Windows/Move Documents and Settings

From braindump
Jump to navigation Jump to search

Windows XP puts all of the user profile data into the %SystemDrive%\Documents and Settings. While this is ok with most settings where you only have 1 disk with one partition sometimes the space on the %SystemDrive% gets smaller and smaller and smaller and can affect system performance. In one particular case I had a much larger D: drive and I wanted to move all the users' data to it. This is how I went about the task.

Proof of concept - move one user

The first thing to do is to login as Administrator and pick a user that can be moved. For the sake of this example we use the fictious user jdoe.

  • Open the registry editor and navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  • Create a backup of the registry path mentioned above by navigating to the File menu and choose Export.
  • Look for the users jdoe by clicking on the folders starting with S-1-5-21-1111111111-222222222-333333333-1XXX. If the number after the last hyphen is 500 it is most likely the Administrator's account. Look for the value of the ProfileImagePath as it will contain the users' name at the very end.
  • Edit the value changing the %SystemDrive% variable to the desired drive letter in our case D:. For our sample user the path should then look something like this D:\Documents and Settings\jdoe.
  • Now create a folder called Documents and Settings under the D: drive.
  • Move the folder jdoe from %SystemDrive%\Documents and Settings to D:\Document and Settings
  • Log out of the Administrator account
  • Log into the account jdoe and check if everything is working as expected.

Move all users

After successfully having moved one users it is time to move the rest of the system. There are 3 steps to the Process.

  1. Backup and Registry change
  2. Directory and File move
  3. Post-change cleanups

Backup and Registry change

  • Download the SetACL tool from helgeklein.com and take a backup of all the permission in the Documents and Settings directory.
SetACL.exe -on "C:\Documents and Settings" -ot file -actn list -lst "f:sddl;w:d,s,o,g" -rec cont -bckp c:\temp\docandset.acl.txt
  • Open the registry editor and navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  • Create a backup of the registry path mentioned above by navigating to the File menu and choose Export.
  • Change every users' ProfileImagePath changing the %SystemPath% to the new driver letter. Note: There is one excpetion user S-1-5-18 is off limits!

Directory and File move

There are a few options to achieve this goal I have only tested the Linux solution hence I can't vouch for the other ones.

Using Linux for moving the files

Using Linux for moving the files will prevent files that are protected under Windows from being moved. However Linux is not best option as it will not honor the NTFS permission commonly known as ACLs of the files. It is also the most labour intensive with as all of the ACLs and attributes have to be restored.

  • Reboot the host with a Linux rescue system disc such as SystemRescueCD
  • Create a directory called /mount and mount the Windows partitions
mkdir -p /mount/{c,d}
ntfs-3g /dev/sda1 /mount/c
ntfs-3g /dev/sda5 /mount/d
  • Copy the date from /mount/c/Documents and Settings to /mount/d/Documents and Settings
rsync -av  "/mount/c/Documents and Settings" /mount/d/
  • To ensure it is working when logging back in we create and __ARCHIVE__ directory under /mount/c/Documents and Settings and move all the previously copied data into it.
cd "/mount/c/Documents and Settings"
mkdir __ARCHIVE__
mv * __ARCHIVE__
  • Reboot into Windows logging into the user previously moved.
  • Change the SetACL backup file replacing \\?\C: with \\?\D: and then use the following command to restore
SetACL.exe -on 'dummy' -ot file -actn restore -bckp c:\temp\docandset.acl.txt
  • Then restore some of the attributes that got lost during the rsync
cd /d "D:\Documents and Settings" 
attrib +H +S /S /D NetworkService
attrib +H +S /S /D LocalService
attrib +H /S /D "Default User"

Using robocopy

Using ntbackup

If there is plenty of diskspace available and no one is in a hurry ntbackup is probably a good solution. But as mentioned without lots of time on your hands this is a no go.

The ntbackup program offers an option to use VSS (SNAP:on) which should guarantee the consitency of more sensitive files. 

ntbackup backup "%SystemDrive%\Documents and Settings" /J "Documents and Settings" /F "d:\docs+set.bkf" /SNAP:on /M normal

Unfortunately ntbackup can not restore from command line.

  • To restore start ntbackup
  • Click on the [Restore and Manage Media] tab
  • Select the docs+set.bkf file and check-mark the Documents and Settings directory for restore.
  • Under Restore files to set it to Alternate location and set the location to D:\
  • Hit [Start Restore]
  • After some testing I found permission are not properly restored. Use the SetACL backup to restore permission properly.

Post-change cleanups

This is probably optional but a good idea to do anyways.

  • Use an advanced registry editor such as RegEditX to search and replace every instance of C:\Documents and Settings\ with D:\Documents and Settings
  • Log out and log in as a user just moved.

Ensure new users will end up on the new drive

For new users to make sure they land on newly created drive we need to change on more Registry entry. For the sake of readability the command has been split onto several lines. Change the /d "" value to the path desired. 

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 
  /v ProfilesDirectory 
  /t REG_EXPAND_SZ 
  /d "D:\Documents and Settings"

Rollback

To roll the above change back run the following commands: 

set sysdrv=SystemDrive
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" 
  /v ProfilesDirectory 
  /t REG_EXPAND_SZ 
  /d "%%sysdrv%%\Documents and Settings"
Retrieved from "https://braindump.bun.ch/index.php?title=Windows/Move_Documents_and_Settings&oldid=689"