{"id":1579,"date":"2014-09-30T17:44:30","date_gmt":"2014-09-30T13:44:30","guid":{"rendered":"https:\/\/rakhesh.com\/?p=1579"},"modified":"2014-09-30T17:45:12","modified_gmt":"2014-09-30T13:45:12","slug":"recreating-windows-profiles-internet-explorer-passwords","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/recreating-windows-profiles-internet-explorer-passwords\/","title":{"rendered":"Recreating Windows profiles; Internet Explorer passwords"},"content":{"rendered":"

I had to recreate a user’s Windows profile the other day and made the novice mistake of removing the profile from his computer by just deleting the folder from c:\\Users<\/code>. Not a good idea coz that leaves all the registry stuff behind. The correct way to remove his profile would have been to go via the System properties, User Profiles, and then delete the profile. If it complains about the folder not being removed, then<\/em> remove the folder. <\/p>\n

What happened in my case since the registry stuff was still leftover is that Windows wouldn’t create a new profile folder because it thought the profile folder had an error. It kept logging the user in with a temporary profile and complained so: “You have been logged on with Temporary profile”.<\/p>\n

Worse, I always thought HKEY_USERS<\/code> was where all the registry stuff was stored so that’s where I kept looking to try and delete the registry bits manually. Finally I realized<\/a> it’s under HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList<\/code> – doh! HKEY_USERS<\/code> only has the registry hives for actively loaded profiles – not necessarily the one logged in interactively, but also user accounts running in the background or that have recently run (via “run as” etc). <\/p>\n

So I went to HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList<\/code>, found the profile (which now had a .bak<\/code> suffixed to it), deleted it (because I want him to start afresh), and that got things working again. <\/p>\n

After recreating the profile the user told me he wanted his Internet Explorer saved passwords. These are stored under HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2<\/code> but I hadn’t saved his HKCU<\/code> hive before deleting the profile. Not a problem – I had a backup of the profile folder, so I:<\/p>\n

    \n
  1. Copied the NTUSER.DAT<\/code> file from there to my computer (NTUSER.DAT<\/code> is basically the HKCU<\/code> hive for his account), <\/li>\n
  2. Loaded it into my registry<\/a> as a temporary hive,<\/li>\n
  3. Exported ...\\Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2<\/code> from this temporary location to a .reg<\/code> file, <\/li>\n
  4. Opened this file in notepad and renamed the root to HKEY_CURRENT_USER<\/code>.<\/li>\n<\/ol>\n

    I then sent the .reg<\/code> file to the user and once he opened it the passwords were imported into his registry. <\/p>\n

    Here’s the command I ran from an elevated command prompt to load the ntuser.dat<\/code> file to a temporary location HKLM\\TempHive<\/code>:<\/p>\n

    reg.exe load HKLM\\TempHive .\\ntuser.dat<\/pre>\n
    Using the above temporary location, I had to rename HKLM\\TempHive<\/code> to HKEY_CURRENT_USER<\/code> once I exported the key and opened in notepad. <\/p>\n","protected":false},"excerpt":{"rendered":"
    I had to recreate a user’s Windows profile the other day and made the novice mistake of removing the profile from his computer by just deleting the folder from c:\\Users. Not a good idea coz that leaves all the registry stuff behind. The correct way to remove his profile would have been to go via … Continue reading Recreating Windows profiles; Internet Explorer passwords<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[85],"tags":[271,272,269,270,133],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1579"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=1579"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/1579\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=1579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=1579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=1579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}