Windows User Profiles: Composition, Architecture, and Mandatory Profile Internals

1. User Profile Composition

A Windows user profile encapsulates user-specific data, configuration settings, and application states. Its primary components are registry hives and a hierarchical file system structure.

1.1 Component List

• Registry Hives:
  • NTUSER.DAT: The core registry hive file located directly within the user's profile root directory (e.g., C:\Users\Username\NTUSER.DAT). Upon user logon, this hive is loaded by the User Profile Service (ProfSvc) and mounted into the registry under HKEY_USERS\<User_SID>. The well-known HKEY_CURRENT_USER (HKCU) root key is then established as a symbolic link to HKEY_USERS\<User_SID>. This hive stores the majority of user-specific registry settings, including application preferences, environment variables, connected hardware configurations (printers, mapped drives), Windows interface customizations (themes, colors, desktop settings), and control panel configurations. The handling of this file (read-write vs. read-only persistence) fundamentally distinguishes profile types like Roaming and Mandatory.⁴
  • UsrClass.dat: A supplementary user registry hive located by default at %USERPROFILE%\AppData\Local\Microsoft\Windows\UsrClass.dat. This hive is mounted during logon at HKEY_CURRENT_USER\Software\Classes (HKCU\Software\Classes).³ It stores per-user Component Object Model (COM) registrations, file type associations, and other class-specific information, separating them from the main NTUSER.DAT hive.³ Its default location within the AppData\Local directory signifies that it is not typically included in standard Roaming User Profile synchronization.³ Potential issues can arise if applications attempt registry writes to HKCU\Software\Classes early in the logon sequence before ProfSvc has fully mounted UsrClass.dat, potentially leading to incorrect registrations within NTUSER.DAT or conflicts.⁶
• File System Folders: The primary container for the user profile's file system components is the user's profile directory, typically located at C:\Users\<Username> (identified by KNOWNFOLDERID FOLDERID_Profile {5E6C858F-OE22-4760-9AFE-EA3317B67173}).¹ Within this directory, a standard set of subfolders, many corresponding to KNOWNFOLDERID GUIDs, store various categories of user data and application settings.¹¹ An list of standard user-profile-specific folders includes:
  • AppData\Roaming (FOLDERID_RoamingAppData): %USERPROFILE%\AppData\Roaming. Stores application settings designed to follow the user via Roaming Profiles.¹
  • AppData\Local (FOLDERID_LocalAppData): %USERPROFILE%\AppData\Local. Stores application data not intended for roaming, such as caches, machine-specific settings, or large data files. Also contains UsrClass.dat and Credential Manager vaults.¹
  • AppData\LocalLow (FOLDERID_LocalAppDataLow): %USERPROFILE%\AppData\LocalLow. Stores data for applications running with a low integrity level, such as browsers in protected mode.⁹
  • Desktop (FOLDERID_Desktop): %USERPROFILE%\Desktop. Contains files, folders, and shortcuts visible on the user's desktop.¹
  • Documents (FOLDERID_Documents): %USERPROFILE%\Documents. Default storage location for user-created documents.¹
  • Downloads (FOLDERID_Downloads): %USERPROFILE%\Downloads. Default location for files downloaded from the internet.¹¹
  • Favorites (FOLDERID_Favorites): %USERPROFILE%\Favorites. Stores Internet Explorer/Edge Legacy favorites.¹¹
  • Music (FOLDERID_Music): %USERPROFILE%\Music. Default location for music files.¹¹
  • Pictures (FOLDERID_Pictures): %USERPROFILE%\Pictures. Default location for picture files.¹¹ Includes subfolders:
    • Camera Roll (FOLDERID_CameraRoll): %USERPROFILE%\Pictures\Camera Roll.¹¹
    • Saved Pictures (FOLDERID_SavedPictures): %USERPROFILE%\Pictures\Saved Pictures.¹¹
    • Screenshots (FOLDERID_Screenshots): %USERPROFILE%\Pictures\Screenshots.¹¹
  • Videos (FOLDERID_Videos): %USERPROFILE%\Videos. Default location for video files.¹¹
  • Start Menu (FOLDERID_StartMenu): %APPDATA%\Microsoft\Windows\Start Menu. Contains user-specific shortcuts and folders appearing in the Start Menu.¹ Includes subfolders:
    • Programs (FOLDERID_Programs): %APPDATA%\Microsoft\Windows\Start Menu\Programs.¹²
    • Startup (FOLDERID_Startup): %APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp. Programs/shortcuts launched automatically at user logon.¹¹
  • SendTo (FOLDERID_SendTo): %APPDATA%\Microsoft\Windows\SendTo. Contains shortcuts appearing in the "Send To" context menu.¹¹
  • Templates (FOLDERID_Templates): %APPDATA%\Microsoft\Windows\Templates. Stores user document templates.¹¹
  • Cookies (FOLDERID_Cookies): %APPDATA%\Microsoft\Windows\Cookies. Stores internet cookies (primarily legacy IE).¹¹
  • History (FOLDERID_History): %LOCALAPPDATA%\Microsoft\Windows\History. Stores internet browsing history (primarily legacy IE).¹¹
  • Recent (FOLDERID_Recent): %APPDATA%\Microsoft\Windows\Recent. Stores shortcuts to recently used files and folders.¹¹
  • Network Shortcuts (FOLDERID_NetHood): %APPDATA%\Microsoft\Windows\Network Shortcuts. Stores shortcuts to network locations.¹¹
  • Printer Shortcuts (FOLDERID_PrintHood): %APPDATA%\Microsoft\Windows\Printer Shortcuts. Stores shortcuts related to printers.¹¹
  • User Pinned (FOLDERID_UserPinned): %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned. Contains subfolders for Taskbar and implicitly pinned Start Menu items.¹¹
    • TaskBar: %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar. Stores shortcuts (.lnk files) for items pinned to the taskbar.²⁰
    • ImplicitAppShortcuts (FOLDERID_ImplicitAppShortcuts): %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts. Stores shortcuts for applications implicitly associated with certain tasks or file types.¹¹
  • Contacts (FOLDERID_Contacts): %USERPROFILE%\Contacts.¹¹
  • Links (FOLDERID_Links): %USERPROFILE%\Links.¹¹
  • Saved Games (FOLDERID_SavedGames): %USERPROFILE%\Saved Games.¹¹
  • Searches (FOLDERID_SavedSearches): %USERPROFILE%\Searches.¹¹
  • 3D Objects (FOLDERID_Objects3D): %USERPROFILE%\3D Objects.¹¹
  • AccountPictures (FOLDERID_AccountPictures): %APPDATA%\Microsoft\Windows\AccountPictures.¹¹
  • Application Shortcuts (FOLDERID_ApplicationShortcuts): %LOCALAPPDATA%\Microsoft\Windows\Application Shortcuts.¹¹
• Other Components:
  • User Tile Image (Legacy): %SystemDrive%\Users\<username>\AppData\Local\Temp\<username>.bmp. The mechanism for storing and retrieving the user tile image may have evolved in modern Windows versions.¹

