1

Morning All

Very odd issue happening this morning.

So far 4 users have come back from leave.

They logged onto their Windows 10 Laptops, domain password reset request, then logged into what appears to be a brand new user profile.

All user files have been deleted, outlook asks for a new profile set up etc. Temp files not older than todays date - literally as if it is a brand new set up.

9 Spice ups
2

Need a little more, are you using local or roaming profiles?

Or maybe local profiles with folder redirection to a server?

If you reset your password will you get a new profile when logging into the same machine?

When you log onto these laptops as the user does a message appear down the bottom saying that you were logged on with a temporary profile (this can be caused by a lot of things)?

On the laptops, what do you find under C:\Users, does the users’ data still exist?

3

Hi @grahamenglish ​

  1. ONLY local profiles, no roaming or redirection

  2. Will test reset now

  3. No message, no temp folders, no temp profiles in c:Users

  4. NO DATA at all in the users folder :frowning:

4

That is bizarre, you sure they aren’t pranking you with new laptops?

So what you are saying is that everything was removed, so if you look at the C:\ drives they have only the standard ~25GB used for windows and program files as all user data has been removed, or does it appear that the drives are still relatively full? As if the data has been moved or hidden?

The only occurrence I know of for multiple computers to lose files is after that one Windows 10 update that wreaked some havoc not too long ago.

5

Yeah first thing I checked was that update, but was blocked on wSUS and no updated since last year for these machines.

HDDs have the space :frowning:

It’s incredibly odd. Going through GPs now to see if its that. Can’t find anything.

6

Well good luck, maybe someone else here have come across this issue before, to at least stop it from happening again. If you don’t have backups of the user files all I can recommend for now is GetDataBack or Recuva (free) to get some of the data back before the laptops are used too much and the data overwritten.

-Sterkte en mooi dag verder-

1 Spice up
7

Dankie Meneer

8

Out of interest - it was an entire partition that was ‘lost’ according to EaseUS on the one HDD i am testing

9

Is there a group policy set up to expunge a profile after it isn’t used on a PC for so long? i.e. there is a policy that can remove a user profile from pc if that user hasn’t logged on to the pc for 14 days

It seems likely since all of the affected users ‘came back from leave’.