# Running playbooks remotely against Windows 10 hosts leaving a user profile in C:\\Users - is there a way to run -NoProfile **URL:** \ **Category:** Get Help\ **Tags:** windows, collections\ **Created:** [February 21, 2024, 12:25pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972 "2024-02-21T12:25:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Andy\_Technical](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@Andy\_Technical](https://forum.ansible.com/u/Andy_Technical)\ **Post date:** [February 21, 2024, 12:25pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/1 "2024-02-21T12:25:10Z")
Hello All When running playbooks remotely against Windows 10 hosts, it creates a profile entry in C:\Users for the sys admin user who ran the playbook. We have a Linux ansible controller from which we run the playbooks against Windows 10 hosts. In Powershell, I found its possible to run the following command to not create the profile : -NoProfile > **[about\_Profiles - PowerShell](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.4)** > > Describes how to create and use a PowerShell profile. However, not all of our ansible playbooks are running powershell scripts on the remote Windows 10 machines, some playbooks are simply copying files across or installing software remotely. The reason I’d like no profiles to be created in C:\Users after running a playbook is so that the C:\Users directory doesn’t get filled up with random profiles that essentially are never going to be logged into and therefore just stay there. Wondering if there is a variable I can run alongside the playbook which will mean no user profile is created on the remote host. Thanks Andy ---
**Author:** ![kevin\_codey](https://avatars.discourse-cdn.com/v4/letter/k/e99b99/32.png) [@kevin\_codey](https://forum.ansible.com/u/kevin_codey)\ **Post date:** [February 21, 2024, 3:33pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/2 "2024-02-21T15:33:04Z")
I wonder whether you could make a last task of removing the profile? ```auto - name: Remove a profile for a still valid account community.windows.win_user_profile: username: ansible-account state: absent ``` [community.windows.win\_user\_profile module – Manages the Windows user profiles. — Ansible Documentation](https://docs.ansible.com/ansible/latest/collections/community/windows/win_user_profile_module.html) ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [February 21, 2024, 7:58pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/3 "2024-02-21T19:58:55Z")
-NoProfile on PowerShell just runs the PowerShell executable without it’s profile file (like ~/.bashrc). It doesn’t have anything to do with the actual user profile. You’ll have to see if the connection plugin you are using has any options around connecting without a profile. Unfortunately it doesn’t look like we expose the option in the winrm or psrp connections and IIRC it didn’t even work anymore on newer versions of Windows for WinRM based connections. ---
**Author:** ![Andy\_Technical](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@Andy\_Technical](https://forum.ansible.com/u/Andy_Technical)\ **Post date:** [February 22, 2024, 9:23am UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/4 "2024-02-22T09:23:46Z")
Thanks @kevin_codey and @jborean for the ideas. Hi Kevin, unfortunately when trying to delete the profile after its been used to deploy a script, windows somehow still has it in use (perhaps a lock on one its files), and so can’t delete it. Hi Jordan, I see what you mean. Here is the connection method we’re using; ansible\_connection=winrm ansible\_winrm\_transport=kerberos ansible\_winrm\_scheme=http ansible\_port=5985 The reason I’d like to remove the stale profiles is because our vulnerability scanning tools picks up on these, and as these stale profiles aren’t logged into, various windows group policies etc do not get applied to them, and therefore they flag up. Any other ideas would be appreciated if there are any. Thanks 🙂 ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [March 21, 2024, 4:03pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/5 "2024-03-21T16:03:09Z")
Sounds like you need to enable the “Delete user profiles older than (days)” GPO. [Delete user profiles older than a specified number of days on system restart (admx.help)](https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.UserProfiles::CleanupProfiles) ---
**Author:** ![Andy\_Technical](https://avatars.discourse-cdn.com/v4/letter/a/0ea827/32.png) [@Andy\_Technical](https://forum.ansible.com/u/Andy_Technical)\ **Post date:** [March 22, 2024, 5:49pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/6 "2024-03-22T17:49:17Z")
Thanks @Denney-tech Unfortunately that GPO doesn’t work too well (also seen similar comments on forums stating the same) This is because the ntuser.dat file within a users profile in c:\users gets updated anytime the machine is patched with windows updates. This is because for some reason, windows updates touches the ntuser.dat file within each profile in c:\users, and so the last modified time of the profile gets updated, and so the GPO doesn’t delete the profile as it doesn’t recognize it as old. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [March 22, 2024, 6:03pm UTC](https://forum.ansible.com/t/running-playbooks-remotely-against-windows-10-hosts-leaving-a-user-profile-in-c-users-is-there-a-way-to-run-noprofile/3972/7 "2024-03-22T18:03:47Z")
Oh yeah! It’s been a while since I’ve been a Windows SysAdmin, so I forgot about that. I don’t think we encountered that problem that much my last job, though. Maybe we didn’t set the days high enough to matter? We also did nightly reboots where possible, which might have helped trigger cleanups between patching. We did however suffer from the 1709 upgrade bug that made this GPO delete _all users_ on the system instead. Fortunately, we had solid user backups for the sites that were impacted before we paused further updates.