1.2 Comparative Table: Profile Type Discrepancies

The management of core profile components and user-generated changes varies significantly across different profile types. The following table summarizes these discrepancies:

The inherent design of standard Roaming Profiles, specifically the exclusion of UsrClass.dat and the entire AppData\Local structure from synchronization, presents a significant challenge for achieving a truly consistent user experience across multiple machines. Many applications store critical configuration data, machine-specific identifiers, large caches, or per-user COM/file association registrations within these non-roaming locations.³ Consequently, users may encounter application errors, missing settings, or unexpected behavior when moving between workstations, as these local components are not transferred. This limitation often necessitates the use of supplementary technologies like Folder Redirection for specific user data folders or more comprehensive profile virtualization solutions (e.g., Microsoft UE-V, FSLogix Profile Containers) to capture and roam data stored outside the default roaming scope.¹⁵

Mandatory profiles inherit this limitation regarding AppData\Local and UsrClass.dat. While the NTUSER.MAN file enforces consistency for registry settings within HKCU (excluding HKCU\Software\Classes) and the AppData\Roaming folder content is reset at each logon from the server template, data written to AppData\Local or AppData\LocalLow during a session is discarded at logoff but is not actively managed or reset by the mandatory profile mechanism itself.⁴¹ The consistency guarantee primarily applies to the components defined within the server-side mandatory profile template.

1.3 User-Interactive Element Mapping

Specific user interface elements and configurations are stored in defined locations within the profile structure and managed by distinct system processes.

