Profile Trasher is a Powershell script that deletes cached Windows 2016 Local User Profiles at logoff, ensuring that users get a brand new User Profile at every logon.
Profile Trasher is intended for use on Citrix XenApp Servers running Windows 2016 Server.
A Scheduled Task is required. The task is triggered by logoff events. When a logoff event is triggered, Profile Trasher will enumerate all non-local (Domain Users only) user profiles and delete them.
TrasherV1.ps1
# Chawn Limited - Citrix Partner - Silver Solution Advisor
# No Liability accepted - Use at your own risk
# Ensure that you validate usage of this script in a pre-prod environment
# Create a task that is triggered by System Winlogon Log Event ID 7002
# Powershell.exe -ExecutionPolicy ByPass -NoProfile -File <PathToFile>\TrasherV1.ps1
# adjust the script sleep time to allow for the user to log off fully
Start-Sleep -Seconds 3
# Define Domain Users that you wish to exclude from profile deletion - case sensitive
$excludeUsers=@("MYDOMAIN\xdadmin","MYDOMAIN\User1")
$SIDs=@()
$SIDs=gwmi -Query "Select * from win32_userprofile where Loaded='False'" | select SID
foreach ($SID in $SIDS) {
$objSID = New-Object System.Security.Principal.SecurityIdentifier($SID.SID)
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])
if ($excludeUsers.Contains($objUser.value)) {write-eventlog -logname Application -source Winlogon -eventID 888 -entrytype Information -message "Profile retained for User: $objUser with SID: $objSID"
continue}
# Filter out the Local (non-Domain Users) from the Array - We don't want to delete Local profiles inc. Administrator, System and Service users
If ($objuser.value.Split("\")[0] -ne $env:Computername) {
try {
# Delete the User Profile
gwmi win32_userprofile | where SID -eq $SID.SID | Remove-WmiObject
# Additional actions - below action is not required - just an example
# remove-item "hklm:\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\$objSID" -recurse
# Write to the event log for auditting
write-eventlog -logname Application -source Winlogon -eventID 777 -entrytype Information -message "Profile deleted for User: $objUser with SID: $objSID"
}
catch{ "Error encountered" }
}
}
|
|
Copy the downloaded script to a local folder (C:\Windows) on you Master XenApp virtual machine.
Create a Scheduled Task with the following properties:
Trigger:
Action: Start a Program
Program: Powershell.exe
Argument: -ExecutionPolicy ByPass -NoProfile -File C:\Windows\TrasherV1.ps1
|
Enhance Internet Explorer is a Powershell script that can be added to a new or existing XenApp or XenDesktop Master Image to deploy the following Internet Explorer Tracking lists from the Internet Explorer Gallery:
- EasyList Standard
- EasyList Privacy
- Stop Google Tracking
Tracking lists can signifanctly reduce (up to 50%) the CPU and Memory consumption of Internet Explorer which improves performance, user experience and XenApp user density.
Additionally, the script modifies the ShockWave Flash configuration so that Flash is not automatically enabled for all websites. Users can still use Flash however each website will prompt the user for permission to use the Flash control which reduces CPU and Memory consumption.
GPU acceleration is not supported in RDS sessions therefore this is disabled to reduce CPU and Memory consumption.
Finally the script modifies the Internet Explorer Configuration to:
- Force Offscreen Composition
- Disable the First Run customisation
- Set the home page to about:blank
- Disable Tracking
- Disable GeoLocation
These items may of course all be controlled by Group Policy.
|
Installation
Download EnhanceIE.ps1.txt to C:\Windows on your Master Image VDA and rename to EnhanceIE.ps1
Download Install.ps1.txt to C:\Windows on your Master Image VDA and rename to Install.ps1
EnhanceIE.ps1 needs to run for each user only once so a logon script is not appropriate. Install.ps1 creates a stubpath in
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\EnhanceIE001
so that EnhanceIE.ps1 will only run once for new or existing users.
Alternatively you can import the registry information below instead of running Install.ps1.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\EnhanceIE001]
"Dontask"=dword:00000002
"IsInstalled"=dword:00000001
"Version"="1"
"StubPath"="Powershell.exe -ExecutionPolicy ByPass -NoProfile -WindowStyle Hidden -File C:\\Windows\\EnhanceIE.ps1"
User Profile Configuration
The Internet Explorer Tracking List files may take a minute or two to populate, therefore it is advisable to include or mirror the following user directory to preserve the tracking list files at user logoff.
AppData\Local\Microsoft\Internet Explorer\Tracking Protection
And preserve the following user registry key (and subkeys)
HKCU\SOFTWARE\Microsoft\Internet Explorer\Safety\PrivacIE\Lists |
.
