K
kjstech10
Guest
We have a GPO to clean up the C:\Users folder that states if the user hasn't logged on in 31 days to delete it. This helps with people who move from machine to machine, turnover, promotions, etc... to keep the drives at bay. Otherwise we would be running out of C: drive space on our workstations over a long period of time - mostly dependent on which department or functional area the machine is in.
We had a user who uses their laptop at home on home wifi often. Not a VPN but does use Office and Outlook. Its been some time since they brought it in and in fact I had to manually hard wire it in to get an updated certificate so their corporate wireless would work. Anyway from being back on the domain the GPO I guess deleted the users profile which contained lots of documents. What is weird is that the user profile has been logged on, just from home. Its like the GPO starts the timer only when its on network which should not be the case. If the profile was used, even locally then it should consider its an active account and do not touch it - basically reset the inactivity timer.
So now the user was started out with a blank profile. Is there any way to recover? I restored everything from the Recycle bin, but that did not restore the folders \Documents, \Favorites, \Desktop, etc.... It only restored some items in \AppData (big whoop).
We gave her this laptop a few months ago. We still had her old laptop, so I turned that on and started copying everyhing from her profile on that machine using the administrative c$ share. It was copying and I got her desktop and favorites folders back, but it froze when copying documents. I logged into the old laptop while this was taking place but guess what.. the stupid User Profile Service deleted her old profile there as well! Even though there were files in use copying over the network, the thing deleted it anyway, much like a non-caring virus would do.
So in the mean time we changed the GPO to not delete user profiles unless its older than 120 days. We are also trying to encourage the user to back things up to the network drive. She is computer illeterate, and for the past 20 years she has just saved her work to the "documents" folder on the C: drive. I tried to explain anything could happen... the laptop could be stolen, it could have a hardware failure, it could get a virus or ransomware, anything. She NEEDS to back things up.
But those are all things for moving forward (backup, relax the profile delete gpo, user training, etc...). What do we do now to recover these files? Is there software that can find them from the nvme ssd? I haven't had any luck with Disk Drill, Piriform Recuva, and EaseUS Data Recovery seems to find a few things, but nothing located in the path c:\users\username\. The only common thing these files seem to find under c:\users\username is \MicrosoftEdgeBackups and \AppData.
The computer is running Windows 10 1809.
Thanks!
More...
We had a user who uses their laptop at home on home wifi often. Not a VPN but does use Office and Outlook. Its been some time since they brought it in and in fact I had to manually hard wire it in to get an updated certificate so their corporate wireless would work. Anyway from being back on the domain the GPO I guess deleted the users profile which contained lots of documents. What is weird is that the user profile has been logged on, just from home. Its like the GPO starts the timer only when its on network which should not be the case. If the profile was used, even locally then it should consider its an active account and do not touch it - basically reset the inactivity timer.
So now the user was started out with a blank profile. Is there any way to recover? I restored everything from the Recycle bin, but that did not restore the folders \Documents, \Favorites, \Desktop, etc.... It only restored some items in \AppData (big whoop).
We gave her this laptop a few months ago. We still had her old laptop, so I turned that on and started copying everyhing from her profile on that machine using the administrative c$ share. It was copying and I got her desktop and favorites folders back, but it froze when copying documents. I logged into the old laptop while this was taking place but guess what.. the stupid User Profile Service deleted her old profile there as well! Even though there were files in use copying over the network, the thing deleted it anyway, much like a non-caring virus would do.
So in the mean time we changed the GPO to not delete user profiles unless its older than 120 days. We are also trying to encourage the user to back things up to the network drive. She is computer illeterate, and for the past 20 years she has just saved her work to the "documents" folder on the C: drive. I tried to explain anything could happen... the laptop could be stolen, it could have a hardware failure, it could get a virus or ransomware, anything. She NEEDS to back things up.
But those are all things for moving forward (backup, relax the profile delete gpo, user training, etc...). What do we do now to recover these files? Is there software that can find them from the nvme ssd? I haven't had any luck with Disk Drill, Piriform Recuva, and EaseUS Data Recovery seems to find a few things, but nothing located in the path c:\users\username\. The only common thing these files seem to find under c:\users\username is \MicrosoftEdgeBackups and \AppData.
The computer is running Windows 10 1809.
Thanks!
More...