• Desktop Background:
  • Storage: The path to the selected wallpaper image file is stored in the registry value HKCU\Control Panel\Desktop\Wallpaper. A history of recently used wallpapers is maintained in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers\BackgroundHistoryPath* values.⁴³ Windows caches or transcodes the current wallpaper for efficient display, often storing it in files like TranscodedWallpaper (no extension) or within subfolders in %APPDATA%\Microsoft\Windows\Themes\.⁴³
  • Management Processes: Explorer.exe is primarily responsible for reading the registry setting and displaying the background image. User configuration occurs through the Settings app (SystemSettings.exe) or legacy Control Panel interfaces. For slideshows or dynamic backgrounds (like Windows Spotlight), background task hosts (taskhostw.exe, potentially RuntimeBroker.exe for UWP components) or dedicated services manage the image rotation and updates.⁴⁵
• Application-Specific Settings (HKCU & AppData):
  • Storage: Application settings are predominantly stored within the user's registry hive (NTUSER.DAT, accessed via HKCU), typically under HKCU\Software\<VendorName>\<ApplicationName>. Applications also store configuration files, caches, user data, and state information within the profile's file system, utilizing AppData\Roaming for data intended to roam, and AppData\Local or AppData\LocalLow for non-roaming or machine-specific data.¹
  • Management Processes: The application's own executable process is the primary entity reading and writing its settings during runtime. Installation and update processes may also modify these locations. ProfSvc manages the loading and unloading of the NTUSER.DAT hive containing the HKCU settings at logon/logoff.¹⁹ Explorer.exe interacts with settings related to shell integrations (e.g., context menu handlers registered under HKCU).
• Start Menu/Taskbar Layout & Pinned Items:
  • Storage (Layout): Standardized Start layouts are typically defined by administrators using XML (LayoutModification.xml) or JSON (LayoutModification.json) files.⁵⁰ These files are deployed via Group Policy (Computer Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout or User Configuration equivalent) or MDM (Policy CSP - Start/StartLayout or Start/ConfigureStartPins).⁵⁰ The system reads these policies and applies the defined layout. The default template resides at %LOCALAPPDATA%\Microsoft\Windows\Shell\DefaultLayouts.xml.⁵⁰ User customizations to the layout, if permitted, are likely stored within the user's registry (NTUSER.DAT, potentially under keys like HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage* or related keys) or possibly user-specific layout files, although the exact mechanism for persisting user deviations from a policy-defined layout is less explicitly documented in the provided materials.
  • Storage (Pinned Items):
    • Taskbar: Pinned application shortcuts (.lnk files) are stored in the %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar folder.²⁰ Registry state related to the taskbar, possibly including pin information or order, may be stored under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband.²¹
    • Start Menu: Program shortcuts (.lnk files) pinned by the user or applications appear based on their presence in %APPDATA%\Microsoft\Windows\Start Menu\Programs and the system-wide %ProgramData%\Microsoft\Windows\Start Menu\Programs.¹⁷ Modern Windows Store app pins are managed differently, likely via registry entries or internal databases associated with the Start menu host process.¹⁷ The legacy TileDataLayer database (%LOCALAPPDATA%\TileDataLayer\Database\vedatamodel.edb) mentioned for older Windows 10 versions is likely deprecated.¹⁷
  • Management Processes: Explorer.exe renders the taskbar and manages pinned item interactions.⁴⁷ The Start Menu UI itself is handled by StartMenuExperienceHost.exe in Windows 10 version 1903 and later, and Windows 11.⁵¹ This separation was implemented to improve Start Menu reliability by isolating it from Explorer.exe.⁵² In earlier Windows 10 versions, ShellExperienceHost.exe played a more significant role in hosting Start and other shell elements.⁵¹ Userinit.exe initiates the shell launch sequence.⁵³ The Group Policy Client (gpsvc) applies layout policies defined by administrators.⁵⁰
• Mapped Network Drives:
  • Storage: Persistent network drive mappings are stored in the registry under HKCU\Network\<DriveLetter>, detailing the remote path (RemotePath), provider (ProviderName), and other connection details.⁵⁴ Historical mount point information, including previously mapped drives, may also reside under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2.⁵⁶
  • Management Processes: Explorer.exe provides the user interface for mapping and disconnecting drives and displays them in "This PC". The mapping itself is handled by the Multiple Provider Router (mpr.dll) and relevant network provider DLLs (e.g., ntlanman.dll for SMB/CIFS). Userinit.exe processes logon scripts which often contain net use commands to establish mappings automatically.⁵³ The underlying network communication relies on the SMB client redirector driver (mrxsmb.sys or newer variants) and associated services (LanmanWorkstation).⁵⁷
• Connected Printers:
  • Storage: User-specific network printer connections are primarily stored under HKCU\Printers\Connections. User preferences for printers (e.g., default printer) and potentially some device-specific settings are found under HKCU\Software\Microsoft\Windows NT\CurrentVersion\Devices and HKCU\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts.⁵⁸ System-wide printer definitions, drivers, and ports are located under HKLM\SYSTEM\CurrentControlSet\Control\Print.⁵⁸
  • Management Processes: The Print Spooler service (spoolsv.exe) manages print queues, printer drivers, and communication with print devices.⁶⁰ Explorer.exe and the Settings app provide user interfaces for adding and managing printers. Applications interact with the spooler via printing APIs when a print job is initiated.⁶¹ Userinit.exe can connect printers via logon scripts (e.g., using rundll32 printui.dll,PrintUIEntry).
• User-Defined Environment Variables:
  • Storage: Environment variables defined specifically for the current user are stored in the registry under HKCU\Environment.⁶²
  • Management Processes: Userinit.exe reads these registry values during logon and incorporates them into the initial environment block for the user's session.⁵³ This environment block is then inherited by the shell (Explorer.exe) and subsequently by any process launched by the user during the session.⁶² Modifications can be made via the System Properties control panel applet (SystemPropertiesAdvanced.exe) or the Settings app, which write back to the HKCU\Environment key. PowerShell cmdlets ($Env:, SetEnvironmentVariable) can also modify these for the current process or persistently in the registry.⁶⁴
• Shell Folder Customizations:
  • Storage: Settings determining folder views (icon size, columns displayed, sorting) are stored within the user's registry hive (NTUSER.DAT), primarily under HKCU\Software\Microsoft\Windows\Shell\Bags and related keys like HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU.⁶⁶ (Derived from context). Customizations like specific folder icons or info tips can be defined in hidden desktop.ini files within individual folders.⁶⁷ Shell Namespace Extensions, which create virtual folders or modify existing ones, register their COM objects (CLSIDs) under HKEY_CLASSES_ROOT (for all users) or HKCU\Software\Classes (for the specific user, leveraging UsrClass.dat).⁶⁶
  • Management Processes: Explorer.exe is the primary process responsible for reading these settings and rendering the folder views and icons accordingly. It loads and interacts with registered Shell Extensions (which might run in-process or be hosted in dllhost.exe for isolation) to provide customized context menus, columns, or folder contents.⁶⁶
• Credential Manager Entries:
  • Storage: Credentials (Web, Windows, Certificate-based, Generic) managed by Credential Manager are stored as encrypted data blobs within .vcrd files located in %LOCALAPPDATA%\Microsoft\Credentials\ and %LOCALAPPDATA%\Microsoft\Vault\.¹⁶ The encryption relies on the Windows Data Protection API (DPAPI), using keys derived from the user's logon credentials or system keys. A corresponding Policy.vpol file in the same directories stores metadata related to the vault and DPAPI protection.¹⁶ These credentials are not part of the standard roaming profile components due to their storage location in AppData\Local.
  • Management Processes: lsass.exe plays a central role, hosting the core security services including DPAPI (dpapisrv.dll logic) and likely the Credential Manager service logic (vaultsvc.dll) responsible for secure storage and retrieval.⁶⁸ Client-side interactions (saving, retrieving, enumerating credentials) occur via the vaultcli.dll library, which provides APIs used by the Credential Manager control panel, command-line tools (cmdkey.exe, vaultcmd.exe), and applications calling Credential Manager APIs (e.g., CredRead, CredWrite, CredEnumerate).¹⁶ Authentication prompts related to credential access or saving are often handled via CredUIPromptForCredentials or similar APIs, potentially hosted by processes like LogonUI.exe or the calling application.⁷⁴ The local storage ensures credentials are not easily accessible over the network via the roaming profile share but necessitates re-entry on different machines unless specific roaming solutions are used.

2. Profile Type Definitions

3. Detailed Architecture of Profile Management

4. Profile Setup Procedures

5. Logon Process with a Mandatory Profile (Under the Hood)

The logon process for a user configured with a Mandatory User Profile involves a detailed sequence of interactions between client-side components, Domain Controllers (DCs), and the file server hosting the profile.

