Author: Andrae Snegirev

Objective: Safely identify and remove cached Entra ID user profiles on local Windows devices to free up disk space and resolve profile issues.

Note on net user:
The standard net user command only queries the local Security Account Manager (SAM) database. Because Entra ID users authenticate against the cloud, Windows does not create a local SAM account for them, making them invisible to net user. The methods below must be used instead.

1. How to View Profiles via PowerShell
To get a quick list of all user profiles currently cached on a machine, run the following command in an elevated PowerShell prompt.
Entra ID profiles can be identified by their SID, which always begins with S-1-12-1.

Get-CimInstance Win32_UserProfile | Select-Object LocalPath, SID

2. How to Safely Remove Profiles via PowerShell
WARNING: Never delete a user’s folder directly from C:\Users. Doing so leaves orphaned SID entries in the registry (ProfileList). If that user logs into the device again, Windows will fail to load their profile and force them into a temporary profile (C:\Users\TEMP).

To cleanly wipe both the file system directory and the associated registry keys, run PowerShell as an Administrator and use the Remove-CimInstance command.

Method A: Remove by SID (Recommended)
Copy the SID from the viewing step and run:

Get-CimInstance Win32_UserProfile | Where-Object { $_.SID -eq "S-1-12-1-YOUR-SID-HERE" } | Remove-CimInstance

Method B: Remove by Folder Path
If you prefer to target the exact folder name located in C:\Users:

Get-CimInstance Win32_UserProfile | Where-Object { $_.LocalPath -like "*\TargetUsername" } | Remove-CimInstance

3. Essential Diagnostic Commands: quser and dsregcmd
Before removing a profile or when troubleshooting an Entra ID login issue, you should use these two built-in command-line tools to understand the current state of the machine.
Checking Active Sessions with quser
While Get-CimInstance shows you every profile saved on the disk, it doesn’t tell you if the user is currently using the machine.
Run this in CMD or PowerShell:

quser

• What it does: Displays all currently active or disconnected login sessions on the machine.
• Why use it: Always run quser before deleting a profile to ensure the target user doesn’t currently have a locked/disconnected session running in the background. You cannot cleanly delete a profile that is actively loaded into memory.

Checking Cloud Connectivity with dsregcmd /status
If an Entra ID user is failing to log in, or their profile isn’t syncing properly, the issue might be with the device itself rather than the user profile.
Run this in CMD or PowerShell (no admin required):

dsregcmd /status

• What it does: Outputs the complete Azure AD/Entra ID registration status of the local device.
• What to look for:
  • AzureAdJoined : YES (Under Device State): Confirms the machine is successfully joined to the client’s cloud tenant.
  • AzureAdPrt : YES (Under SSO State): Confirms the user has a valid Primary Refresh Token. If this says NO, the user’s cloud credentials are out of sync or expired, which will break access to local Office apps and OneDrive.

Appendix: The GUI Method
If technicians prefer a visual interface, or if you are doing a bulk cleanup on a single machine, use the native Windows tool:

1. Open the Run dialog (Win + R) or CMD.
2. Type sysdm.cpl and press Enter.
3. Navigate to the Advanced tab.
4. Under the User Profiles section, click Settings.
5. Select the target profile from the list and click Delete.

This executes the same safe removal process as the PowerShell commands above.