Moving Users from old to new microscope computer

Page Version: 2026-08-12

Problem: A microscope is getting a new computer or a new operating system, provided by the microscope manufacturer. This means that the operating system and the microscope control software are installed from scratch. All users have to be installed again. Their microscope software settings (filter settings, sequential settings, etc) are lost if they are not copied manually to the new computer. This may keep Core Facility staff busy for weeks if several systems have to be updated at the same time.

Attempted solution: users and their microscope software settings in C:\Users are extracted from the old system and copied to the new system. This is done with scripts as outlined below. 

We need this to update Leica microscopes only (LAS-X 3.X) from Windows 10 to Windows 11, some with new, Win 11 compatible hardware, some on the same hardware. The transfer of users to a new system should work for any type of new Windows installation. The Leica specific subfolder in the respective scripts would have to be adapted however to make it work with systems from other vendors. 

This guide only explains the migration of users. For other changes we make to new microscope computers, please see Routine for a new microscope computer (Win 11).

The scripts used in this guide as well as parts of this overview were generated with the help of AI.

If this page should prove useful to you, I would apreciate a message to dietzel@lmu.de, to estimate if it is worth putting it online.

Please note: As of now this guide is a suggestion! It was tested only on a single widefield system. This note will be deleted once it was successfully applied. 

This web page is work in progress. It may contain inconsistencies!

Overeview

The following steps are performed:

1. With the help of scripts, generate a users.csv file with all users who are to be migrated to the new computer.
2. Copy relevant Leica settings of users to server or external drive.
3. On the new computer, generate user accounts from the users.csv file with temporary passwords. Enable "user must change password". 
4. Copy Leica user settings files to respective users' subfolders
5. Send users their temporary password by e-mail.

Optional: 

• Undo changes on new computer (for test environments).
• Disable users on new computer who never logged in (after some time).

csv stands for "comma separated values". It is a text file that can be edited with any text editor, e.g. notepad or Notepad++.

Downloading Scripts, Running Scripts, and what if they don't

Scripts for Download:

Please read the detailed explanations below before running the scripts. Use them at you own risk. No warranty! Even if the scripts work in our environment they might not in yours. 

Note: This web server does not allow storage of files with the ps1 script ending (for powershell scripts). Therefore .txt is added to each file. Right-click on the link below and use "save as" to download the file. Saving them to a short path (such as C:\scripts) is recommended. The folder where the scripts reside is also where output files (CSVs, logs) will be written by default. The scripts can be edited to use a different folder if required. 

Before running the script, delete ".txt" and replace the "_" before ps1 with a "." (a dot). You can do this during download or after you saved the files to the local disk.

Extracting data from the old computer (2 scripts): 
ExportUsers.ps1 || CopyLeicaSettings.ps1

Creating accounts and Leica settings on the new computer (2 scripts):
CreateLocalUsers.ps1 || RestoreLeicaSettings.ps1

Maintenance on the new computer (2 scripts):
UndoNewComputerSetup.ps1 || DisableInactiveUsers.ps1

How to run a script

To run a script:

• Make sure the file ending is .ps1 (see above)
• The scripts are text files that, if needed, can be modified with any editor, e.g. notepad or Notepad++. For example to change names of output files, directories, etc. Some editors like Notepad++ color code the script, e.g. to distinguish comments from code and generally make the code more readable.
• Right-click on a Powershell Icon and select "run as administrator". If you just double-click the shell will have no administrator rights, even if you are logged in as an administrator! Using an administrator account is anyway strongly recommended. You don't have to enter passwords over and over again and it may avoid other hiccups. 
• In the shell, change to the directory where the script file is saved with e.g. "e:" and cd commands. Start the script with 
  ./scriptname.ps1

If a script does not run (and it probably won't: execution policy)

Default on newer Windows versions is that scripts won't run for security reasons. This restriction has to be lifted (temporarily) to enable the scripts to work.