1. Initial Winlogon.exe Phase & Credential Acquisition:
   • The process begins when the user initiates logon, typically by pressing the Secure Attention Sequence (SAS), Ctrl+Alt+Del.⁸⁰
   • Winlogon.exe detects the SAS, switches to the secure Winlogon desktop, and launches LogonUI.exe.⁸⁰
   • LogonUI.exe enumerates and loads registered Credential Providers (e.g., password provider in authui.dll, smart card provider).⁷⁹
   • The relevant Credential Provider presents its user interface tile(s) and securely collects the user's credentials (e.g., username and password).⁷⁹
   • The collected credentials are securely passed back from the Credential Provider (via LogonUI.exe) to Winlogon.exe.⁷⁹
2. Authentication (LSASS.exe):
   • Winlogon.exe makes a call to the LsaLogonUser function, passing the collected credentials to the Local Security Authority Subsystem Service (lsass.exe) for verification.⁸⁰
   • lsass.exe identifies the appropriate authentication package based on the logon type (typically Kerberos for domain logons).⁸⁰
   • Kerberos Authentication Flow:⁸⁰
     • The client's lsass.exe process acts as the Kerberos client. It sends an Authentication Service Request (AS-REQ) to the Key Distribution Center (KDC) service (running within lsass.exe on a DC) for the target domain.
     • The KDC verifies the user's credentials against Active Directory. If valid, it returns an Authentication Service Reply (AS-REP) containing a Ticket-Granting Ticket (TGT) encrypted with the user's password hash.
     • The client lsass.exe decrypts the TGT and caches it. It then sends a Ticket-Granting Service Request (TGS-REQ), presenting the TGT, to the KDC. This request asks for service tickets for necessary resources:
       • The Domain Controller's LDAP service (Service Principal Name - SPN: ldap/<DC_FQDN>) for subsequent AD queries.
       • The File Server's CIFS (SMB) service (SPN: cifs/<FileServer_FQDN>) for accessing the profile share.
     • The KDC validates the TGT and issues a Ticket-Granting Service Reply (TGS-REP) containing the requested service tickets, encrypted with session keys.
   • NTLM Fallback: While Kerberos is preferred, NTLM challenge/response might be attempted if Kerberos fails, although accessing domain resources like the profile path typically requires successful Kerberos authentication.⁸⁰
   • Upon successful authentication by the chosen package, lsass.exe creates a logon session for the user and generates their access token. This token encapsulates the user's SID, group SIDs, and privileges. lsass.exe returns a success status and a handle to the logon session/token back to Winlogon.exe.⁸⁰
3. User Profile Service (ProfSvc) Invocation:
   • Following successful authentication, Winlogon.exe signals the User Profile Service (ProfSvc) to proceed with loading the user's profile⁴⁹ (Implicit interaction).
4. User Object & Profile Path Retrieval (LDAP):
   • ProfSvc, requiring the location and type of the user's profile, initiates an LDAP query to a Domain Controller⁸⁵ (Implicit step). The specific DC is found via the DC Locator process (DNS queries for SRV records).
   • The LDAP connection is established using an authenticated bind, leveraging the user's Kerberos credentials (the LDAP service ticket obtained during authentication).⁸⁵
   • An LDAP search request is sent, typically targeting the user's domain partition (e.g., DC=contoso,DC=com), with a filter to identify the user object (e.g., (&(objectCategory=person)(objectClass=user)(sAMAccountName=<username>))).
   • The request specifies the attributes to retrieve, critically including objectSid and profilePath. Other relevant attributes like scriptPath might also be requested.³⁰
   • The DC's lsass.exe (hosting the NTDS service) processes the query against the Active Directory database (ntds.dit) and returns the requested attributes to the client's ProfSvc.
5. Profile Path Resolution & Type Determination:
   • ProfSvc parses the retrieved profilePath attribute value (e.g., \\FileServer2\Mandatory$\CorpStd or \\FileServer2\Mandatory$\CorpStd.man).
   • It determines the profile type based on the path and file existence checks:
     • If profilePath is empty or not set, it defaults to a local profile.
     • If profilePath ends with .man, it's identified as Super-Mandatory.²⁵ ProfSvc checks accessibility; if the path is unavailable, logon is terminated.
     • If profilePath does not end with .man, ProfSvc resolves the full path including the OS-specific version suffix (e.g., \\FileServer2\Mandatory$\CorpStd.V6). It then checks for the existence of NTUSER.MAN within that directory.² If NTUSER.MAN is found, the profile is identified as Mandatory. If the path is inaccessible, ProfSvc attempts to use a locally cached version (if caching is enabled); otherwise, it proceeds to create a temporary profile.²⁸
     • If NTUSER.DAT is found instead of NTUSER.MAN, it's identified as Roaming.
   • Internal flags corresponding to the profile type (e.g., PT_MANDATORY, PT_TEMPORARY) are set, likely reflected in the Flags and State values under HKLM\...\ProfileList\<User_SID>.⁹³
