How Windows XP Roaming User Profiles Synced Data

Roaming User Profiles in Windows XP allowed domain users to maintain a consistent desktop environment, personal files, and application settings across any networked workstation. This article explains the underlying synchronization mechanism, covering how Active Directory, Server Message Block (SMB) network shares, and local system processes coordinated the download of user data at logon, maintained it during an active session, and uploaded changes upon logoff.

The Infrastructure Configuration

The synchronization process relied on a centralized architecture combining Active Directory (AD) and standard SMB file shares:

  • Active Directory Attribute: Network administrators configured the profilePath attribute in the user account properties (e.g., \\ServerName\Profiles$\%username%).
  • Central File Server: A dedicated network share hosted the folders containing each user's profile files and folders.
  • Local Storage: The local client machine stored user data in the C:\Documents and Settings\%username% directory.

The Logon Synchronization Process

When a user logged onto a Windows XP machine joined to an Active Directory domain, the synchronization sequence executed as follows:

  1. Authentication and Path Discovery: The Winlogon process authenticated the user credentials via Kerberos or NTLM against a domain controller. Upon successful authentication, the local system queried Active Directory to retrieve the user's configured roaming profile UNC path.
  2. Local Cache Evaluation: Windows XP checked C:\Documents and Settings\ for an existing local copy of the profile. If found, the operating system compared timestamps between the local profile and the copy residing on the network share.
  3. Data Download:
    • If the user was logging into the machine for the first time, the entire profile folder structure was copied from the network share to the local hard drive.
    • If a cached profile existed, Windows XP performed a reconciliation check, downloading only the files that were newer or missing on the server compared to the local cache.
  4. Registry Hive Loading: The user's registry hive file, NTUSER.DAT, was copied locally and loaded into the registry under the HKEY_CURRENT_USER (HKCU) tree.

Session Behavior

During an active session, Windows XP did not continuously synchronize changes to the file server over the network.

All reads, writes, and modifications occurred strictly within the local file system at C:\Documents and Settings\%username% and in the loaded memory of the registry. Operating entirely out of the local cache prevented network bottlenecks and ensured that applications performed at local disk speeds rather than relying on network latency.

The Logoff Synchronization Process

The primary sync mechanism occurred when the user initiated a logoff:

  1. Application Termination and Hive Unload: Windows XP closed all running applications and user-level processes. The operating system flushed pending registry writes to the local NTUSER.DAT file and unmounted HKEY_CURRENT_USER.
  2. File Comparison and Reconciliation: The User Profile Service compared the local profile directory with the server share. Windows XP identified files that were created, modified, or deleted locally during the session.
  3. Upload to the Share: The operating system copied updated files and the modified NTUSER.DAT back to the central network share via SMB. Files deleted locally were deleted from the server copy.
  4. Local Cache Retention: By default, Windows XP retained the local copy of the profile in C:\Documents and Settings\%username% to speed up future logons on that specific machine, unless Group Policy was configured to delete cached copies upon logoff.

Exclusions and Conflict Resolution

Windows XP included specific mechanisms to prevent synchronization errors and reduce network overhead:

  • Exclusion Lists: Non-roaming directories, specifically the Local Settings folder (which contained application temporary files, history, and the Internet Explorer cache), were excluded from the sync process by default. These remained strictly local to the specific computer.
  • Conflict Resolution: If a user logged into multiple computers concurrently, Windows XP used a "last write wins" policy. The workstation that logged off last overwrote any conflicting files or registry entries on the central server.