Try to run the first script on the computer (in step 1 (old computer) or in step 3 (new computer)). If it runs, ignore the rest of this section and continue with step 1 (or step 3). If it does not run and you get an error message that the execution of scripts is not allowed on the system, type the following command that will inform you on the policies on the computer:

Get-ExecutionPolicy -List

• If your computer is part of a domain, executing scripts can be forbidden by Group Policy that overrides local settings. If that is the case the values for MachinePolicy or UserPolicy may show anything other than "Undefined". Restrictions will have to be lifted by the domain administrator. 
• The value for LocalMachine is probably "undefined". This means that scripts are not explicitly allowed and thus forbidden. For extra backup, note the value and copy it down somewhere, but you should not need it (except you accidentally delete the file to which the value is written). This value needs to be set to "Bypass". To do this, execute the following three commands, one by one, read explanations below.

Get-Location
Get-ExecutionPolicy -Scope LocalMachine | Out-File ".\OriginalExecutionPolicy.txt"
Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy Bypass -Force

Get-Location displays the folder to which the output file will be written. If nothing funny happened, this should be the folder to which you navigated before, where the scripts are stored. 

The second command writes the current state of the security policy of the local machine that we need to change into a file. (If paranoid, you can check that the file was indeed created, use "dir", or open it in an editor.)

The third command sets the execution policy of the local machine to allow scripts to run ("Bypass"). The scripts now should run. Be aware that this disables a reasonable security policy. Thus don't forget to re-enable once you are done. 

If all the scripts are done running (on the old and new computer including copying the Leica settings, see below) restore the settings with this command (one line):

$OriginalPolicy = (Get-Content ".\OriginalExecutionPolicy.txt" -Raw).Trim(); Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy $OriginalPolicy -Force

This reads the original setting from the file OriginalExecutionPolicy.txt that was created above and restores the setting. You can check if the value is set back to the original value with 
Get-ExecutionPolicy -List
Should you have lost the OriginalExecutionPolicy.txt you can set the value to "undefined" (or to other values with the respective value changed) with the following command:

Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy Undefined -Force

Step 1: Generating a csv file with all the users that have to be moved to the new computer.

The script

The script ExportUsers.ps1 does the following: 

• Makes sure the output folder exists, creating it if needed. The unchanged script will write files to the folder where the script itself is stored. 
• Reads every local Windows user profile on this computer.
• Excludes built-in Windows accounts (Administrator, Guest, etc.).
• Excludes any account that has admin rights! Thus typical microscope manufacturer and maintenance accounts are ignored. This behavior can be changed with the setting ($MigrateAdmins) at the beginning of the script.
• For every remaining user, generates a random temporary password in the format StartPasswordX, where X is some random characters that can be typed directly on a German/US/UK keyboard. See "Temporary password generator" in the script if you need to get rid of some of those symbols for your keyboard layout.
• Sorts every user into exactly one of two groups — never both:
• Logged on within the last 6 months (number of months can be changed in script)
• Everyone else (older, or never logged on)
• Writes three files to the output folder, each tagged with this computer's name so files from different machines don't get mixed up:
• Users_Last6Months_<computer name>.csv (Name is adapted if you set script to other than 6 months)
• Users_Other_<computer name>.csv
• Users_All_<computer name>.csv — the two lists above combined into one (recent users first, then the others), with no user appearing twice
• Within each file, users are listed newest-login-first.
• At the end, prints how many users were written to each of the three files.

See above for how to run a script. 

Create final user file (manually)

Create a file that contains only those users that should be transfered to the new system. Presumably these are mostly those who were logged in in the last 6 months. So that file is used as starting point and users are deleted and added as needed.

Note: In the following Step 2 the (unchanged) script CopyLeicaSettings.ps1 uses the automatically-generated 'all users' file to export all Leica user files, just in case they might be needed, and not the file created in this section. Accordingly, you can run Step 2 at any point after ExportUsers.ps1. You will need the manually curated file only in Step 3. 