6. Profile Download/Copy:
   • For a Mandatory or Super-Mandatory profile, ProfSvc initiates an SMB connection to the file server and share specified by the resolved profile path (e.g., \\FileServer2\Mandatory$\CorpStd.V6)⁷⁷ (Implicit).
   • Authentication to the file server occurs using the user's Kerberos service ticket for the cifs SPN (obtained during authentication) or NTLM fallback.⁸⁵
   • ProfSvc performs file copy operations:
     • Source: Contents of the server-side mandatory profile folder (\\FileServer2\Mandatory$\CorpStd.V6\*).
     • Destination: The local user profile directory (C:\Users\Username). A temporary staging directory might be used first to ensure atomicity before committing to the final path.
     • The NTUSER.MAN file from the server share is copied to the local profile directory and renamed to NTUSER.DAT⁷⁷ (Implicit).
     • All other files and folders within the server profile template (AppData\Roaming, Desktop, etc.) are copied to the corresponding locations in the local profile directory.
   • File Locking Behavior: The NTUSER.MAN file on the server share is accessed for reading during the copy operation but is typically not held open with an exclusive lock by the client throughout the session⁷⁷ (Inferred). This allows multiple users to concurrently download the same mandatory profile template at logon. The enforcement of the mandatory state relies on the read-only nature of persistence (discarding changes at logoff), not on locking the source file.
7. Local Profile Initialization:
   • ProfSvc invokes the LoadUserProfile API (or an internal equivalent) provided by userenv.dll.⁹²
   • LoadUserProfile internally calls functions like RegLoadKey (from advapi32.dll or kernel equivalents) to load the locally copied NTUSER.DAT hive file into the registry under the HKEY_USERS\<User_SID> key.⁹⁵
   • The system establishes the HKEY_CURRENT_USER (HKCU) alias, linking it to HKEY_USERS\<User_SID>.¹
   • ProfSvc may perform additional initialization steps, ensuring standard profile directories exist and potentially applying initial security descriptors.
8. Environment Setup & Shell Launch:
   • The Group Policy Client service (gpsvc) is triggered to apply User Configuration GPOs. Policies are processed based on the user's location in AD and linked GPOs.⁸⁹
   • Winlogon.exe starts the Userinit.exe process.⁵³
   • Userinit.exe executes its initialization sequence⁵³:
     • Reads and establishes the user's environment variables (system + HKCU\Environment).
     • Executes assigned logon scripts (GPO-defined or from scriptPath attribute).
     • Restores persistent network drive mappings defined in the profile.
     • Reads the shell path from HKLM\...\Winlogon\Shell (typically explorer.exe).
     • Launches explorer.exe (or the specified shell) under the user's security context, inheriting the established environment.
     • Userinit.exe terminates.
9. Mandatory Profile Enforcement (Logoff/Session Behavior):
   • Mechanism: During the user's session, changes are made to the local copy of the profile (registry, files). At logoff, ProfSvc checks the profile type. Because it was loaded from a source containing NTUSER.MAN (or identified via flags/state), it intentionally skips the synchronization phase where changes would normally be uploaded back to the server share.¹ This effectively discards all changes made during the session.
   • Local Cache Handling: The fate of the local profile directory (C:\Users\Username) at logoff depends on policy:
     • Default Behavior: The local cache is typically retained after logoff. However, at the next logon, it is overwritten by a fresh copy from the server's mandatory profile template.²⁴ This allows for potential offline logon using the (potentially stale) cached mandatory profile if the server is unavailable.²⁴
     • With "Delete cached copies..." GPO Enabled: If the Computer Configuration\Policies\Administrative Templates\System\User Profiles\Delete cached copies of roaming profiles GPO is enabled, ProfSvc will actively delete the entire local profile directory (C:\Users\Username) during the logoff process.²⁴ This prevents offline logon using the cache and ensures no residual data remains, but requires a full profile download at every logon.
10. Process/Module Responsibility Mapping Summary:
    • Authentication: Winlogon.exe, LogonUI.exe, Credential Providers, lsass.exe (Client & DC), Kerberos/NTLM DLLs.
    • LDAP Query: ProfSvc (via userenv.dll/profapi.dll, using wldap32.dll) -> DC lsass.exe (NTDS).
    • Profile Type Check: ProfSvc (using userenv.dll APIs like GetProfileType).
    • SMB Copy: ProfSvc (initiator) -> Client SMB Redirector (mrxsmb.sys) -> Server LanmanServer service & srv2.sys/srv.sys driver.
    • Registry Load: ProfSvc (via userenv.dll API LoadUserProfile) -> advapi32.dll (RegLoadKey).
    • GPO Application: gpsvc.
    • Environment/Scripts/Shell Launch: Userinit.exe.
    • Logoff Change Discard: ProfSvc (by skipping sync based on mandatory flag).
    • Cache Deletion: ProfSvc (if GPO enabled).

