I don't even know where to start. A user contacts me and says today that she worked on a powerpoint presentation all day yesterday and clicked save throughout the day. Closed the file after clicking save and went home. She came in today and said the file reverted to a previous version. When you look at the last modify date it is Jan 16th. The file appears in the office file recovery folder but it too is the version from Jan 16th. However it's dated Feb 12th 8:34am.

So it proves she opened it but what the ... happened? Is this even possible? I guess anything is possible but how do you figure something like out.

It's office 365 (2013 Pro plus) running on a windows 2008 r2 terminal server with Citrix xenapp 7.6. The file is stored on a server 2012R2 file share.

I didn't have shadow copies turned on but when ahead and turned it on starting at 7AM to run for 12 hours every 2 hours. I gave it 15Gb.

Thanks,
John Long

• Edited by jlongjr Friday, February 13, 2015 10:07 PM

Hi John,

Above all, as it is a Citrix environment, I cannot ensure if it makes any difference to the specific issue as Office 365 and Terminal server are all involved. Also the file may not able to be recovered as it cannot be found in recovery folder either. For preventing such kind of issue, create VSS snapshot is a good option like you did. 

Here are my personal viewpoint of this issue.

1. Please check if Offline Files is enabled. It could be caused if the file is actually saved as a local cache instead when user clicking Save - and by some means the file is not synced to server the last time user logged on.

You can check Event log for related information. Start from the time user Save the file and check if any network or offline files related error is logged.

2. Is there any file replication set on that terminal server which stores user's files? Sometimes a replication confict could also cause similar issue, that an older version is considered as a "winner" in file replication. For example if DFS replication is used, "conflicted file" will be stored temporarily for some time. You can check ConflictandDeleted folder (a hidden folder inside replication folder target) to see if there is any chance to find the deleted file. 

I just realized something. Office 365 cannot be installed on a terminal server. So I have office 2013 pro plus installed on it.

With that being said, offline files are disabled via GPO. Been there, so to speak!

I looked in the event log and didn't see any strange errors or warnings. We do not use DFS on the terminal server or the file server. She didn't report being disconnected or logged out either so I don't think the profile was over written.

hello,

did she encounter this section just one time? if so, mistaken operation may be most probably, like not save correctly.

It's happened quite a few times. It's also happening on her PC too. Not just the terminal server. She also says she is loosing sent email. She'll send an email and it doesn't appear in her sent items. There is no log of it on the server, we also have journaling enabled and use Mimecast to archive our email and it's not there.

I turned on shadow copies on the server to try to capture the files she's saving, I set shadow copies to 30 minutes. I told her to save everything to the server but the last time this happened she saved it to the desktop. Then she complained that it's too hard to save stuff to the server. Ugh.

Can anyone recommend some software that records absolutely everything she does on her computer? Something like a DVR that we can see these events happen?

 

• Edited by jlongjr Friday, February 20, 2015 3:58 PM

Hi,

Long everything is achievable such as using Process Monitor, but the log will be very large and it will be hard to find specific thing.

In current situation, can I say if the issue occurs specifically on her computer? Is there any other user has the same issue in the same environment?

If issue is reproducible, capture a network trace to see if we can find something.

https://support.microsoft.com/kb/812953?wa=wsignin1.0

As a possible workaround, you can test to help her create a new local profile incase the issue related to settings which could be reset by using a new profile.

Also make sure all updates and drivers are up-to-date on her computer. 

I wouldn't really call your last reply the answer to my particular problem but I did install some software to record everything that goes on, on that computer. The problem hasn't repeated its self since...

Things that make you go hum!