Skip to content

Instantly share code, notes, and snippets.

@AlexDev404

AlexDev404/self_destruct.ps1

Last active May 4, 2026 00:43
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save AlexDev404/3f6471ece5b763e0c7d0ebe10a2e12e1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save AlexDev404/3f6471ece5b763e0c7d0ebe10a2e12e1 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. AlexDev404 revised this gist May 4, 2026. 1 changed file with 8 additions and 14 deletions.
    22 changes: 8 additions & 14 deletions self_destruct.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -1,19 +1,13 @@
    # Define the username and profile path
    $username = $env:USERNAME
    $profilePath = "C:\Users\$username"
    # We embed the username directly into the string since -ArgumentList doesn't exist here
    $taskCommand = "Powershell.exe -NoProfile -WindowStyle Hidden -Command `"`$userSid = (New-Object System.Security.Principal.NTAccount('$username')).Translate([System.Security.Principal.SecurityIdentifier]).Value; Get-CimInstance Win32_UserProfile | Where-Object { `$_.SID -eq `$userSid } | Remove-CimInstance`""

    # Create the command to remove the profile via CIM (most reliable)
    $scriptBlock = {
    $userSid = (New-Object System.Security.Principal.NTAccount($args[0])).Translate([System.Security.Principal.SecurityIdentifier]).Value
    Get-CimInstance -Class Win32_UserProfile | Where-Object { $_.SID -eq $userSid } | Remove-CimInstance -Confirm:$false
    }
    $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument $taskCommand

    # Create a scheduled task to run at next logoff
    $taskName = "DeleteProfileTask"
    $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -Command &{$scriptBlock}" -ArgumentList $username
    $trigger = New-ScheduledTaskTrigger -AtLogOff
    Register-ScheduledTask -Action $action -Trigger $trigger -TaskName $taskName -User "SYSTEM" -Force
    # Note: Since -AtLogOff isn't a native parameter,
    # this uses an Event Trigger for User Logoff (Event 4647)
    $trigger = New-ScheduledTaskTrigger -AtLogOn

    Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "DeleteProfileTask" -User "SYSTEM" -Force

    # Self-destruct this script file
    Remove-Item -Path $MyInvocation.MyCommand.Path -Force
    Write-Host "Profile will be deleted on logout. Self-destruct initialized."
  2. AlexDev404 created this gist May 4, 2026.
    19 changes: 19 additions & 0 deletions self_destruct.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    # Define the username and profile path
    $username = $env:USERNAME
    $profilePath = "C:\Users\$username"

    # Create the command to remove the profile via CIM (most reliable)
    $scriptBlock = {
    $userSid = (New-Object System.Security.Principal.NTAccount($args[0])).Translate([System.Security.Principal.SecurityIdentifier]).Value
    Get-CimInstance -Class Win32_UserProfile | Where-Object { $_.SID -eq $userSid } | Remove-CimInstance -Confirm:$false
    }

    # Create a scheduled task to run at next logoff
    $taskName = "DeleteProfileTask"
    $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -Command &{$scriptBlock}" -ArgumentList $username
    $trigger = New-ScheduledTaskTrigger -AtLogOff
    Register-ScheduledTask -Action $action -Trigger $trigger -TaskName $taskName -User "SYSTEM" -Force

    # Self-destruct this script file
    Remove-Item -Path $MyInvocation.MyCommand.Path -Force
    Write-Host "Profile will be deleted on logout. Self-destruct initialized."