October 2nd, 2003, 08:19 AM
Mysterious User Profiles Deleted
Can you help with a situation we have? Thanks in advance.
User logs onto a windows domain (server NT 4.0)
User workstation Windows 2000
User logs onto workstation and uses standard email (outlook) and word etc. Settings and desktops are set to the way the user likes them to be. All OK.
Now...Here comes the problem
User logs off workstation
Administrator logs onto workstation
Administrator logs off of workstation
User logs onto workstation the next morning
Desktop appears as the default (new) user
IE wizard has to be used to access internet
.pst and email configuration missing in action
Cannot locate the .pst file on the server or the local system
We are suspicious that the user may be deleting profile (this is the fourth time this event has happened)
Any ideas? Tools to determine if profile and file deletion has taken place?
October 2nd, 2003, 08:38 AM
I would have to say that since the administrator account is the only one to access the computer between the user logons, there is no other possibility. The administrator account must be being used to delete profiles, or maybe perhaps the user him/herself is and blaming the administrator. A hex editor can tell you if files have been deleted by looking at the MFT tables, but that can get quite technical. I'm sure somebody here knows of a good free low level file recovery utility... hey, I could use one too as a matter of fact! I would definitely check the file permissions on the profile directory, see if anyone else has access to this user's directory. If not then it's only a question of who has access to the accounts used when these files could have been deleted. But as for deletion logs, I don't think they exist. Somebody correct me if I'm wrong.
Government is like fire - a handy servant, but a dangerous master - George Washington
Government is not reason, it is not eloquence - it is force. - George Washington.
Join the UnError
October 2nd, 2003, 09:28 AM
Does this only happen on one machine? and for one user? if yes:
I would try a little experiment:
Re-install WIN2k on the users machine
Create a new profile for the User
If administrator is not killing anyone else's profile then either the WIN2K installation and/or the user profile is corrupt?
October 2nd, 2003, 03:54 PM
So im not on my own... exact same thing happened to us here..
Very interested to see how this pans out.
I remember when Nihil was ickle. Does that mean I'm old?
October 2nd, 2003, 04:48 PM
Yes this only happens on one machine. Thank you all for your efforts. I would love to find out what the root cause of this issue is.
October 2nd, 2003, 06:32 PM
I have had this with NT4.0 SP5, but not since.......we never found the cause...MS don't acknowlede that there was a problem.
If you turn some of the WIN2K files into .txt and read them, you will see it referred to as "NT5"...I guess that this is some sort of intermittent bug carried forwards?
I personally suspect that it might have something to do with "roaming profiles" failing to reset correctly............but that is a real wild guess.
October 3rd, 2003, 08:17 AM
Thanks to everyone who responded. A very nice group!