I recently noticed on server 2012 that there are empty user profiles created for users that do not have access of logging onto the server locally. At first thought I was wondering if someone was trying to log on the server. The users do not have access physically to the server and they do not have RDP rights. Why would the empty profiles be created?

Hi TechPay,

Would you please let me know whether this server 2012 is a DC? Just a confirmation, thanks for your understanding.

-->I recently noticed on server 2012 that there are empty user profiles created for users that do not have access of logging onto the server locally.

Did there has user profiles for every user account in the domain environment? Would you please let me know the path of that user profile in the server? Please select a user profile folder and access it. Any find?

By the way, did you remember whether configure roaming profile for those users? Meanwhile, please also open Event Viewer and check if find some relevant events.

If any update, please feel free to let me know.

Best regards,

Justin Gu

I noticed this on 2 different servers. One is a DC and the other was on a member server. We do not use roaming profiles due to bandwidth issues. I only had about 5 extra user profiles on one server and a couple on the other. I did go into the profiles and they had the usual Music Documents and Pictures folders but everything was empty. I also right clicked and properties for the main user profile folder and it was 0 bytes. I did delete the profiles from the member server and they have not returned.

• Proposed as answer by Justin GuMicrosoft contingent staff, Moderator 1 hour 15 minutes ago

I noticed this on 2 different servers. One is a DC and the other was on a member server. We do not use roaming profiles due to bandwidth issues. I only had about 5 extra user profiles on one server and a couple on the other. I did go into the profiles and they had the usual Music Documents and Pictures folders but everything was empty. I also right clicked and properties for the main user profile folder and it was 0 bytes. I did delete the profiles from the member server and they have not returned.

• Proposed as answer by Justin GuMicrosoft contingent staff, Moderator Monday, March 09, 2015 5:45 AM

I did delete the profiles from the member server and they have not returned.

Hi,

Thanks for your feedback.

-->At first thought I was wondering if someone was trying to log on the server.

From your original post, you thought that someone was trying to log on the server. Did you logon the server and open Event Viewer, then check if find some relevant events.

Best regards,

Justin Gu

From the dates on the profiles, event viewer would not go back that far. A couple of them were pretty old. AD is set up to only allow 4 users with RDP access. Also we keep the servers locked and none of the profiles have access to the room. One of the servers is actually a Hyper V vm with exchange on it. It also had a couple of empty profiles. Strange.

Do these users have any kind of admin rights on the domain?  Empty copies of my profile get created on a target machine when I perform remote registry queries via script (some o/s's).. A feature of the remote registry provider.

Nick

• Edited by Nick P. - SCCM Guy 5 hours 7 minutes ago