6. Server-Side Processes and Interactions (Mandatory Profile Context)

The successful loading of a mandatory profile relies on specific processes and services running on both the Domain Controller(s) and the File Server hosting the profile share.

Works cited

1. About User Profiles (Windows) - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/bb776892(v=vs.85)
2. Where Is the Windows Registry Stored - Ultimate Systems Blog, accessed May 9, 2025, https://blog.usro.net/2024/10/where-is-the-windows-registry-stored/
3. Information About Windows Registry - HACKLIDO, accessed May 9, 2025, https://hacklido.com/blog/51-information-about-windows-registry
4. windows-itpro-docs/windows/client-management/client-tools/mandatory-user-profile.md at public - GitHub, accessed May 9, 2025, https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/client-management/client-tools/mandatory-user-profile.md
5. What is mandatory profile - Microsoft Community, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/all/what-is-mandatory-profile/2b594ca1-d3a5-4f2a-8ef7-4bee3c0e50dc
6. Windows 10 Application Log Event ID 1542 No start button/Windows - Microsoft Community, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/windows_10-start/windows-10-application-log-event-id-1542-no-start/babcf9c5-937a-43cd-87c0-8cb470b3bfac?page=3
7. Where does the USrClass.dat file get its information from when a profile is created?, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/all/where-does-the-usrclassdat-file-get-its/57814d82-9d8d-4d4e-8941-c8c8d8b9b0b9
8. Profile loading fails - Windows Server | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/desktop-location-unavailable
9. Difference between Local, Locallow, Roaming folder. - Microsoft Community, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/all/difference-between-local-locallow-roaming-folder/5f46d671-9303-4260-8226-82f5d4e509cc
10. Why are there directories called Local, LocalLow, and Roaming under \Users\
11. KNOWNFOLDERID (Knownfolders.h) - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid
12. User Shell Folders - Armour Infosec, accessed May 9, 2025, https://www.armourinfosec.com/user-shell-folders/
13. How to manually change the default location of user files in Windows - Geeks in Phoenix, accessed May 9, 2025, https://www.geeksinphoenix.com/blog/post/2023/02/26/how-to-manually-change-the-default-location-of-user-files-in-windows
14. KNOWNFOLDERID | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/previous-versions/bb762584(v=vs.85)
15. Disabled roaming profiles but APPDATA is still pointing to the roaming location instead of local - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/721945/disabled-roaming-profiles-but-appdata-is-still-poi
16. Credentials from Password Stores: Windows Credential Manager, Sub-technique T1555.004 - Enterprise | MITRE ATT&CK®, accessed May 9, 2025, https://attack.mitre.org/techniques/T1555/004/
17. Where are ALL locations of Start Menu folders in Windows 10? - Super User, accessed May 9, 2025, https://superuser.com/questions/960406/where-are-all-locations-of-start-menu-folders-in-windows-10
18. CSIDL (Shlobj.h) - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/shell/csidl
19. Configure Startup Applications in Windows - Microsoft Support, accessed May 9, 2025, https://support.microsoft.com/en-us/windows/configure-startup-applications-in-windows-115a420a-0bff-4a6f-90e0-1934c844e473
20. Understanding the Taskbar: Key Features and Functions Explained - Lenovo, accessed May 9, 2025, https://www.lenovo.com/us/en/glossary/taskbar/
21. How to Back Up and Restore Your Pinned Taskbar Items on Windows - MakeUseOf, accessed May 9, 2025, https://www.makeuseof.com/windows-back-up-restore-pinned-taskbar-items/
22. Types of User Profiles: Mandatory Profile [Breakdown] – Ivanti, accessed May 9, 2025, https://www.ivanti.com/blog/profile-series-mandatory-profile-gotchas
23. learn.microsoft.com, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/shell/mandatory-user-profiles#:~:text=A%20mandatory%20user%20profile%20is,when%20the%20user%20logs%20off.
24. Are Mandatory User Profiles Deleted at Logoff - or Cached? - Helge Klein, accessed May 9, 2025, https://helgeklein.com/blog/are-mandatory-user-profiles-deleted-at-logoff-or-cached/
25. Creating a mandatory profile on Windows 10 1803 – james-rankin.com, accessed May 9, 2025, https://james-rankin.com/articles/creating-a-mandatory-profile-on-windows-10-1803/
26. Roaming user profile - Wikipedia, accessed May 9, 2025, https://en.wikipedia.org/wiki/Roaming_user_profile
27. Folder Redirection, Offline Files, and Roaming User Profiles overview | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview
28. Create mandatory user profiles | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/client-management/client-tools/mandatory-user-profile
29. Mandatory User Profiles (Windows) | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/bb776895(v=vs.85)
30. Deploy roaming user profiles | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows-server/storage/folder-redirection/deploy-roaming-user-profiles
31. mandatory user profile in The Network Encyclopedia, accessed May 9, 2025, http://www.thenetworkencyclopedia.com/entry/mandatory-user-profile/
32. How to Fix Temporary Profile in Windows - Fortect, accessed May 9, 2025, https://www.fortect.com/how-to-guides/how-to-fix-temporary-profile-in-windows/
33. Windows 10 Reports That You Are On a Temporary Profile | Dell US, accessed May 9, 2025, https://www.dell.com/support/kbdoc/en-us/000134012/windows-10-reports-you-are-on-a-temporary-profile
34. Local Profile vs. Roaming Profile: Advantages and Disadvantages, accessed May 9, 2025, https://www.itsasap.com/blog/local-vs-roaming-profile
35. Group Policy: Automatically Delete User Profiles Older Than Certain Number of Days Win 10 not working. - Microsoft Q&A, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/441800/group-policy-automatically-delete-user-profiles-ol
36. LocalAppData Roaming - Microsoft Q&A, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/282423/localappdata-roaming
37. Profile Management use cases - Citrix Product Documentation, accessed May 9, 2025, https://docs.citrix.com/en-us/profile-management/2402-ltsr/how-it-works/use-cases.html
38. Customize default local user profile - Windows Client | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/customize-default-local-user-profile
39. Fix You've been signed in with a temporary profile in Windows 10, accessed May 9, 2025, https://www.tenforums.com/tutorials/48012-fix-youve-been-signed-temporary-profile-windows-10-a.html
40. Mandatory Profiles - The Good, the Bad and the Ugly - Helge Klein, accessed May 9, 2025, https://helgeklein.com/blog/mandatory-profiles-the-good-the-bad-and-the-ugly/
41. Create mandatory user profiles | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/client-management/mandatory-user-profile
42. User profile management for Azure Virtual Desktop with FSLogix profile containers, accessed May 9, 2025, https://learn.microsoft.com/en-us/azure/virtual-desktop/fslogix-profile-containers
