iNetSystem
asked on
Windows 2008 Server has a current profile of a user that left the company
I have a Windows 2008 Standard server that has a local profile with a Modified date of today for a user that has left the company weeks ago and their account was disabled in AD.
Under what conditions could this profile be for today?
Under what conditions could this profile be for today?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
No services at all on the system using the account. The event logs truncated as of early this morning. I do have a backup but am suspicious. In AD the user is disabled and has a Modified date of weeks ago. The Server however shows a current profile as of today.
A more direct link
http://support.microsoft.com/kb/973148/en-us
http://support.microsoft.com/kb/973148/en-us
You can also look here - if you are suspicious - and see when the account was actually last logged in
http://technet.microsoft.com/en-us/library/dd378867(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/dd378867(v=ws.10).aspx
ASKER
Thank Geodash -
I use ManageEngine AD Manager and actually it reports the "Last Real Logoin" as the same date that the account shows in the Objects tab.
I use ManageEngine AD Manager and actually it reports the "Last Real Logoin" as the same date that the account shows in the Objects tab.
ASKER
any other ideas?
So the account has not been logged in or has recently?
ASKER
correct - the account is actually disabled in AD yet the profile continbues to report the current date.
Check local event logs?
Server Backup?