The created csv files are formatted as follows:

Name,FullName,Password,LastLogon
mueller,Max Müller,StartPassword,2026-06-14 08:17:52
schmidt,Anna Schmidt,StartPassword,2026-04-21 13:55:08
meier,Peter Meier,StartPassword,2026-01-30 09:11:44

• If you indeed wish to migrate all users, copy(!) the file Users_All_<computer name>.csv and rename the copy Users_<computer name>.csv. (If you rename the original, Step 2 is not going to work!) Else: 
• Open Users_Last6Months_<computer name>.csv in a text editor (e.g. notepad) and review each line. Delete lines with users that are not needed any more. Save the file as Users_<computer name>.csv.
• Open Users_Other_<computer name>.csv and see if any of those users should be added to Users_<computer name>.csv. 
• Optional: This would be a good occasion to correct "FullName" where applicable
• Optional (if time allows): Send all users of old computer e-mail, ask if they still need the account or not. Adapt Users_<computer name>.csv accordingly.

Step 2: Copy Leica user settings on old computer to a temporary location

In a standard configuration, the Leica user files (e.g. sequential settings) are stored in 
C:\%username%\AppData\Roaming\Leica Microsystems\LAS X
AppData is a hidden folder and therefore may not be visible in the File Explorer. You still can navigate there if you type in the path manually (or copy the path from above).

The script CopyLeicaSettings.ps1 will copy the user's LAS X folder with all files in it for all users listed in Users_All_<computer name>.csv (see previous section). Thus, to be on the safe side, all users' profiles will be copied, not only profiles from users that are actually migrated. Make sure this script is in the same folder as the previous one, so that it will find the file. 

If not changed at the beginning of the script, the Leica files will be copied to a subfolder of the folder in which the scripts are stored called OldUsers_<computer name>, as in 
<folder with scripts>\OldUsers_<computer name>\<username>\AppData\Roaming\Leica Microsystems\LAS X

The target directory also can be changed at the beginning of the script. A log file CopyLeicaSettings.log is created in the folde of the scripts. 

Caution: A user's Leica folder may contain unexpected large amounts of data! For example, LAS_X_SMD\UserHelpEnglish may contain gigabytes of help files. This folder is therefore actively excluded in the script but there may be others that we have missed. Accordingly, depending on the free space and the number of users, writing to C:\ bears the risk of filling up the system partition if this script (and only this one) is located in e.g. C:\scripts and the directories are on default settings, . 

In detail, the script does the following:

• If the scripts are located on the C: drive, warns that the backup could fill the system drive and asks for confirmation before continuing. Typically the backup is just a few megabytes, but in one case help files were included and the resulting size was several Gigabytes. The folder in which those help files were is now specifically excluded. The exclusion list can be edited in the script. 
• Creates the destination folder OldUsers_<computer name> in the script's folder if it doesn't already exist, and checks that it's actually writable.
• Checks whether the log file already exists, and asks whether to overwrite it or abort
• Starts writing the log file, and prints a note explaining that each user's robocopy summary will show one "skipped" directory (this is normal, not an error), and where the detailed per-file log will be written.
• Looks for a file named Users_All_<computer name>.csv in the directory where the script is stored. If not found, gives an error explaining that ExportUsers.ps1 needs to be run first.
• If the file is found, shows its name and asks for confirmation before continuing.
• Before reading a user's Leica settings, makes sure the script has full read access to their profile folder (taking ownership if needed), since even an Administrator can otherwise be blocked by restrictive folder permissions on some machines.
• Goes through the CSV file one row at a time, and for each user: if that user has Leica LAS X settings on this computer, copies them to the defined location; if not, notes that and moves on.
• Writes detailed, per-file copy information for every user into a separate file (RobocopyDetails.log), so the main log stays readable.
• At the end, shows and logs a summary: how many users' settings were copied, not found, or ran into errors.

Note 1: This script uses robocopy /MIR. The parameter MIR deletes everything in the target that is not present in the source. This may lead to unexpected results if the script is run twice on the same system with different Users_<computer name>.csv. If you need to run the script again, best delete the content of the target directory first. 

