1

End user couldn’t login to pc after lunch so she did a forced reboot by holding the power button down until the pc turned off. When she logged back into Windows it went through the “Getting Things Ready For You” setup as if it were a fresh install or new user sigining in for the first time. All of her documents, folders, wallpapers,etc…are missing. There is no deleted user profile that I can see // and no windows.old folder. Her SID is NOT duplicated in the registry.

We have a GPO to delete user profiles if not logged in within 60 days, but she has been using this computer for the past year with no issues until now.

38 Spice ups
2

If she’s not getting the ol’ “User has been logged in with a Temporary profile” error and her existing profile has all the data then I’m not sure what is going on there. I’d need to know what your “[we] delete user profiles if not logged on for 60 days” thing is doing exactly. Maybe she was ignoring an error? Check your event log and see if there are some old errors that maybe she was ignoring (like the above) that the feature update has not corrected and deleted her data.

3 Spice ups
3

Its a built in Group Policy Object under Computer config>Policies>Administrative Templates, to "Delete user profiles if no activity in ‘X’ number of days. (A day being 24 hours). It sounded like she may have been using a temp profile, but I don’t know for how long and if that’s the case then there’s nothing I can do anyway…

2 Spice ups
4

So if you login as administrator and go to ThisPC>open it up click on C:Drive>User Profiles you dont see her profile in there?

If it is then just recreate there windows profile.

4 Spice ups
5

Restore from Backup

3 Spice ups
6

Have you tried recovering to the last known restore point? You never know.

Also, you could install recuva or some such tool and look for deleted files

7

is there any company having backups of every users workstation? I doubt it.

Shadow copies for the C drive is maximum “backup” i have ever seen for regular client PC,s. Higher ups excluded.

1 Spice up
8

The problem with last known is that it resets when you hit a desktop. so this would be a toss of a coin :smiley:

1 Spice up
9

Us. We use Synology Active Backup for Business in incremental with de-duplication. The daily increment usually takes less that 5 minutes. We have lot’s of mobile users across the world who frequently need to use the C drive as a persistent internet connection is not available throughout the day.

Restoring a user profile would be challenging if the C:\Users%username% folder is still there are it would appear to be a registry problem.

1 Spice up
10

Oh wow. how many devices you have to backup this way?

11

About 200, takes less disk space than our server backups. There is a user portal for users to pick and choose files to recover and we can also use a bootable Synology USB to reimage a system as per a specific backup.

12

Looking in c:\Users are there 2 user folders with the same name one with a .domain name after it? Administrator and Administrator.domain1 for example. Do you have Roaming profiles setup? Typically if the SID is broken the data is still in the Users folder you can relink it or copy it over…

1 Spice up
13

Oh nice. a self service restore solution. Thats cool.
Yeah user profiles are not that big mostly so it should not take that much free space.

14

If the registry is fine and there is no existing user profile, I would say look for deleted or hidden files. If the profile got hidden, do a malware scan, on her computer at least on everything they have access to would be best. If you can’t find it there it’s probably gone and they have been using a temp profile for awhile. Hopefully they saved documents and things to a network drive or one drive cause it’s time to start over.

15

My guess is the user has been on a temporary profile, ignored the message stating that, and never logged out. At lunch, the computer finally rebooted and now all that temporary profile stuff is gone. That would stink if that’s the case!

2 Spice ups
16

You can try the portable version of Shadow explorer and see if there is a shadow copy of the profile.

17

Sadly, that happens more often than I like.

“It kept saying “something” but I don’t remember what it was…”

1 Spice up
18

So, if you have any kind of folder redirection enabled in your GPO (like desktop/document is sent to \server%username%\desktop/documents) then you might want to log in as a local administrator and go to C:\Windows\CSC and see if you can find any of the data there. If they were using a temporary folder for a month because they just kept ignoring an error then it may have never synced anything to the server but stored everything in offline files. When you make a new profile it leaves everything behind in there if it doesn’t sync. You might get lucky and find a bunch of the users documents in the Offline Cache.

To recover, just take ownership of the folder and copy everything out that you want.

1 Spice up
19

Yep! I’ve begged users to just snap a picture of the message with their phone so I can at least see what it said.

20

The first thing I thought of is that she logged in with a local profile instead of a domain profile, and it created a new user because her creds are good. That happened to me when I was very green.

Since you checked a best answer, was the policy in error? Was the user ignoring something?

1 Spice up