Windows 2003 R2 File Server - user profiles appearing in Documents and Settings
Hello Recenlty on one of FS i started to have user profiles created in c:\documents and settings. Server is pure file server and apart from Backup Exec nothing else is installed there - users does not use any app that would impersonate them. Even more strange is that when i deleted those profiles they recreated after system reboot. Any ideas what may cause this issue? Micha
July 1st, 2010 4:26pm

Hi, 1. Please check Local Users and Groups to see if there is any unknown user list. If so, delete them. 2. Here is a tool which can help delete user profile. You may have a try: http://www.microsoft.com/downloads/details.aspx?familyid=901a9b95-6063-4462-8150-360394e98e1e&displaylang=en 3. If these profiles will still be recreated by a reboot, try delete them once more and reboot to Safe Mode to see if they will be recreated. 4. If not, disconnect from network and reboot again to see if they will be recreated.Shaon Shan TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com
Free Windows Admin Tool Kit Click here and download it now
July 2nd, 2010 12:00pm

Hello Recenlty on one of FS i started to have user profiles created in c:\documents and settings. Server is pure file server and apart from Backup Exec nothing else is installed there - users does not use any app that would impersonate them. Even more strange is that when i deleted those profiles they recreated after system reboot. Any ideas what may cause this issue? Micha I too have started to notice this problem. This post is the only information I've found on it so far. I have a few user profiles that are showing up in the same place (Server 2003 R2 Enterprise). We have Symantec NetBackup client on the server, McAfee AV, VMware tools, nothing else. There are 4 user profiles on the server (out of ~700 users on this server). They are just users, and group policy as well as network ACLs prevent them from being able to RDP to the server. As far as I'm aware, that is the only action that could possibly generate a user profile. If not, someone say something! Shaon, that doesn't seem to address the issue at all. Figuring out how to delete the profile isn't significant. Explaining how it got there is the point.
August 3rd, 2010 10:36pm

Hello, We are experiencing the same problem. (the suggested solution doesn't address it). Any ideas? our problem occurs in a file server running 2003 R2 to which users don't have interactive logon access. Software loaded is minimal: Veritas Netbackup agent and antivirus. Joseph
Free Windows Admin Tool Kit Click here and download it now
March 16th, 2011 9:33pm

Profiles created on the FS are not full ones. IMHO these profile are byproduct of some procedures on FS and are not the prove of any penetration. By audit and process monitor you will find the cause in your system. Regards Milos
March 16th, 2011 9:54pm

Does anybody find any explanation? I have a FS which is used by 400 users and I have discovered 30 profiles under documents and settings. The users are totally differentes (IT admin, engineers, secretaries, designers,..) with differents rights to different shares, but no one log in directly to the server. Any ideas?? Thanks and regards
Free Windows Admin Tool Kit Click here and download it now
April 20th, 2011 12:33pm

Has anyone found the cause yet to why the profiles are being created? I am running windows 2008 r2 File Server and I have getting partial profiles created and would love to find the source of the issue. Thanks Tim
April 30th, 2011 2:41am

Hi We are having same thing on our file server; don't understand as user are not allowed to access server by Remote Desktop how can the profile be generated on Server Document and Setting.
Free Windows Admin Tool Kit Click here and download it now
May 25th, 2011 12:14pm

EDIT: Realized that I should have given more information.... I was having this problem on some of the file servers I support (running Win 2K3) - partial profiles were showing up for users that did not have access to log onto the servers either via remote desktop or local login. After looking at some of the files these users had been copying up to their shared folders on the servers, I found that all of them appeared to have copied files from encrypted USB-keys. My suggestion would be to find out if any of your users are copying encrypted-files up to a share on the server. If you cross-reference the date that these profile folders were created or last modified with the System log in Event Viewer, you might find EFS-related errors (I did - not sure if these always come up but it gave me a clue as to what to look for). Hope this helps Dan
June 17th, 2011 4:30pm

Hi all I have the same problem on FS 2008 R2. Under User folder there are the typical DA or SA account and some normal domain user account too. Users doesn't have RDP or HTTP access, only shared folder for folder redirection, roaming profile and data sharing. I do not know why the profile is created directly under the Users folder for users who access a resource through a Windows authentication. Something like this: http://www.youtube.com/watch?v=yRmXouOQRVk this process is normal?
Free Windows Admin Tool Kit Click here and download it now
June 27th, 2011 8:51pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics