Announcement

Collapse
No announcement yet.

NTUSER.DAT Would not delete

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • NTUSER.DAT Would not delete

    Hi,

    I am facing a very common issue of NTUSER.DAT & NTUSER.LOG file not getting deteled from users local profile.

    The user in question is not logged in to the computer or any other compuer on the Domain.

    I have deteled the local profile setting from My Computer--> Properties--> Advanced--> USer Profiles. & then deleting the profile but this gives an error.

    I also have edited the registry HLM--> Software --> Microsoft --> Windows NT --> ProfileList & then deleting the SID for the profile that has the curropted ProfileImagePath.

    I have also installed the UPHClean utility to unload user profiles.

    There is no computer on the domain that is logged in with this users profile.

    The computer from which we want to delete these files is a Windows 2003 DC server.

    Please assist in resolving this.

    Regards,
    Harneet Seistani

  • #2
    Re: NTUSER.DAT Would not delete

    What errors do you get?
    What led up to the issue i.e. what caused the corruption?
    Where did the account come from?
    Regards,
    Jeremy

    Network Consultant/Engineer
    Baltimore - Washington area and beyond
    www.gma-cpa.com

    Comment


    • #3
      Re: NTUSER.DAT Would not delete

      sounds maybe a bit stupid but did you already rebooted the machine?
      Marcel
      Technical Consultant
      Netherlands
      http://www.phetios.com
      http://blog.nessus.nl

      MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
      "No matter how secure, there is always the human factor."

      "Enjoy life today, tomorrow may never come."
      "If you're going through hell, keep going. ~Winston Churchill"

      Comment


      • #4
        Re: NTUSER.DAT Would not delete

        Thie is a domain user with rights to logon to the DC.

        After some changes in the local DC policy the user can only logon to a temp profile & not the orignal one.

        Since it was loading the temp profile we deleted the old profile & tried to created a new one.

        Tried RM Userprofile /s /q in documents & settings folder but only 2 files NTUSER.DAT & NTUSER.LOG are left.

        Regards,
        Harneet Seistani

        Comment


        • #5
          Re: NTUSER.DAT Would not delete

          hey Mr Moderator this is my main DC for the office I cannot restart it.

          Sorry

          Comment


          • #6
            Re: NTUSER.DAT Would not delete

            Moved Thread to Server forum.

            deadly_virgo, find a time to restart the server and then delete the files.

            Good call Marcel.

            EDIT - deadly_virgo, let us know if it works or not.
            If it doesn't work then please post the errors you get.
            If it does work then let us know and be sure to thank Marcel.
            Last edited by JeremyW; 28th December 2006, 15:46.
            Regards,
            Jeremy

            Network Consultant/Engineer
            Baltimore - Washington area and beyond
            www.gma-cpa.com

            Comment


            • #7
              Re: NTUSER.DAT Would not delete

              Deadly_virgo;

              Ask the boss when you can reboot the machine. Most likely you can do it tonight, or on a onther night. How do you reboot the machine when there are security patches out?

              Ntuser.dat is the user's registry, and there might still be a handle open. You can also try if you find anything with process explorer, however i Doubt that.
              Marcel
              Technical Consultant
              Netherlands
              http://www.phetios.com
              http://blog.nessus.nl

              MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
              "No matter how secure, there is always the human factor."

              "Enjoy life today, tomorrow may never come."
              "If you're going through hell, keep going. ~Winston Churchill"

              Comment


              • #8
                Re: NTUSER.DAT Would not delete

                Deadly_virgo:
                UPHClean was installed before or after the problem started? If it was installed before it's odd, because its purpose is to assure a clean logoff and user profile unload, thus preventing these things from happening. If it was installed afterwords, it will not help you in this one.
                And you can restart the server, even if it's a DC. Just do it as Marcel proposed, in a time window that has as little influence on your office. From experience, only Restart will release the locked NTUser.dat file.
                BTW, why are you so afraid of restarting the DC?

