Answer
A practical approach used during major upgrades has been exporting base and user profiles together from a test/upgrade environment during a planned lockout window, rather than handling each user individually — treat this as a bulk operation to schedule deliberately (with users locked out) rather than something to script live against an active environment.