1

Running this command rundll32 sysdm.cpl,EditUserProfiles will display the 'User Profiles' window showing details about the profiles stored on that machine. The speed at which this screen loads suggests this data is stored somewhere locally versus generated on the fly.

I'm seeking to understand where this data located so it could be retrieved programmatically as querying Win32_UserProfile only provides a subset of the data, and I'm specifically looking for the profile size versus calculating it manually.

JuliusPIV
  • 178
  • 1
    There really isn't a great deal of data when it comes to user profiles. However, all information about a user profile is contained within the appropriate registry hive. – Ramhound Mar 28 '19 at 14:16

2 Answers2

1

folder sizes aren't specifically stored anywhere as a variable, they are calculated when you right click -> properties on the 'c:\users' profile folder. Any location or subset data you need will be found in the registry under this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

If you need to collate a list of profile sizes, it would be best to query 'c:\users'. powershell would be my first go-to for this. Note also that the 'c:\users' location will only contain the complete profile if roaming profiles is not enabled and that you are not using a folder redirection policy, otherwise you would need to query the location they are stored in.

If you are interested in the powershell method, please see below link. This will detail how to use the folder-size module then you will just need to add in the folder name for identification. An off the shelf product which will be able to grab this for you is called 'spacesniffer' - run this againt your c:\users and it will provide you with a graph showing different shape sizes for each profile and you can even export that into a file if need be.

edit: forgot link https://www.gngrninja.com/script-ninja/2016/5/24/powershell-calculating-folder-sizes

spacesniffer: http://www.uderzo.it/main_products/space_sniffer/

RhysPickett
  • 112
  • I guess I'm just surprised at how quickly the system is able to calculate the sizes of the user profiles on the machine. If I were do do it manually or even programmatically it takes longer than it does to simply open that screen. – JuliusPIV Mar 28 '19 at 18:46
  • You can decompile the .dll in Jetbrains dotPeek to get further clarification on how the command works, from what I can see it's using a checksum of the currently initialised data on disk, hence you will see different sizes in the user profile contents (c:\users) and the command you are running (initialised data). – RhysPickett Mar 29 '19 at 09:30
1

Warning: The topic is too broad to explain in short Q&A. Those who are interested, go through the whole sysdm folder in ReactOS repository.

Here I sum up the procedure from Windows 10. I get the details from BOOL EditUserProfiles(HWND hWndParent) function in sysdm.cpl file.

  1. It opens HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList registry key with RegOpenKeyExW() and enumerates all the sub-registry key in it.

  2. ProfileImagePath registry value provides %UserProfile% folder path.

  3. From that path, FindFirstFileW() gets last modified time and date.

  4. Sid provides Security IDentifier. Each registered users has its own unique SID. From that SID value, LookupAccountSidW() provides user name, domain name etc.

  5. Many more...

Community
  • 1
Biswapriyo
  • 11,179
  • Ohh I appreciate the deep dive here along with the methods used :) makes total sense! Many thanks for this. – JuliusPIV Mar 28 '19 at 18:46