Profile Lost When Computer Unlocked

I've run into a bit of an odd situation --

First time I worked with this user, her problem was that she would log into her computer, but her profile would be gone -- Desktop settings, My Documents, Outlook profile, etc. would all be gone. Turned out she was being logged into the default profile because her profile was failing to load for some reason. I ran an AV and spyware scan, cleaned out some stuff, rebooted the computer, and she was able to log in fine, and her profile, settings, and documents were all back as they had been. Problem solved, right?

Well, things ran smoothly for a few days, but then she calls back. She leaves her computer locked every night instead of logging off. She comes in one morning, unlocks her computer, and suddenly she's in safe mode. So I had her reboot the machine, and all was well again. However, I found it quite odd that she was magically in safe mode all of a sudden.

Today, a week later, she just called back. She unlocked her computer again this morning (remember, she always locks it instead of logging off), and her Outlook profile was gone, along with some of her desktop icons. Rebooted machine, all is well again.

So question is -- What the heck could be causing all these weird anomolies? I'm going to VNC into her computer later today to do some more malware scans, but I'm wondering -- could something else be causing all this wacky stuff?

are you using roaming profiles???

What version of windows???

also...tell her to log off at night...this could be the culprit....corrupting the profile

users like to leave things running and open..for days at a time...then wonder why the machine\apps start acting up :rolleyes:


MLF

Hey Hey,

Have you checked logs... or do you have logs at that level? Check the event log... Logons and logoffs, error messages... What appears from the time (roughly) that she locks her computer until she returns the next day.

Is someone trying to screw with her mind... and doing this to screw her up... You don't just magically lock your computer in regular mode and unlock it into safe mode the next day, it doesn't work like that...

Peace,
HT

Why does she leave it switched on.......?

Any "vaguely intelligent" reason?

:D

Quote:

---

You don't just magically lock your computer in regular mode and unlock it into safe mode the next day, it doesn't work like that...

---

Indeed, that's what I thought, doesn't seem even remotely possible. I'm wondering if perhaps she just mistook what she saw, given you have to hit ctrl-alt-delete to unlock or login...She could've thought it was still locked, but actually it had rebooted over night for x reason and she was actually logging in. However, it still begs the question as to why it rebooted automatically into safe mode.

Quote:

---

are you using roaming profiles???

What version of windows???

---

Honestly, I've never even messed with roaming profiles before, I didn't think of that. And it's XP Pro.

AK~ you just know that I am going to say this.............

It could be a hardware issue.........like it overheats a bit, or there are voltage fluctuations in the night?

roamimg profile...if they get too big (users storing every file and folder on the desktop...dont laugh.............it does happen ;) )

can corrupt...or because she is leaving herself logged...on and some process\maintenance runs over night that buggers it up.

MLF

I would check out the following firstly as MF said check if she is using roaming profiles. If it is a roaming profile it may be corrupt. I have found that when that is the case it is better to recreate a totaly new profile.
Then verifiy if she has restrictions on the times when she is allowed to be logged to the computer. It may be that she is only allowed to be logged between 9am and 6pm for example. After this time windows tries to close the session but cant as the it is locked. The result can be a corrupt profile.
Also make sure she is the only one useing her account. I had a situation once where every morning a user complained that his account was changed. After investigateing we found he had gave his account to two other people. Of course they changed the desktop every time they logged.
In any case dont for the usual details OS domain or stand alone ...........

Edit : HTregz actually you can find your self in safe mood coming out a lock. I've seen it happen a couple of time on windows 2K machines. Do you do automatic updates at night. Like roll out patches maybe that try to reboot the computer. Sometimes when you have a machine locked and you do an automatic reboot like that it seems to screws up the profile and shuts down most of the proccess and drivers so windows thinks it is in safe mode. Of course never got microsoft to admit it was happening. Ps lots of post between the time i started typing and posting so some of what i said is already mentioned.

Hi

You could run a memtest86 to see if there are memory issues...

Quote:

---

Software issue or error

Errors generated by software programs can cause a computer to reboot unexpectedly or without warning. If you are running Windows XP see the below section "For Windows XP users" before continuing.

