Monday, February 04, 2013 5:22 PM
I have a Windows 2008 R2 AD domain, with several 2008 R2 file servers (member servers). On one of these file servers I have noticed that a few domain users have local profiles under c:\Users. These profiles appear to be empty, and again, very few users have them.
I know that they have not logged into the console of the server (they don't have physical access and we restrict Users from logging in locally)... Does anyone have any idea what would be responsible for creating these profiles?
Tuesday, February 05, 2013 4:45 AM
Hi Dasani, a profile is create on local login or RDP's login only.
Please check the security log for login attemp. The fact it's empty is strange on the other hand, maybe some failed attemp, but it would not create a profile.
Thursday, February 14, 2013 9:50 PM
Thanks for the info (and sorry for my late response), however I have yet to find the reason for these profiles.... The logs are pretty busy on this server, but I will check to see if I can find anything. As I mentioned above, these users do not have access to the console of the server, and the RDP ports are protected by the firewall. I will post a follow up if I ever find anything out.
Thursday, February 14, 2013 10:14 PM
my guess is that the box was retasked from a ts role at some point. Possibly someones lab machine.
check the folder creation dates AND talk to the builder.
After making all your companies required and practical logging methods for this item: Delete the folders and audit the folder structure later
Friday, February 15, 2013 2:43 AMI agree with CountryStyle, a profile can't be created unless a user logon into that server. For that filter the security's log and delete those folder. Maybe an admin that tested to log with user credential to test something.