winprofile-guard

Windows signed you into a temporary profile. This puts the real one back — and stops it happening again.

When Windows cannot load your user hive it renames your ProfileList entry to <SID>.bak and signs you into a blank TEMP profile. Your data is still on disk — only the pointer moved. Every guide tells you to make a new account. This repairs the pointer instead, at boot, before you notice.

Nothing is ever deleted. A conflicting entry is renamed to <SID>.broken-<timestamp> and kept. Leftover TEMP folders are reported, never removed.

What's in here

Script	Purpose
ProfileGuard.ps1	The watchdog. Restores a .bak profile entry and logs a health summary
Install-ProfileGuard.ps1	Registers the watchdog at boot + a daily hive backup, as SYSTEM
Backup-UserHive.ps1	Saves NTUSER.DAT / UsrClass.dat, one copy per weekday
Harden-ProfileStability.ps1	Fixes the root causes: Modern Standby and services holding the hive open
Undo-Hardening.ps1	Reverts the hardening
Uninstall-ProfileGuard.ps1	Removes both scheduled tasks

Use it

Look before you leap — this reports what it would repair, changes nothing:

powershell -ExecutionPolicy Bypass -File .\ProfileGuard.ps1 -ReportOnly

Already stuck in a TEMP profile? Run it for real from an elevated prompt, then sign out and back in:

powershell -ExecutionPolicy Bypass -File .\ProfileGuard.ps1

Then make it permanent (elevated):

powershell -ExecutionPolicy Bypass -File .\Harden-ProfileStability.ps1
powershell -ExecutionPolicy Bypass -File .\Install-ProfileGuard.ps1 -UserName <your-user>

Reboot. From then on the watchdog runs 30 s after every boot, and a copy of your hive is saved daily to C:\ProgramData\ProfileGuard\hive-backup.

What the hardening changes

Both root causes, explained properly in docs/root-cause.md:

1. Modern Standby (S0ix) — the laptop never truly sleeps, drains flat in a bag, and dies with the hive open. Switched to real hibernation; Fast Startup disabled.
2. Services holding the hive at sign-out — GamingServices / GamingServicesNet re-open HKU\<SID> during sign-out so Windows cannot unload it. Set to Manual, plus DisableForceUnload = 0 so Windows may force the unload.

It also enables EnablePeriodicBackup (which brings RegBack back to life) and runs a read-only chkdsk /scan. A restore point is created first, and everything is reversible with Undo-Hardening.ps1.

If you play Game Pass titles, expect to start the Xbox app manually — that is the trade this makes.

Verifying it works

Get-Content C:\ProgramData\ProfileGuard\guard.log -Tail 20
schtasks /query /tn ProfileGuard /fo LIST

The log gets a --- guard run --- block after every boot. No block means the task did not fire — Install-ProfileGuard.ps1 reads its own registration back for exactly this reason, and reports a silent failure instead of assuming success.

Requirements

Windows 10/11, PowerShell 5.1, administrator rights. The watchdog and the backup task run as SYSTEM.

License

MIT — see LICENSE. Registry surgery, run at your own risk; read the scripts first.

---

🇹🇷 Türkçe: README.tr.md