locked
User accounts randomly deleting on login RRS feed

  • Question

  • We are a school district running a blend of 7 pro and 7 enterprise. Every so often, usually most often after a school break, we will receive complaints about user accounts being deleted, as if we were "ghosting" the computers over the break. The user will log in, but all information in their user account will be gone, it is as if they have never logged into that machine before. Is this a known bug and/or is there anything we can do to keep this from happening? 
    Monday, April 6, 2015 6:10 PM

Answers

  • Hi con_man03,

    Have you got any error messages ?
    Have you checked the C:\Windows \Users folder ,is the user profile folder listed here ?

    Please also check the following registry keys for the user account :
    HKLM\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\ProfileList

    If the account has beend removed ,we will get a log recorded in the Event Viewer .
    Please filter the Event Viewer for the Event ID :4726 in the following path .
    Event Viewer \Windows Logs \Security

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    • Proposed as answer by Deason Wu Tuesday, April 28, 2015 9:56 AM
    • Marked as answer by Deason Wu Monday, May 11, 2015 8:07 AM
    Thursday, April 9, 2015 3:10 AM

All replies

  • You mentioned Windows 7 Enterprise, so I am assuming this is a domain...
    Are the profiles that are disappearing from local or domain accounts?
    Are these profiles stored locally, or are you doing profile redirection?

    There is a group policy that can remove stale accounts after 'x' days.

    While not likely, this could also be a script running on the workstation, or someone with Administrative access removing the accounts... Again, doubtful, but possible.

    I have never encountered this, and to my knowledge, this is not a bug.


    www.SteveHardee.com | @SteveHardee


    Monday, April 6, 2015 8:48 PM
  • You are correct in assuming it is in a domain. We do not have that policy in place to delete users after X days. These are not roaming profiles. The profiles are being stored on the local machine on first login. The current set up is the user logs in, and it only will map their user drive. We do not have any other login hooks or anything like that. It is very random, but I have seen this happen on no less than 3 separate occasions, with around 10 machines getting hit, with our most recent one happening yesterday to 5 separate machines in 2 different buildings. I have also heard that if this happens, it will hose every user on that machine. I am just as stumped on this. I have never seen an issue like this until I came to this district a few months ago.
    Tuesday, April 7, 2015 6:10 PM
  • Hi con_man03,

    Have you got any error messages ?
    Have you checked the C:\Windows \Users folder ,is the user profile folder listed here ?

    Please also check the following registry keys for the user account :
    HKLM\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\ProfileList

    If the account has beend removed ,we will get a log recorded in the Event Viewer .
    Please filter the Event Viewer for the Event ID :4726 in the following path .
    Event Viewer \Windows Logs \Security

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    • Proposed as answer by Deason Wu Tuesday, April 28, 2015 9:56 AM
    • Marked as answer by Deason Wu Monday, May 11, 2015 8:07 AM
    Thursday, April 9, 2015 3:10 AM
  • I will have to get back to you about the error messages. We did consider looking into the event log, so knowing what event Id to look for is very helpful. As for the user folder question, yes their user folder is there, there is only 1, so no USERNAME.DOMAIN.001 or anything like that. When I open the user folder, all the folders show a created date as the day this issue happened, with no original data still in the folder. 
    Thursday, April 9, 2015 7:06 PM
  • Hi con_man03,

    How about the issue ,is there anything to update ?

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, April 22, 2015 3:18 AM