Note 2: If the new computer will get the exact same name under Windows as the old one (i.e. the microscope name), after copying the Leica files is a good time to rename the old computer, e.g. to name_old. If two computers with the exact same name are in the same network at the same time, this can cause diverse issues. 

Note 3: If you are really in the process of exchanging computers (and not doing a test run), this may be a good time to deinstall a PPMS tracker (if installed) and copy the ppms.vbs file together with the other data to the new computer.

Step 3: Create Users from csv File on new Computer

The csv file with the users to be migrated (Users_<computer name>.csv, end of Step 1) is copied to the new computer and used by the script CreateLocalUsers.ps1 to create those users on the new computer. The file Users_<computer name>.csv must be in the same folder as the script. Log files will be written to the same directory.

For this script to work, the group "Users" must have the right "Log on as a batch job", so the script can initialize each new account's Windows profile automatically. This right is not granted by default on all systems and can be set up as follows:

In a PowerShell with admin rights (see above) type secpol.msc. This opens a new window "Local Security Policy".

• Go to Local Policies → User Rights Assignment
• Double-click "Log on as a batch job" (in German Windows: Anmelden als Stapelverarbeitungsauftrag). The properties dialog "Log on as a batch job" will open. 
• In the new window, check the short list in the box, does it contain "Users" (in German Windows: Benutzer)? If it does, you can skip the rest of this procedure. But it probably does not, so continue: 
• Click on "Add User or Group..."
• Click on Object types, top right and in the new window check if the "Groups" box is checked. If not, do it and click ok.
• Back to the previous window (Select users or groups), go the the text box and type "Users".
• Click on "Check Names". This should result in a change of the entry just made to COMPUTERNAME\users. 
• Click on OK and again on OK
• The properties dialog "Log on as a batch job" should now show "Users" in the list in the box. 

• Checks whether log file already exists, and asks whether to overwrite it or to abort.
• Starts a log file that records everything the script does.
• Looks for the file Users_<computer name>.csv. The computer name is filled in automatically. You will have to change the name of the file if the old and new computer have a different name. If the file is found, shows its name and asks for confirmation before continuing.
• Goes through the CSV file one row at a time, and for each row:
• Skips it with a warning if the username is empty (e.g. a stray blank line in the file).
• Skips it if a local account with that name already exists on this computer.
• Otherwise, creates a new local user account with the name, full name, and password from that row.
• Adds the new account to the local Users group.
• Initializes the account's real Windows user profile in the background (without requiring the user to log on themselves), and checks that it was created correctly.
• Forces the account to require a password change at the next logon and verifies that the change took effect.
• Records the newly created account in a separate undo file (CreateUsers_Undo_<computer name>.csv), so afterwards it is clear which accounts this run created.
• At the end, shows and logs a summary: how many accounts were created, how many were skipped, and how many errors occurred.

Note: While the script sets "User must change password on next log on" and checks it automatically, you also can set and check it manually (e.g. in case the log says it did not work): Go to Computer Administration->Local users and groups->Users ->right click->preferences of user and see if the respective checkmark is set. If not, set it.

Step 4: Copy Leica user settings files to respective user subfolders on new computer

This step is best made before users that were created as described above logged in. If a login of the user did happen and some Leica settings already exist, the script asks per user whether to skip or overwrite. Still, this script may overwrite some settings. I thus strongly discourage using this script for admin accounts, to avoid any potential problems. 

This script RestoreLeicaSettings.ps1 assumes that Users_<computer name>.csv is in the same folder as the script and the Leica settings copied from the old computer are in a subfolder called OldUsers_<computer name>. This can be adapted at the beginning of the script. If old and new computers have different names, the file name must be adapted to the new computer's name. 

