Mysterious User Profiles Deleted

Hello group,

Can you help with a situation we have? Thanks in advance.

Situation

User logs onto a windows domain (server NT 4.0)
User workstation Windows 2000
User logs onto workstation and uses standard email (outlook) and word etc. Settings and desktops are set to the way the user likes them to be. All OK.

Now...Here comes the problem

User logs off workstation
Administrator logs onto workstation
Administrator logs off of workstation
User logs onto workstation the next morning
Desktop appears as the default (new) user
IE wizard has to be used to access internet
.pst and email configuration missing in action
Cannot locate the .pst file on the server or the local system

We are suspicious that the user may be deleting profile (this is the fourth time this event has happened)
Any ideas? Tools to determine if profile and file deletion has taken place?


Thanks again.



DarkCarniv0l

I would have to say that since the administrator account is the only one to access the computer between the user logons, there is no other possibility. The administrator account must be being used to delete profiles, or maybe perhaps the user him/herself is and blaming the administrator. A hex editor can tell you if files have been deleted by looking at the MFT tables, but that can get quite technical. I'm sure somebody here knows of a good free low level file recovery utility... hey, I could use one too as a matter of fact! I would definitely check the file permissions on the profile directory, see if anyone else has access to this user's directory. If not then it's only a question of who has access to the accounts used when these files could have been deleted. But as for deletion logs, I don't think they exist. Somebody correct me if I'm wrong.

Hi,

Does this only happen on one machine? and for one user? if yes:

I would try a little experiment:

Re-install WIN2k on the users machine
Create a new profile for the User

If administrator is not killing anyone else's profile then either the WIN2K installation and/or the user profile is corrupt?


Cheers

So im not on my own... exact same thing happened to us here..

Very interested to see how this pans out.

Cheer$
V$D$

Nihil,

Yes this only happens on one machine. Thank you all for your efforts. I would love to find out what the root cause of this issue is.

Regards,



DarkCarniv01

Hi DarkCarniv0l

I have had this with NT4.0 SP5, but not since.......we never found the cause...MS don't acknowlede that there was a problem.

If you turn some of the WIN2K files into .txt and read them, you will see it referred to as "NT5"...I guess that this is some sort of intermittent bug carried forwards?

I personally suspect that it might have something to do with "roaming profiles" failing to reset correctly............but that is a real wild guess.


Good luck

Thanks to everyone who responded. A very nice group!