Monitoring User Profile Sizes With uberAgent

The size of user profiles is critical for logon performance, especially in SBC and VDI environments. Bloated profiles lead to slow logons and therefore unhappy users. Here is how to stay on track with your users’ profile sizes with uberAgent’s powerful script execution engine and Splunk.

If you are new to uberAgent’s script execution engine I recommend reading my colleague’s blog article first. It contains all the information you need to get started.

Monitoring Options and Realisation Methods

You have two options for calculating user profile sizes:

1. On the local computer and for the current user(s) only
2. On the file server which hosts a user profile file share for all users

Which option you choose is up to you. We will cover both below.

1. Local Computer

This option is best for fat clients and notebooks, where users typically work with local profiles. The script will be executed by uberAgent on the user’s machine.

I decided to use PowerShell for the job. Below is the script. It gets the profile size and returns the username as well as the size in bytes as a key-value pair.

[Hashtable]$Output = @{}
$ProfileSize = Get-ChildItem -Path $(Join-Path 'C:\Users' $env:USERNAME) -Recurse -Force -ErrorAction SilentlyContinue | Measure-Object -Sum Length
$Output = @{
   'UserName' = $env:USERNAME
   'ProfileSize' = $($ProfileSize.Sum)
}
Write-Output $($Output.Keys.ForEach({"$_=$($Output.$_)"}) -join ' ')

Here is the output for my notebook:

UserName=domin ProfileSize=112288349557

I configured a new timer in the uberAgent configuration, which executes the script every 60 minutes (3600000 milliseconds) in the user’s context. 60 minutes should be sufficient to gather every user at least once per day but also keep the amount of data sent to Splunk small. I also added a start delay of 5 minutes which should be enough to ensure logon profile processing is finished.

############################################
# Timer 10
############################################
[Timer]
Name           = User profile size
Interval       = 3600000
Start delay    = 300000
Script         = powershell.exe -executionpolicy bypass -file "C:\Program Files\vast limits\uberAgent\Scripts\Get-UserProfileSize.ps1"
ScriptContext  = UserSessionAsUser

In addition to local computers, the script can also be used on terminal servers. uberAgent executes it for each user session and thus determines the profile size for each logged on user.

2. User Profile Share

This option is best for SBC and VDI environments, where users often work with roaming profiles stored on a file server. The script needs to be executed on the file server, hence you have to install uberAgent on it. The script will then enumerate all profile directories and return their names and sizes as key-value pairs. You can also use it to monitor the size of redirected user data if you are using folder redirection.

Again, I used PowerShell. The script is a little bit more complex for this option.

PARAM
(
    [Parameter(Mandatory=$true)]
    [ValidateNotNullOrEmpty()]
    [string]$Share
)

[Hashtable]$Output = @{}
Get-ChildItem -Path $Share | ForEach-Object -Process {
    $DirectorySize = Get-ChildItem -Path $PSItem.FullName -Recurse -Force -ErrorAction SilentlyContinue | Measure-Object -Sum Length
    $Output = @{
       'DirectoryName' = $($PSItem.Name)
       'DirectorySize' = $($DirectorySize.Sum)
    }
    Write-Output $($Output.Keys.ForEach({"$_=$($Output.$_)"}) -join ' ')
}

You can find a sample output below. This could easily be extended with further useful information like the directory’s last modified timestamp.

DirectoryName=user01 DirectorySize=112288349557
DirectoryName=user02 DirectorySize=1065937039508
DirectoryName=user03 DirectorySize=956380045

The configuration entry looks slightly different this time. I chose an interval of once per day, start delay is not needed and the script context has to be SYSTEM. Note that the script expects a parameter for the file share.

############################################
# Timer 10
############################################
[Timer]
Name           = User profile sizes
Interval       = 86400000
Script         = powershell.exe -executionpolicy bypass -file "C:\Program Files\vast limits\uberAgent\Scripts\Get-SubdirectorySizes.ps1" -Share "\\fileserver\profileshare"
ScriptContext  = Session0AsSystem

Purify The Data

The Splunk search result for the first option looks as follows:

However, the profile size in bytes is not very user-friendly. With Splunk’s powerful Search Processing Language, we can convert bytes to gigabytes.

index=uberAgent sourcetype="uberagent:script:user profile size" | eval ProfileSizeGB = round(ProfileSize / (1024*1024*1024),2) | table UserName ProfileSizeGB

Conclusion

Determining user profile sizes is another great example of uberAgent’s script execution engine. You are not limited to the dashboards we ship by default but can extend your monitoring solution as you want.

About uberAgent

The uberAgent product family offers innovative digital employee experience monitoring and endpoint security analytics for Windows and macOS.

uberAgent UXM highlights include detailed information about boot and logon duration, application unresponsiveness detection, network reliability drill-downs, process startup duration, application usage metering, browser performance, web app metrics, and Citrix insights. All these varied aspects of system performance and reliability are smartly brought together in the Experience Score dashboard.

uberAgent ESA excels with a sophisticated Threat Detection Engine, endpoint security & compliance rating, the uAQL query language, detection of risky activity, DNS query monitoring, hash calculation, registry monitoring, and Authenticode signature verification. uberAgent ESA comes with Sysmon and Sigma rule converters, a graphical rule editor, and uses a simple yet powerful query language instead of XML.

About vast limits

vast limits GmbH is the company behind uberAgent, the innovative digital employee experience monitoring and endpoint security analytics product. vast limits’ customer list includes organizations from industries like finance, healthcare, professional services, and education, ranging from medium-sized businesses to global enterprises. vast limits’ network of qualified solution partners ensures best-in-class service and support anywhere in the world.