The script does the following:

• Checks whether the log file (RestoreLeicaSettings.log) already exists, and if so asks whether to overwrite it or abort.
• Starts writing the log file, and prints a note explaining that each user's robocopy summary will show one "skipped" directory (this is normal, not an error).
• Checks that source is available. Standard is the subfolder OldUsers_<computer name>. The folder can be changed at the start of the script code. 
• Reads Users_<computer name>.csv from the script's directory (the computer name is filled in automatically). If the file is found, shows its name and asks for confirmation before continuing.
• Before touching a user's profile, makes sure the script has full read/write/delete access to it (taking ownership if needed), since even an Administrator can otherwise be blocked by restrictive folder permissions on some machines.
• Goes through the CSV file one row at a time, and for each user copies the Leica files from the source. Except: If the user already has Leica settings on this computer (e.g. they already logged in and started LAS-X), warns that continuing will permanently delete those existing files, and asks whether to skip this user or delete the existing files and proceed.
• Two log files are created in the script's folder: RestoreLeicaSettings.log with human-readable output and RestoreLeicaDetails.log which contains detailed, per-file copy information for every user, so the main log stays readable.
• Records every user whose settings were successfully restored into a separate undo file (RestoreLeicaSettings_Undo_<computer name>.csv), noting whether any pre-existing files were deleted first (which, if so, cannot be recovered).
• At the end, shows and logs a summary: how many users had settings restored, skipped, not found, or ran into errors.

Step 5: Send users their temporary password

Send an individual e-mail to all users from Users_<computer name>.csv with the temporary password and ask them to change it on the next login. Ask them to report any problems they might encounter. If users have accounts on more than one processed computer, possibly send passwords of all of them in one mail. 

Undo

The undo script is supposed to undo changes that were made to the new computer in Steps 3 and 4, CreateLocalUsers.ps1 and RestoreLeicaSettings.ps1. Hopefully you will have no reason to try this on the microscope computers. Undo may be useful if you tested those scripts on a test machine. For example, before running a second test you wish to undo the accounts created in the previous one. 

On the old computer, only files were generated, and possibly the policy changed. Both must be undone manually, if desired. 

Warning: If a user already had Leica settings on the new computer and they were deleted and overwritten in step 4, the deleted files cannot be restored. 

To solve some open file issues, the computer must reboot after steps 3 or 4 before the undo-script can be used. Otherwise there may be "file in use" errors on recently-used profiles.

Download script UndoNewComputerSetup.ps1 (right-click, save as). See top of page on how to make it executable. 

This script does the following:

• Checks that it is running with Administrator rights, and stops with a message if not.
• Checks whether its log file already exists, and asks whether to overwrite it or abort script.
• Reads the two undo files written earlier by CreateLocalUsers.ps1 and RestoreLeicaSettings.ps1:
• CreateUsers_Undo_<computer name>.csv, expected in the directory where the script is located, by default (change at beginning of the script if needed).
• RestoreLeicaSettings_Undo_<computer name>.csv, expected in the directory where the script is located by default, can be changed in the script.
  
  If neither file exists (or both are empty), it stops immediately — there is nothing to undo.
• Shows exactly what it is about to do — which accounts (and their whole profile) will be fully removed, and which users will only have their restored Leica settings removed — and requires you to type UNDO in capital letters to proceed. This is a destructive action, so it does not accept a simple Y/N here.
• For every account that CreateLocalUsers.ps1 actually created: removes the account and its entire Windows user profile (not just the account) — this also removes any restored Leica settings automatically, since they live inside that profile.
• For any user whose account already existed before the migration (so it wasn't created by these scripts) but who had Leica settings restored into it: removes only the restored settings folder. The account itself, and everything else in their profile, is left untouched.
• At the end, shows and logs a summary of how many accounts/profiles were removed, how many settings-only removals happened, and any errors.

Some weeks later... 

There is a good chance, that some of the users that are transferred to the new system will not log on. Either never, because they left, or not within a reasonable time span. In both cases it is desirable to disable the accounts to avoid that the start password remains valid for too long. The script DisableInactiveUsers.ps1 does exactly that. Note that disabling is not the same thing as deleting. Disabling means the user cannot login any more but all the information is still there. The account can be reactivated by an admin at any time. 

Best copy the script to the location of the other scripts, e.g. C:\scripts. Started in an admin-Powershell, this script does the following: