2003 terminal services - unknown profiles created

On a windows 2003 terminal server, I was going through c:\documents and settings and I noticed that there were various profiles created, for example

c:\documents and settings\firstname.lastname
c:\documents and settings\anotherfirstname.anotherlastname

overall around 10 new profile folders, that were not created by the local user logon.

Can I find more information about the terminal server user logins on 2003?  specifically how were these folders created? the timestamp shows that it was not during working hours.
LVL 1
sk391Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Radhakrishnan RSenior Technical LeadCommented:
Hi,

That's expected in terminal servers as it is the way the TS designed for. Those profiles are created when a user access (login) via this terminal server. This can be deleted as it's a temporary profile. There is a group policy to set the profiles to be delete after xxx days.

Hope this helps.
sk391Author Commented:
thank you however the users had been disabled in AD, and the profiles were created outside business hours, thats why its suspicious. how can we dig deeper to find out what is the root cause for this?
Toni UranjekConsultant/TrainerCommented:
Check Security log for Event ID: 528 with Logon Type: 10 (remote desktop) and check Workstation Name value.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
sk391Author Commented:
thank you but unfortunately we dont have security log because this happened last month. any other ideas?
Toni UranjekConsultant/TrainerCommented:
If your Security log was overwritten, you should restore them from your backups.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.