Surface user claims half (not all) their desktop folders/files and shortcuts disappeared from desktop
I am inquiring if anyone has seen or heard of this before. I know that certain malware can mark files as hidden but this machine is clean. I've got Kaspersky end point on this machine and have run mutiple scans including malwarebytes. I have found nothing. The machine is not acting abnormal which you typically notice something (slowness, redirection, pop ups) This is a surface pro 4 with windows 10. I've checked the show hidden files check box just to see if they are hidden. I have done a search ion the machine to find none of those files. I have unchecked and checked the "show desktop Icons" under view (right clicking on desktop). I checked when the last update happened on his machine and it was 11/10/16. The first day he noticed this was 11/29/16 so there is no way an update went wrong. I suggested that he clicked and drug them into the recycling bin on accident. (recycling bin was emptied) He states that the folders and shortcuts that are missing where all over his desktop mixed in with his files that are not missing from his desktop so it would have been really hard for that to happen. Again he is missing some folders and some shortcuts to programs, however he has a bunch of other files still on his desktop. There is no rhyme or reason. If you search a machine will is show hidden files? Also, if we attempt a restore back to a date prior to him noticing his files are gone will that restore those files? Any help?
Marcos Santo
Don't know if they were files or programs and make new shortcuts. Or get them from a back up
ASKER
They were folders full of files AND files AND shortcuts to programs that were missing......again not all of them. We've already recreated the shortcuts. There is no backup of the users desktop, only their network folders. Since the files were only on his desktop they are gone unless someone has seen this and has a fix. I am asking to see if anyone has info on this because we don't want it to continue to happen.
I just noticed that office 2016 says it installed on that Monday 11/28/16 which i know no to be the case. Office was installed when the machine was deployed. I am assuming it was just an update?
I just noticed that office 2016 says it installed on that Monday 11/28/16 which i know no to be the case. Office was installed when the machine was deployed. I am assuming it was just an update?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
So I am in some need of additional help now. I did the restore back to when he had his files. The files are not back and when we tried to log back into the domain. We could not. It was saying the established trust between the domain controller and the pc has been broken. I went ahead and deleted his Computer entry in active directory. Joined his pc to a group away from our domain. Renamed his PC and then tried to rejoin it to the domain. I am now getting an error message stating The machine can not locate the domain controller for our domain. I am online and can ping our domain controller. Any help?
Ouh... what are you doing? To reestablish a domain affiliation, a local admin and one powershell command is all we need.
Ok, to join now, please look at the DNS server entries and verify if the first DNS entry is still pointing at the DC.
Also please don't use the domain netbios name when joining, but the full qualified name.
Ok, to join now, please look at the DNS server entries and verify if the first DNS entry is still pointing at the DC.
Also please don't use the domain netbios name when joining, but the full qualified name.
ASKER
Apeerently I don't know what I am doing. However, I got it fixed and rejoined. For whatever reason i just had to enter domain.local into the domain instead of just the domain name.
ASKER
So we are back to where we were before the restore. Again, the only thing we now notice is there was an Office update on the day before the files came up missing.
So you are perfectly sure it was just an office update? No way it could have been the upgrade to v1607?
If so, what can we do, we can only setup auditing to audit what gets deleted in the future.
If so, what can we do, we can only setup auditing to audit what gets deleted in the future.
ASKER
The user states. He printed something from this folder on 11/28/16. There was an Office 2016 update (even though it shows as just an install and not an update in the control panel) on 11/28/16. We restored back to 11/21/16. The files are still missing. We could restore back to 11/10/16 (the last critical windows update) however, user says there is no way the files disappeared back then because he used them on 11/28/16. I hope you can follow. It is possible he made a careless deletion but I doubt it. I am at a loss for what exactly happened. I would be interested in setting up logging if you can walk me through that. Also, I would like to know that power-shell command to re-establish trust. If you will.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Although there was never a proper solution or answer to this question. I can not prove the user just didn't delete his files. Mcknife offered insight as to why this may have happened and provided steps to set up auditing in case this happens again.