User Profile seems to reset constantly

I have a user on my domain that when she logs out, her profile seems to get removed and recreated. First it was C:\Users\Username, then Username.Domain, then Username.Domain.000, and the numbers kept going up and up.

I copied the data out of those folders to a safe folder, removed the user profiles and their folders, then had the user log in again to recreate a fresh one. I copied the data back to her new profile, and things seemed to be good.

This weekend passed, and she logged in again this morning to a fresh desktop. I checked the Application Logs, and I saw a weird entry:

Windows Search Service indexed data for user "<domain>\<Username>" successfully removed in response to user profile deletion. I've never seen this issue before, so I Googled. I found out we are supposed to delete the profile from HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList, but I'd like to find the actual cause of this issue. Why is the profile getting deleted? I'm not seeing anything else in the Event Log relating to this.

Canadian Luke

Posted 2015-01-12T17:48:41.263

Reputation: 22 162

Does this user always use the same device to log into the domain? – Ramhound – 2015-01-12T17:53:06.173

Same device, connected via Ethernet cable - So, no wireless interference, and no weird travelling machine syndrome – Canadian Luke – 2015-01-12T18:05:04.573

As you have a backup of user files I'd probably cut your losses trying to resolve it and re-image the workstation. The problem is linked to Windows trying not to lose your data by creating temporary profiles. It isn't deleting them. This is a preventative measure by Microsoft. You can fix it by following the registry fix ("ProfileList"). It will be a mismatch of profile loaded and actual profile location. – Kinnectus – 2015-01-12T18:41:46.437

Answers

So there were two possibilities that caused this: the first was a Group Policy setting, the second was a start up script malfunctioning.

For the Group Policy, check under Computer Configuration -> Administrative Templates -> System -> User Profiles. There are two options there to check: Delete cached copies of roaming profiles and Delete user profiles older than a specified number of days on system restart. I changed both of these back to Not Configured.

Secondly, the startup script that ran only half-assed the profile deletion. I removed the script as well, and the profiles stuck.

Canadian Luke

Posted 2015-01-12T17:48:41.263

Reputation: 22 162

I've seen roaming profiles do this when connection/authentication to the server is lost. Local profile issues like this can be indicative of hard disk errors or permissions.

Scott

Posted 2015-01-12T17:48:41.263

Reputation: 1

I've run chkdsk c: /f /r, and no errors there. It shouldn't be a roaming profile, as we don't use a Windows Server, just Samba with a simple /home folder for each user. – Canadian Luke – 2015-01-12T21:34:18.883

Username and Username.Domain are caused by logging in with a local account and a domain account with the same name (and possibly the same password). I've only seen the .000 used when there is an profile corruption, deletion and recreation, or a user rename followed by creating a user the old name again (basically any time windows tries to create a profile and there is already one using that path--often because profile paths are NOT renamed when the username is changed).

James

Posted 2015-01-12T17:48:41.263

Reputation: 1 029

But the issue is that her stuff is simply GONE, as in, not even in C:\Users anymore – Canadian Luke – 2015-01-13T06:11:24.370

Did you install the OS yourself from retail discs? There are many setups where admins intentionally set up this behavior to happen on every logout or on a schedule. – James – 2015-01-13T13:35:39.043

I am the admin, and none of my other systems have this behavior from the same image running on 90 other systems – Canadian Luke – 2015-01-13T15:38:33.600

+1 on your question, then. That's very strange. – James – 2015-01-13T19:27:37.087