Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Windows 2008 Server has a current profile of a user that left the company

Posted on 2012-03-26
9
Medium Priority
?
298 Views
Last Modified: 2012-08-13
I have a Windows 2008 Standard server that has a local profile with a Modified date of today for a user that has left the company weeks ago and their account was disabled in AD.

Under what conditions could this profile be for today?
0
Comment
Question by:iNetSystem
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
9 Comments
 
LVL 124
ID: 37767936
No services on that server using the Account?

Check local event logs?

Server Backup?
0
 
LVL 9

Accepted Solution

by:
Geodash earned 2000 total points
ID: 37767946
Take a look at this article. The OS can be modifying something within the profile, even if it is not being used.

http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2rds/thread/c97f17a0-e711-413b-a2f0-8b30717ca627
0
 

Author Comment

by:iNetSystem
ID: 37767950
No services at all on the system using the account.  The event logs truncated as of early this morning.  I do have a backup but am suspicious.  In AD the user is disabled and has a Modified date of weeks ago.  The Server however shows a current profile as of today.
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 
LVL 9

Expert Comment

by:Geodash
ID: 37767960
0
 
LVL 9

Expert Comment

by:Geodash
ID: 37767970
You can also look here - if you are suspicious - and see when the account was actually last logged in

http://technet.microsoft.com/en-us/library/dd378867(v=ws.10).aspx
0
 

Author Comment

by:iNetSystem
ID: 37767983
Thank Geodash -
I use ManageEngine AD Manager and actually it reports the "Last Real Logoin" as the same date that the account shows in the Objects tab.
0
 

Author Comment

by:iNetSystem
ID: 37768573
any other ideas?
0
 
LVL 9

Expert Comment

by:Geodash
ID: 37768831
So the account has not been logged in or has recently?
0
 

Author Comment

by:iNetSystem
ID: 37801874
correct - the account is actually disabled in AD yet the profile continbues to report the current date.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question