none
Modified Date of User ntuser.dat changes when hive is LOADED but NOT Changed - Breaks "Delete profiles after number of days" RRS feed

  • Question

  • There was a Hotfix for Windows 7 but not for Windows 10?

    https://support.microsoft.com/en-us/help/983544/the-modified-time-file-attribute-of-a-registry-hive-file-is-updated-wh

    I tested this. Running as System I loaded a users ntuser.dat into Regedit. I made NO changes. I just unloaded ntuser.dat and the "date modified" changed to today's date.

    So Symantec, Windows Update or any other process that scans the ntuser.dat CHANGES the "last used" date on the profile.

    We have 1000 users on average logging into 1 machine over a matter of a few months (hospitals) and we have the "Delete profiles older than 30 days" set in Group Policy but it is NOT deleting them because this "modified" date keeps getting updated by any process that loads the hive.

    Any ideas?

    Also what happened to all the forums? Seems only a few left?


    lforbes

    Friday, October 9, 2020 8:40 PM

All replies