                Sorin Solomon


                In order to succeed, your desire for success should be greater than your fear of failure.
                -

                Comment


                • #9
                  Re: NTUSER.DAT Would not delete

                  Guys, there is no reason to restart a server because of a file that is in use.
                  Just get yourself a copy of Unlocker from here and it will let you identify the process locking the files in question. Watch out though not to kill important processes like lsass
                  Guy Teverovsky
                  http://blogs.technet.com/b/isrpfeplat/
                  "Smith & Wesson - the original point and click interface"

                  Comment


                  • #10
                    Re: NTUSER.DAT Would not delete

                    I would agree with you, but we are talking about NTUSER.DAT here... Wouldn't one be on the safe side to restart the server and unlock this file? After all, there's no such big deal to restart, even a DC. There's also DelinvFile that can be used.
                    BTW, 10nx for the link.

                    Sorin Solomon


                    In order to succeed, your desire for success should be greater than your fear of failure.
                    -

                    Comment


                    • #11
                      Re: NTUSER.DAT Would not delete

                      Originally posted by sorinso View Post
                      I would agree with you, but we are talking about NTUSER.DAT here... Wouldn't one be on the safe side to restart the server and unlock this file? After all, there's no such big deal to restart, even a DC.
                      Well, I do not care much about profiles on the DC - there is no reason that it should contain anything of any value. Also I am not a big fan of rebooting to make something work - I prefer to identify the problem rather than making is dissapear without knowing where it came from.
                      If we are talking about a critical process locking the file, I'd reboot. Otherwise, just release the file handle using something like Unlocker or Process Explorer and you are done.
                      Guy Teverovsky
                      http://blogs.technet.com/b/isrpfeplat/
                      "Smith & Wesson - the original point and click interface"

                      Comment


                      • #12
                        Re: NTUSER.DAT Would not delete

                        Well, I do not care much about profiles on the DC - there is no reason that it should contain anything of any value
                        Unless you are working with roaming profiles that reside on the DC, you are right.
                        I prefer to identify the problem rather than making is dissapear without knowing where it came from
                        Agree with you again. But, if there's something that happens once (and not a ritual ), and the thing doesn't allow me to do something that I need, I wouldn't waste my time with it. In this case, installation of UHPClean prior the case, would have prevent the issue from happening. I suspect it was installed later, as a way to solve the problem.

                        Sorin Solomon


                        In order to succeed, your desire for success should be greater than your fear of failure.
                        -

                        Comment


                        • #13
                          Re: NTUSER.DAT Would not delete

                          Originally posted by sorinso View Post
                          Unless you are working with roaming profiles that reside on the DC, you are right.
                          Sorry for nitpicking, but files from roaming profiles of regular users that reside on DC will not be locked by a process running on the DC, but rather by a process running on the workstation the user logs on from. And if we are talking about administrative account that is used to logon to DC that has a roaming profile, we are again talking about a profile that should have a minimal profile (if you are using administrative profile for daily work, you have bigger issues to take care of).
                          Last edited by guyt; 30th December 2006, 22:35.
                          Guy Teverovsky
                          http://blogs.technet.com/b/isrpfeplat/
                          "Smith & Wesson - the original point and click interface"

                          Comment


                          • #14
                            Re: NTUSER.DAT Would not delete


                            OK, OK, I give up !!
                            BTW, how are things in /dev/null nowadays?
                            Happy New Year !!

                            Sorin Solomon


                            In order to succeed, your desire for success should be greater than your fear of failure.
                            -

                            Comment


                            • #15
                              Re: NTUSER.DAT Would not delete

                              You could always (outside working hours) stop the Server service, delete the file, and restart the server service... this should remove the file lock because I believe it's part of the Server Service which does ALL file locking.


                              Tom
                              For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

                              Anything you say will be misquoted and used against you

                              Comment

                              Working...
                              X