Users local profile keeps corrupting?

Hi guys,

I have a really strange issue at the moment that I would like to see if anyone else here has in-counted.

I have a user with his local profile that seems to keep corrupting (loses My Documents files, network printers disappear and map drives disappear) and is doing this on 2 different computers. We do not not use roaming profiles and it is a Windows 2003 Srv and XP Workstation environment.

I have re-imaged the users laptop and it worked for about 2 days with out any issues but as of today the issue has returned. This time it has not created a profile like a Temp user in the Documents and Settings folder but about 2 Gb of files (all his files) in his My Documents are missing again and all his network printers have disappeared and mappings.

 

address and then stress test the memory.
run hard disk diagnostics

install the User Profile Hive cleanup utility and see if that helps.


edit; yes I know its quite generic advice, but I recommend it anyway, you may discover the ram is mis matched or something and not stable, or you may find that the disk has got some kind of cyclic redundancy check problems, it could also be some kind of process not unloading prior to the system shutting down which utilises keys in the HK_CU (Ntuser.dat) hive. Could be many things, rule out hardware issues first IMHO

 

Does he have a habit of hibernating the laptop and then letting the battery run dry? I have seen this many times before.

 

He does use hibernating but he has done this for about 4 yrs with out any issues. Also I have had him use a desktop computer as well and this is happening also with this machine so I do not think it is hardware. I have also preformed a scan disk on his machine so I can only think it is possibly something with his AD account?

 

What A/V?

Symantec AV plays silly buggers with some user profiles occasionally where I work (locks ntuser.dat - turns the profile into a temp profile) a reboot usually sorts it out though.

Anything in the event log?

 

We are using Symantec Endpoint Protection.

The event log does not seem to indicate anything at all.

I am looking at possibly just trying to recreate his AD account but I can't see how this could be doing this.

 

Does this user use any specific applications that would be on both PC's ? I.e CAD or something ?

 

How bout the event logs on the server?

Got enough CAL's?

Try disabling the network firewall component in endpoint; the PC might be logging in with a cached profile?

Are my documents mapped to a network path? Sounds like it's dropping the connectivity to the server rather than corrupting the profile.

 

Well one PC does have CAD and the other machine that I rebuilt is using DWG AutoCAD viewer.

I have been looking into the event viewer and in the last 24 hours it has started to log some issues that relate to users profiles not closing so this would be related to the problem I feel.

These are:

Event ID: 1517
Source: Userenv

Event ID: 1524
Source: Userenv

I have read that they can be due to services set to run as non system but all the services are set to Local machine. I am wondering if it could be with the AutoCAD viewer as I did not install this until the 2nd day he had the machine back from the rebuild and it did not happen again until then.

 

IMO End point proteciton doesnt always protect against all forms of malware, I would do a MBAM scan over the system for peace of mind, but thats just me.

Again, the User Profile Hive Cleanup Utility will probably solve all your problems..
It runs as a service and prevents user account corruption, consider using it.

 

I am looking to this now.

It mentions those event ID's and will set this up.

Cheers...

 

you're welcome,
I originally discovered it looking into those kind of event records and following the Microsoft urls (in said records) to find solutions.