43. How do I find the pic I'm using for my desktop background : r/Windows10 - Reddit, accessed May 9, 2025, https://www.reddit.com/r/Windows10/comments/107x7gg/how_do_i_find_the_pic_im_using_for_my_desktop/
44. How to Find Your Current Desktop Wallpaper's File Location in Windows 11 - MakeUseOf, accessed May 9, 2025, https://www.makeuseof.com/find-desktop-wallpapers-file-location-windows-11/
45. Windows background apps and your privacy - Microsoft Support, accessed May 9, 2025, https://support.microsoft.com/en-us/windows/windows-background-apps-and-your-privacy-83f2de44-d2d9-2b29-4649-2afe0913360a
46. What background processes are okay to close - Microsoft Community, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/all/what-background-processes-are-okay-to-close/dafa0090-ce1a-4268-878a-179ab7f9758f
47. Customize the Taskbar in Windows - Microsoft Support, accessed May 9, 2025, https://support.microsoft.com/en-us/windows/customize-the-taskbar-in-windows-0657a50f-0cc7-dbfd-ae6b-05020b195b07
48. How to Access and Manage the AppData Folder in Windows 10 and 11? - SmartWindows, accessed May 9, 2025, https://smartwindows.app/blog/how-to-access-and-manage-the-appdata-folder-in-windows-10-and-11/
49. How do i fix "the user profile service failed the sign in" without logging into an account?, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/1635289/how-do-i-fix-the-user-profile-service-failed-the-s
50. Customize The Start Layout For Managed Windows Devices | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/configuration/start/layout
51. Troubleshoot Start menu errors - Windows Client | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors
52. What was new in 19H1 Windows 10 Insider Preview Builds - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows-insider/archive/new-in-19h1
53. What does userinit.exe do? - Server Fault, accessed May 9, 2025, https://serverfault.com/questions/411189/what-does-userinit-exe-do
54. Files and Folders Located on a Mapped Drive Become Unselected, accessed May 9, 2025, https://support.carbonite.com/articles/Server-Windows-Files-and-Folders-Located-on-a-Mapped-Drive-Become-Unselected
55. Can I rearrange drive letters of my mapped network drives? - Super User, accessed May 9, 2025, https://superuser.com/questions/916326/can-i-rearrange-drive-letters-of-my-mapped-network-drives
56. How to Find Mapped Drives in a Remote PC Registry - Small Business - Chron.com, accessed May 9, 2025, https://smallbusiness.chron.com/mapped-drives-remote-pc-registry-57951.html
57. How to Map a Network Drive: A Step-by-Step Guide - Lansweeper, accessed May 9, 2025, https://www.lansweeper.com/blog/itam/how-to-map-a-network-drive-a-step-by-step-guide/
58. How to Check a Registry Key for a Printer on Your Computer - Small Business - Chron.com, accessed May 9, 2025, https://smallbusiness.chron.com/check-registry-key-printer-computer-57663.html
59. Installed Printers via Registry | Detection - Insider Threat Matrix, accessed May 9, 2025, https://insiderthreatmatrix.org/detections/DT006
60. Best practices for configuring Windows Print Servers - PaperCut, accessed May 9, 2025, https://www.papercut.com/kb/Main/PrintQueueSetUpOnWindows/
61. Fix printer connection and printing problems in Windows - Microsoft Support, accessed May 9, 2025, https://support.microsoft.com/en-us/windows/fix-printer-connection-and-printing-problems-in-windows-fb830bff-7702-6349-33cd-9443fe987f73
62. Get Environment Variable - N-able, accessed May 9, 2025, https://documentation.n-able.com/N-central/userguide/Content/Automation/Objects/System/GetEnvironmentVariable.htm
63. Environment Variables and Windows 10 – 3SL Blog – Threesl.com, accessed May 9, 2025, https://www.threesl.com/blog/environment-variables-windows-10/
64. about_Environment_Variables - PowerShell | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_environment_variables?view=powershell-7.5
65. Setting Env Variables in Windows, Linux & MacOS: Beginner's Guide - Configu, accessed May 9, 2025, https://configu.com/blog/setting-env-variables-in-windows-linux-macos-beginners-guide/
66. Implementing the Basic Folder Object Interfaces - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/shell/nse-implement
67. CBFS Shell | Windows Shell Virtual Folders - Callback Technologies, accessed May 9, 2025, https://www.callback.com/cbfsshell
68. Cached and Stored Credentials Technical Overview - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh994565(v=ws.11)
69. Considerations and known issues when using Credential Guard - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues
70. Windows Credential Manager (recommended) - DigiCert Docs, accessed May 9, 2025, https://docs.digicert.com/en/digicert-keylocker/overview/secure-credentials/set-up-secure-credentials-for-windows/windows-credential-manager.html
71. script to delete saved password for IE/Edge - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/720237/script-to-delete-saved-password-for-ie-edge
72. Detection: Windows Credentials Access via VaultCli Module | Splunk Security Content, accessed May 9, 2025, https://research.splunk.com/endpoint/c0d89118-3f89-4cd7-8140-1f39e7210681/
73. T1555.004 - Credentials from Password Stores: Windows Credential Manager - Atomic Red Team, accessed May 9, 2025, https://www.atomicredteam.io/atomic-red-team/atomics/T1555.004
74. Credential Manager in Windows - Microsoft Support, accessed May 9, 2025, https://support.microsoft.com/en-us/windows/credential-manager-in-windows-1b5c916a-6a16-889f-8581-fc16e8165ac0
75. Unsupported DFS-R and DFS-N deployment scenario - Windows Server | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/support-policy-for-dfsr-dfsn-deployment
76. Profile Management 7.15 - Citrix Product Documentation, accessed May 9, 2025, https://docs.citrix.com/en-us/profile-management/downloads/profile-management-7-15.pdf
77. windows 10: create local mandatory (unchangeable) user profile, accessed May 9, 2025, https://superuser.com/questions/1190789/windows-10-create-local-mandatory-unchangeable-user-profile
78. List of Microsoft Windows components – Wikipedia, accessed May 9, 2025, https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_components
79. Credentials Processes in Windows Authentication - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/credentials-processes-in-windows-authentication
80. Microsoft Windows Security, accessed May 9, 2025, https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=8
81. Windows Credential Provider - LDAPWiki, accessed May 9, 2025, https://ldapwiki.com/wiki/Wiki.jsp?page=Windows%20Credential%20Provider
82. MSGina.dll Features - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/secauthn/msgina-dll-features
83. Boot or Logon Initialization Scripts: Logon Script (Windows), Sub-technique T1037.001, accessed May 9, 2025, https://attack.mitre.org/techniques/T1037/001/
84. How User Account Control works | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works
85. How to troubleshoot high Lsass.exe CPU utilization on Active Directory Domain Controllers, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/troubleshoot-high-lsass.exe-cpu-utilization
86. Troubleshooting High LSASS CPU Utilization on a Domain Controller (Part 1 of 2), accessed May 9, 2025, https://techcommunity.microsoft.com/blog/askds/troubleshooting-high-lsass-cpu-utilization-on-a-domain-controller-part-1-of-2/394888
87. Please wait for the user profile service problem - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/1659194/please-wait-for-the-user-profile-service-problem
88. Essential Windows Services: User Profile Service / ProfSvc | The Core Technologies Blog, accessed May 9, 2025, https://www.coretechnologies.com/blog/windows-services/profsvc/
89. Applying Group Policy troubleshooting guidance - Windows Server | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/applying-group-policy-troubleshooting-guidance
90. Group Policy Client service failed the logon. Access denied. - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/35476/group-policy-client-service-failed-the-logon-acces
91. CreateProfile function (userenv.h) – Win32 apps - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-createprofile
92. GetProfileType function (userenv.h) - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-getprofiletype
93. GetAllUsersProfileDirectoryA function (userenv.h) – Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-getallusersprofiledirectorya
94. LoadUserProfileA function (userenv.h) – Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/api/userenv/nf-userenv-loaduserprofilea
95. FSlogix Black Screen - Microsoft Q&A, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/414883/fslogix-black-screen
96. Internet explorer crashing for few users - Microsoft Q&A, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/466589/internet-explorer-crashing-for-few-users
97. Windows 10 DLL File Information - profapi.dll - NirSoft, accessed May 9, 2025, https://windows10dll.nirsoft.net/profapi_dll.html
98. profapi.dll - Windows 7 DLL File Information, accessed May 9, 2025, https://www.win7dll.info/profapi_dll.html
99. Winlogon and GINA - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/secauthn/winlogon-and-gina
100. GINA - Win32 apps | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/secauthn/gina
101. Windows registry information for advanced users - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/windows-registry-advanced-users
102. In the Windows Registry under ProfileList key there are subkeys for - Microsoft Community, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/all/in-the-windows-registry-under-profilelist-key/63d22f5f-5b65-4267-ad06-f34e6eb86fd8
103. accessed January 1, 1970, https://social.technet.microsoft.com/wiki/contents/articles/1120.user-profile-service-event-id-1509-error-detail-the-system-cannot-find-the-file-specified.aspx
104. accessed January 1, 1970, https://social.technet.microsoft.com/Forums/windows/en-US/708707f1-78fa-4c1e-adf1-916e2d8848d7/meaning-of-profilelist-state-flags?forum=w7itprogeneral
105. Why does my Windows roaming profile always change to a local profile on a particular PC?, accessed May 9, 2025, https://superuser.com/questions/1857066/why-does-my-windows-roaming-profile-always-change-to-a-local-profile-on-a-partic
106. Set roaming profile path for all users – Windows Server | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-roaming-profile-path-all-users-applies-all-acccounts
107. 'You Have Been Logged On With a Temporary Profile' when all profiles have been redirected to a specific location - Weird & Wonderful IT, accessed May 9, 2025, https://www.craig-tolley.co.uk/2015/02/26/you-have-been-logged-on-with-a-temporary-profile-when-all-profiles-have-been-redirected-to-a-specific-location/
108. Scripts to clean profile folder and prevent TEMP user profile creation - Windows Server, accessed May 9, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/scripts-to-cleanup-profile-folder-information-and-prevent-temp-user-profiles-from-being-created
109. Registry keys are not created via Powershell - Microsoft Q&A, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/1667241/registry-keys-are-not-created-via-powershell
110. New files copied, old files not deleted during roaming profile login - Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/2189009/new-files-copied-old-files-not-deleted-during-roam?forum=windowserver-all&referrer=answers
111. ADMX_UserProfiles Policy CSP | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-userprofiles
112. Weird user profile folders in C:/Users - can I delete them? - Microsoft Community, accessed May 9, 2025, https://answers.microsoft.com/en-us/windows/forum/all/weird-user-profile-folders-in-cusers-can-i-delete/6c965099-2046-417a-af70-3c951b443247
113. Share and NTFS Permissions - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/iis/web-hosting/configuring-servers-in-the-windows-web-platform/configuring-share-and-ntfs-permissions
114. Secure | Profile Management 2503 - Citrix Product Documentation, accessed May 9, 2025, https://docs.citrix.com/en-us/profile-management/current-release/secure.html
115. Permissions required for secure roaming profiles & redirected folders – ITProMentor, accessed May 9, 2025, https://www.itpromentor.com/profile-permission/
116. Secure | Profile Management 2411 - Citrix Product Documentation, accessed May 9, 2025, https://docs.citrix.com/en-us/profile-management/current-release/secure
117. Roaming Windows User Profiles - SambaWiki, accessed May 9, 2025, https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles
118. how to enable roaming profile user sign in only one system - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/answers/questions/2185071/how-to-enable-roaming-profile-user-sign-in-only-on
119. Access Control Overview | Microsoft Learn, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/access-control
120. Mandatory profiles NTFS rights – Ivanti Community, accessed May 9, 2025, https://forums.ivanti.com/s/question/0D51B00005BxoOYSAZ/mandatory-profiles-ntfs-rights?language=en_US
121. Sample Chapters from Windows Internals, Sixth Edition, Part 1 - Download Center, accessed May 9, 2025, https://download.microsoft.com/download/1/4/0/14045a9e-c978-47d1-954b-92b9fd877995/97807356648739_samplechapters.pdf
122. Security Briefs: Customizing GINA, Part 2 - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/archive/msdn-magazine/2005/june/security-briefs-customizing-gina-part-2
123. RegLoadKey • Win32 Programmer's Reference, accessed May 9, 2025, http://winapi.freetechsecrets.com/win32/WIN32RegLoadKey.htm
124. RegLoadAppKeyA function (winreg.h) - Win32 apps - Learn Microsoft, accessed May 9, 2025, https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regloadappkeya
125. Critical "SMBleed", Vulnerability: Why Should You Be Worried? - FireCompass, accessed May 9, 2025, https://www.firecompass.com/critical-smbleed-vulnerability-smbghost-risk-analysis/
126. The Srv2.sys breaks when the computer responds to the SMB client in Windows Server 2012 R2 - Microsoft Support, accessed May 9, 2025, https://support.microsoft.com/en-us/topic/the-srv2-sys-breaks-when-the-computer-responds-to-the-smb-client-in-windows-server-2012-r2-e2771056-93d1-7346-0629-0fb9519d0a0b