?
Solved

Windows 2008 Server has a current profile of a user that left the company

Posted on 2012-03-26
9
Medium Priority
?
293 Views
Last Modified: 2012-08-13
I have a Windows 2008 Standard server that has a local profile with a Modified date of today for a user that has left the company weeks ago and their account was disabled in AD.

Under what conditions could this profile be for today?
0
Comment
Question by:iNetSystem
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 122
ID: 37767936
No services on that server using the Account?

Check local event logs?

Server Backup?
0
 
LVL 9

Accepted Solution

by:
Geodash earned 2000 total points
ID: 37767946
Take a look at this article. The OS can be modifying something within the profile, even if it is not being used.

http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2rds/thread/c97f17a0-e711-413b-a2f0-8b30717ca627
0
 

Author Comment

by:iNetSystem
ID: 37767950
No services at all on the system using the account.  The event logs truncated as of early this morning.  I do have a backup but am suspicious.  In AD the user is disabled and has a Modified date of weeks ago.  The Server however shows a current profile as of today.
0
U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

 
LVL 9

Expert Comment

by:Geodash
ID: 37767960
0
 
LVL 9

Expert Comment

by:Geodash
ID: 37767970
You can also look here - if you are suspicious - and see when the account was actually last logged in

http://technet.microsoft.com/en-us/library/dd378867(v=ws.10).aspx
0
 

Author Comment

by:iNetSystem
ID: 37767983
Thank Geodash -
I use ManageEngine AD Manager and actually it reports the "Last Real Logoin" as the same date that the account shows in the Objects tab.
0
 

Author Comment

by:iNetSystem
ID: 37768573
any other ideas?
0
 
LVL 9

Expert Comment

by:Geodash
ID: 37768831
So the account has not been logged in or has recently?
0
 

Author Comment

by:iNetSystem
ID: 37801874
correct - the account is actually disabled in AD yet the profile continbues to report the current date.
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Auditing domain password hashes is a commonly overlooked but critical requirement to ensuring secure passwords practices are followed. Methods exist to extract hashes directly for a live domain however this article describes a process to extract u…
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial steps you through the configuration steps to configure your ESXi host Management Network settings and test the management network, ensure the host is recognized by the DNS Server, configure a new password, and the troubleshooting…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question