Meaning of values under HKLM\SOFT....\ProfileList Key

[sergeys]

Hello Everybody.

I am writing a little script that prestages local profiles on new computers. One of the steps is to create a bunch of values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\SidXXX\ key. Some of these values are self explainatory, but others are not. It seems that I've walke to the end of the Google trying to find out what these values mean and what their valid content should be:

Flags
CentralProfile
RefCount
RunLogonScriptSync
OptimizedLogonStatus

Any help and links are greatly appreciated.
Thanks.

 

[tiath]

Any luck finding the meaing of all keys/values? I'm looking to pre-create profiles without first having the user logon. I can do this but I might be creating issues down the line because I don't know the purpose of all of the registry values found in ProfileList\SID..

Any info you have is appreciated.

Regards

 

[sergeys]

This is all I could find.

Profile structure and procedures:

http://technet2.microsoft.com/windo...5064-470e-a281-0eb1c28b9cf01033.mspx?mfr=true

Profiles and SIDHistory

http://technet.microsoft.com/en-us/library/bb727127.aspx

When formulating your domain restructure plan, you should be aware of the implications of migrated users having new SIDs on profile use.
When a user logs on to a Windows NT workstation, the system loads a profile for that user containing user-specific configuration information. The system locates this profile by picking up the user's SID and looking in the registry under the key HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows NT\CurrentVersion\ProfileList for a key named after the string representation of the user's SID.
An implication of this behavior is that users logging onto their workstations after migration might lose access to their logon profiles, because their primary SIDs will have changed and their old profiles will be stored under their old primary SID.
When a user has been moved between Windows 2000 domains in the same forest using a tool such as MoveTree, this will not be a problem because MoveTree preserves the user's globally unique identifier (GUID). A new feature of the profile handling code in the Windows 2000 client takes advantage of this invariance of the GUID, so that on failure to find a user's SID in the ProfileList key, the system will retrieve the user's GUID and look in the registry under the key HKEY_LOCAL_MACHINE \SOFTWARE \Microsoft \Windows NT\CurrentVersion\ProfileGuid for a key named after the string representation of the user's GUID. If it finds such a key, it will search it for a value called the SidString, which provides a fallback mapping of the user's GUID to the user's SID. The system can then look under the ProfileList key for the SID contained in SidString, and if it finds it, rename the key to the string representation of the user's new SID. The system will in this case also change the SidString value.
From the above description, you can see that you could lose profiles in the following cases:

http://www.nowa.cc/showthread.php?t=136348

?????: ??????? ?????? ??????????

????? ?? ???????? ????? ? ??????????????? ?????? ??????? ??????, ??????? ?? ????????, ? ???? ? ????? ???? ???? ? ???????? ????? ????? .bak - ????? ??? (?????? .bak !). ? ???? ?? ????? ? ????????? RefCount ??????? 1 ?????? 0, ? ????????? State ?????? ?????? 0x00000100(256) - ????????????? ?????????? ??????????????, ???????? OptimizedLogonStatus ?????? ?????? ?????? 0x0000000b(11). ?????? ????? ???????????????




HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\<SID> contains a State Value Name, a REG_DWORD data type, that is a bit mask whose value indicates the state of the local profile cache.
Hex Mask Description
0001 Profile is mandatory.
0002 Update the locally cached profile.
0004 New local profile.
0008 New central profile.
0010 Update the central profile.
0020 Delete the cached profile.
0040 Upgrade the profile.
0080 Using Guest user profile.
0100 Using Administrator profile.
0200 Default net profile is available and ready.
0400 Slow network link identified.
0800 Temporary profile loaded.

 

[tiath]

Your goal may be somewhat different that mine but I found though experimentation that I can get the SID key for any user from AD (using any number of tools including GetSid.exe from the resource kit) and pre-creating a SID key under ProfileList. This allows me to run a script I have created that will point the new / pre-created profile to an existing profile. My concerns were that I didn't and still don't how the values in the SID key are used and what effect this might have down the road. I have found the following article where someone is saying that you can delete all subvalues other than the ProfileImagePath and then logon as the new user. In my testing this re-creates MOST but not all sub-values. One missing value is the GUID value. (would like to know how the GUID value is used)

http://www.tech-recipes.com/windows_tips1409.html

If I can pre-create the profile using the user's SID then I can create their profile without having them logon first or my knowing their pwd. We are doing a weekend conversion of sorts and if we must logon to each profile then that will be a problem.

Perhaps this is useful to you or someone else.

 

[sergeys]

Guid value is used in case there is no matching sid. If windoze can't find sid (as if a sid got changed during cross-domain migration within same forest, but guid didn't change), it will get the guid, and look up sid histroy. Sid history keeps old sids for an object.

Hope that helps.

And this:

http://technet.microsoft.com/en-us/library/bb727127.aspx

 

[sergeys]

Found some more:

If you lose access to your profile folder, Windows creates a new profile folder for you, and places it in the Documents and Settings folder by default. Windows attempts to use your user name as the name of the new profile folder. However, if the old profile folder still exists, Windows modifies the name of the new folder to avoid duplicating the name of the original profile folder. In this scenario, you may see multiple profile folders for your user profile. The following information describes the default naming scheme that Windows 2000 uses for user profiles:
• If the username folder does not already exist, the new profile folder is named:
username
• If the username folder already exists, the new profile folder is named:
username.computername
• If the username.computername folder already exists, the new profile folder is named:
username.computername.000
• If the username.computername.000 folder already exists, Windows uses the next available increment of the username.computername.000 naming scheme.

For example:
username.computername.001