If you are not running Windows XP or following the below steps still cause your computer to reboot without warning. Boot your computer into safe mode, and let the computer run in safe mode. If the computer is still rebooting in safe mode the issue is likely not software related but something else, skip to the next section. If the computer is not rebooting in safe mode it is likely you have software related issue. We would recommend you run through the basic troubleshooting section for your operating system.

For Windows XP users

Windows XP is designed to automatically reboot each time an error occurs. Although this may be nice for errors that do not occur often, users who have a re-occurring error may wish to identify the error to troubleshoot it. Below are the steps on how this feature can be disabled and enabled in Windows XP.

1. From the desktop right click on My Computer.
2. Click the Properties option.
3. In the System Properties window click the Advanced tab.
4. In Advanced click the Settings button under Startup and Recovery.
5. In the Startup and Recovery window uncheck the Automatically restart check box.
6. Click Ok.

Now if the computer generates and error it should not automatically restart and enable you to display any errors your computer may be experiencing.

Hardware issue or error

Any failing hardware component in your computer could cause your computer to unexpectedly generate an error and/or reboot without warning. If you have recently attempted to add a new hardware device, remove that device to make sure it is not causing your issues.

Make sure you are not encountering any hardware conflicts by viewing device manager for errors. Additional information about device manager can be found on our device manager page.

New drivers can also cause this issue, if you have recently performed any hardware driver updates you may wish to try an earlier version of the drivers. Additional information and help with computer drivers can be found on our drivers’ page.

If you have updated drivers and removed any hardware that could be causing this issue and continue to experience random reboots, it's possible that the memory is bad in the computer. Additional information about testing computers memory can be found on document CH000708.

Finally, hardware devices that are not installed properly in the computer can also cause random reboots. Make sure all the cables and expansion cards are connected properly to the computer. The best way to determine this is to disconnect and reconnect all cables and expansion cards.

---

Source

Ok, what I've found so far:

(1) Profile is not roaming.
(2) "Automatically restart" checkbox is already unchecked, so it shouldn't be automatically rebooting due to software errors.
(3) And I found this rather interesting log in Event Viewer:

Quote:

---

USER32
1073
The attempt to unknown SWHITE failed

---

SWHITE, of course, is the user in question. This was logged this morning, around the same time she experienced the lost profile problems.

[edit]
And then this:

Quote:

---

Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

---

Right after this event, there are logs for Event Viewer and various other processes restarting, so there must have been an automatic reboot (though there's no log for an actual successful Windows Update -- looks like it just rebooted anyway). And guess when? Yesterday evening, right after when she would have left her computer.

Then there's Event ID LSASRV, 40961:

Quote:

---

The Security System could not establish a secured connection with the server ldap/server.domain.com/[email protected]. No authentication protocol was available.

---

Are you sure its clean ????

I have seen machines act up when it cant get updates...depending on the OS...

MS has a doc how to open the requests on the ISA\firewall ...as they changed the update site...

The machine will continually try and connect and starts to misbehave when it cant

Mostly I have experieinced this with W2K machines...

Sometimes....its just best to format and reinstall...that way you may be able to glean if it is a hardware issue..

Installs will usually fail with faulty hardware

MLF

Also, Malware will edit your HOSTS file so that the window's updates end up calling Home 127.0.0.1 and this is true for AV software as well, which have automatic update options, so it sounds like something is interfering with the processes.

Run a HJT log and have a look at it or check for any unusual processes in task manager.

So she locks her machine (everything is working normally), then when she comes back the next day the profile is lost?

That to me sounds like a problem with hardware, and software.

If she lost it when she logs in after reboot or logout then I would say the problem is windows. There was a patch that was released awhile back. It had to do with the registry being corrupted for the user this would then generate a new profile on logon.

insist that she LOGS OUT as a minimum

have you ran the updates ?
set auto update to D/L but to install only when you say.....

my first instinct was the auto update failing
suspect S/W corruption

if it's a work machine, and the image is standard
re-image

if the image is not standard, then run a repair with an XP cd
that is to go on till it asks whether you want to install a fresh version OR repair

choose repair