Solved

Windows 2008 Server has a current profile of a user that left the company

Posted on 2012-03-26
9
287 Views
Last Modified: 2012-08-13
I have a Windows 2008 Standard server that has a local profile with a Modified date of today for a user that has left the company weeks ago and their account was disabled in AD.

Under what conditions could this profile be for today?
0
Comment
Question by:iNetSystem
  • 4
  • 4
9 Comments
 
LVL 118
ID: 37767936
No services on that server using the Account?

Check local event logs?

Server Backup?
0
 
LVL 9

Accepted Solution

by:
Geodash earned 500 total points
ID: 37767946
Take a look at this article. The OS can be modifying something within the profile, even if it is not being used.

http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2rds/thread/c97f17a0-e711-413b-a2f0-8b30717ca627
0
 

Author Comment

by:iNetSystem
ID: 37767950
No services at all on the system using the account.  The event logs truncated as of early this morning.  I do have a backup but am suspicious.  In AD the user is disabled and has a Modified date of weeks ago.  The Server however shows a current profile as of today.
0
 
LVL 9

Expert Comment

by:Geodash
ID: 37767960
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 9

Expert Comment

by:Geodash
ID: 37767970
You can also look here - if you are suspicious - and see when the account was actually last logged in

http://technet.microsoft.com/en-us/library/dd378867(v=ws.10).aspx
0
 

Author Comment

by:iNetSystem
ID: 37767983
Thank Geodash -
I use ManageEngine AD Manager and actually it reports the "Last Real Logoin" as the same date that the account shows in the Objects tab.
0
 

Author Comment

by:iNetSystem
ID: 37768573
any other ideas?
0
 
LVL 9

Expert Comment

by:Geodash
ID: 37768831
So the account has not been logged in or has recently?
0
 

Author Comment

by:iNetSystem
ID: 37801874
correct - the account is actually disabled in AD yet the profile continbues to report the current date.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show you how to create an ISO CD-ROM/DVD-ROM image (*.iso), and MD5 checksum signature, for use with VMware vSphere Hypervisor 6.5 (ESXi 6.5). It's a good idea to compare checksums, because many installations fail because of a corr…
In this step by step tutorial with screenshots, we will show you HOW TO: Enable SSH Remote Access on a VMware vSphere Hypervisor 6.5 (ESXi 6.5). This is important if you need to enable SSH remote access for additional troubleshooting of the ESXi hos…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now