Link to home
Start Free TrialLog in
Avatar of iNetSystem
iNetSystemFlag for United States of America

asked on

Windows 2008 Server has a current profile of a user that left the company

I have a Windows 2008 Standard server that has a local profile with a Modified date of today for a user that has left the company weeks ago and their account was disabled in AD.

Under what conditions could this profile be for today?
Avatar of Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Andrew Hancock (VMware vExpert PRO / EE Fellow/British Beekeeper)
Flag of United Kingdom of Great Britain and Northern Ireland image

No services on that server using the Account?

Check local event logs?

Server Backup?
ASKER CERTIFIED SOLUTION
Avatar of Geodash
Geodash
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of iNetSystem

ASKER

No services at all on the system using the account.  The event logs truncated as of early this morning.  I do have a backup but am suspicious.  In AD the user is disabled and has a Modified date of weeks ago.  The Server however shows a current profile as of today.
You can also look here - if you are suspicious - and see when the account was actually last logged in

http://technet.microsoft.com/en-us/library/dd378867(v=ws.10).aspx
Thank Geodash -
I use ManageEngine AD Manager and actually it reports the "Last Real Logoin" as the same date that the account shows in the Objects tab.
any other ideas?
So the account has not been logged in or has recently?
correct - the account is actually disabled in AD yet the profile continbues to report the current date.