Mysterious User Profiles Deleted
Results 1 to 7 of 7

Thread: Mysterious User Profiles Deleted

  1. #1
    Member
    Join Date
    Aug 2003
    Posts
    37

    Question Mysterious User Profiles Deleted

    Hello group,

    Can you help with a situation we have? Thanks in advance.

    Situation

    User logs onto a windows domain (server NT 4.0)
    User workstation Windows 2000
    User logs onto workstation and uses standard email (outlook) and word etc. Settings and desktops are set to the way the user likes them to be. All OK.

    Now...Here comes the problem

    User logs off workstation
    Administrator logs onto workstation
    Administrator logs off of workstation
    User logs onto workstation the next morning
    Desktop appears as the default (new) user
    IE wizard has to be used to access internet
    .pst and email configuration missing in action
    Cannot locate the .pst file on the server or the local system

    We are suspicious that the user may be deleting profile (this is the fourth time this event has happened)
    Any ideas? Tools to determine if profile and file deletion has taken place?


    Thanks again.



    DarkCarniv0l

  2. #2
    Senior Member
    Join Date
    Oct 2002
    Posts
    1,130
    I would have to say that since the administrator account is the only one to access the computer between the user logons, there is no other possibility. The administrator account must be being used to delete profiles, or maybe perhaps the user him/herself is and blaming the administrator. A hex editor can tell you if files have been deleted by looking at the MFT tables, but that can get quite technical. I'm sure somebody here knows of a good free low level file recovery utility... hey, I could use one too as a matter of fact! I would definitely check the file permissions on the profile directory, see if anyone else has access to this user's directory. If not then it's only a question of who has access to the accounts used when these files could have been deleted. But as for deletion logs, I don't think they exist. Somebody correct me if I'm wrong.
    Government is like fire - a handy servant, but a dangerous master - George Washington
    Government is not reason, it is not eloquence - it is force. - George Washington.

    Join the UnError community!

  3. #3
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,192
    Hi,

    Does this only happen on one machine? and for one user? if yes:

    I would try a little experiment:

    Re-install WIN2k on the users machine
    Create a new profile for the User

    If administrator is not killing anyone else's profile then either the WIN2K installation and/or the user profile is corrupt?


    Cheers
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  4. #4
    Senior Member VicE$DoS$'s Avatar
    Join Date
    Nov 2002
    Posts
    209
    So im not on my own... exact same thing happened to us here..

    Very interested to see how this pans out.

    Cheer$
    V$D$
    I remember when Nihil was ickle. Does that mean I'm old?

  5. #5
    Member
    Join Date
    Aug 2003
    Posts
    37

    Question

    Nihil,

    Yes this only happens on one machine. Thank you all for your efforts. I would love to find out what the root cause of this issue is.

    Regards,



    DarkCarniv01

  6. #6
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,192
    Hi DarkCarniv0l

    I have had this with NT4.0 SP5, but not since.......we never found the cause...MS don't acknowlede that there was a problem.

    If you turn some of the WIN2K files into .txt and read them, you will see it referred to as "NT5"...I guess that this is some sort of intermittent bug carried forwards?

    I personally suspect that it might have something to do with "roaming profiles" failing to reset correctly............but that is a real wild guess.


    Good luck
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  7. #7
    Member
    Join Date
    Aug 2003
    Posts
    37

    Smile

    Thanks to everyone who responded. A very nice group!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides