3 (S-1-5-18, S-1-5-19, S-1-5-20), which are the system ones, and then 2 of the S-1-5-21-*, which are domain users related.

I can identify first 3 by their names; however, the last 2 need to be identified by their sub-keys' values. The one that makes the most sense for me (and presumably will have the same value on all PCs) is "ProfileImagePath". It will have "C:\Users\piotr" for my profile and "C:\Users\confirmit" for "confirmit" profile.

So, the full list of keys I want to leave untouched is below: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-* where value of "ProfileImagePath" is "C:\Users\piotr" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-* where value of "ProfileImagePath" is "C:\Users\confirmit"

The rest of them need to be deleted.

I tried to make a sense of CMD "REG" command (especially the "QUERY" and "COPY") but failed miserably. I want to use batch file so this would be a perfect combination, if I could make it work :)

Messing with registry is always risky so I didn't want to be too cocky here. Instead I decided to seek help from experts; hence, my post here.

I guess my question is whether someone can give me the final solution; therefore, if you guys are up for a challenge, then that's great; however, I know, it is not always possible, so I would be equally grateful if somebody points me into the right direction.

I understand this is a very specific question and not everyone might be familiar with this topic. I would appreciate all the help I might get here and look forward to receiving your suggestions.

Thank you in advance.

Answer 1

Don't go rummaging through the registry for this unless you really need to. Use existing tools for user profile cleanup, such as delprof2:

delprof2 /ed:piotr /ed:confirmit

The program also has options for deleting profiles based on time of last usage.