1

Some users on my domain gets their user-profile deleted. This happened to Few Users.

No related event logs, although their workstation restart and then the deletion happens. The Whole Account folder gets deleted

9 Spice ups
2

I feel like this should be under the Windows section maybe.

What operating system is on your client computers impacted by this?

Your domain controller(s)?

What’s your domain functional level?

Do you have any setting defined for this GPO: Computer Config >> Policies >> Admin Templates >> System >> User Profiles >> Delete user profiles older than a specified number of days on system restart?

  • If not, you might want to define that GPO setting and change it to Disabled
3

Hi and thanks for the query - I have moved this post into both the General Windows and AD forums. I hope you get a great answer.

1 Spice up
4

Hi there,

is only the userfolder deleted or the whole account?
Do you use folder redirection?

1 Spice up
5

If auditing is enabled and the whole account is deleted then this article can help you How to Find Who Deleted a User Account in Active Directory

To restore AD objects you can follow this article Restore Deleted Active Directory Objects using Recycle Bin

6

The whole accounts get deleted

7

So when u go under “control->system->advanced->userprofiles” you do not see any other users than the local admin?

Any chance Kiosk mode is active?
You may try to create a local user account, reboot and see if this will get deleted too.

As there are no errors in eventlog i’d go for some kind of “planned” deletion. Script/kiosk mode or smth similar.

1 Spice up
8

I would also recommend running an RSOP to see if there are any GPOs applying that may be causing the behavior by design.

Are the impacted users / computers in the same OU in AD as any non-impacted users / computers?

1 Spice up