registry assistance please

Archived from groups: microsoft.public.windowsnt.registry (More info?)

First, i know all about what microsoft says about cloning. And yes this is
XP not NT but I have had this on NT units as well. I thought I would also
post this to this group so maybe some veteran NT registry expert can shed
some light on what is going on with this issue and how to fix. (short of
reinstalling)

I need to know HOW to remove duplicate SID keys from the registry under
HKLM/software/microsoft/windows nt/current version/profilelist

Sometimes I see 2, or 3 and as many as 5 or 6 duplicate SID keys under this
entry linking to both local accounts and domain accounts.
This presents a problem when viewing userprofiles using the User Profile
tool as I see the user listed multiple times.

The registry key
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F4 only shows the
user ONCE but the Profile List key shows the SID multiple times.


Usually I find the SID farm growing after several of these Ghost/Clone
proceedures are done on an image.

Master copy, syspreped, then image made to new system. Then the new system
is brought up. After the new system configured and updated (usually if
patches are applied i will take the new system and make a new image from the
clone replacing the outdated image. I usually have gone through several
iterations on replacing the Master Image with subsequent Clone Images.
Occasionally I will get an error after going through the sysprep wizard
after the SID is generated that an "Error occured in the registry and a
recovery was made from a back up copy. Thus is when I see another duplicate
SID is born in the registry and in the User Profile tool.

When I delete the first listing of the user from the userprofile tool, the
second, third, and sometimes fourth key will not delete.

Also, I have posted the below information as well to Windows XP Security
news group but no one has posted any answers.


~~~~~~~~~~~~~~~~~~~~

I have a XP image that has been cloned (ghosted) several times. After
creating a new image on a new PC, when I go into the Profile managment tool
(my computer>properties>advanced>userprofile) I see 4 or more entries for
the
same profile. And this is happining on Domain Account Profiles as well.
Lets say User1 is the local administrator. When I log on as
USer1, I see 4 entries in the user profile tool but only one folder in
Documentss and settings. I then log on as User2 (also have admin rights) and
delete User1 entires. Only the first entry actually deletes the folder,
then
deleteing the others an error is generated (file not found) but the entry
disappears. After verifying that the list is cleaned up and profile folder
removed I log off User2 and log on as User1. When logging back on as User1
the 4 multiple entries return to the user profile list, and only 1 folder is
created. I suspect that the folders were deleted manually without using
the
profile tool and has left stray keys in the registry somewhere. Any
thoughts
as to where these keys may reside and/or how to clean this up so only one
entry shows in the profile tool and one folder on C????

In addition to this, I have under the registry key,
HKLM/software/microsoft/windows nt/current version/profile list
duplicate SID keys.

If the profile exist, I can open each key.
If the profile has been deleted, the extra keys remain.
If I delete one key, I then can't open / delete the two other duplicate keys
which remain. The profile also disappears from the list in the profile
management tool.

I would like to clean this up. Even if I delete the username and recreate
it, it will fix the duplication of the keys but the old duplicate keys in
the registry can't be cleaned up. least i don't know how to delete them...

Additional Note: This also happens when I use sysprep.exe in several chain
sucessions. instead of ghost.
Seems that the keys in the profileList subkey can't be deleted manually if
the profile is removed. Even when editing the registry in /interactive
mode.