K
KJSTech1
Guest
Hello,
We have the following GPO set :
System/User Profiles- Delete user profiles older than a specified number of days on system restart (120 days).
Today two laptop users working from home since March rebooted due to issues and when they logged back in it was like a brand new PC. Sure enough they have brand new profiles. No there was not a TEMP profile created or logged. For whatever reason even though they work daily, their user profiles have been wiped clean. The only thing I can think of is this GPO, otherwise we have no other means to delete a users profile, at least in any kind of automated way. I've only seen this on Dell XPS laptops... never on our Optiplex or Precision desktops... if that matters.
This has happened to numerous people in the past and we thought it was just the value of this GPO. For example it was once originally 30 days, then we upped it to 90 days. Another high profile case came through and we upped it to 120 days, thinking surely someone will log into a computer at SOME point within 120 days. I've read that it checks the date of the NTUSER.DAT file in the C:\users\username folder. I've checked mine and my NTUSER.DAT file has a file modification date of 6/10/2020 - thats 7 days ago, yet today as of this post 6/17/2020 I am actively on this machine and typing out this response right here. I too have a Dell XPS laptop.
Right now we have one user who is completely distraught and escalated with management the deletion of her files from her laptop. Believe me, if she could sue Microsoft she would... loosing hours of work. The other user that had the problem today had most of his stuff in his Recycle Bin, which I was able to restore. He also uses RDP to a hardwired machine in the physical office... so while it was disruptive to recreate shortcuts, preference, walk through the Outlook first time startup wizard... he was ok. But the other person's recycle bin only restored so much. It did not catch all of her files.
For now I've changed this GPO from 120 days to Not Configured. Hoping that puts an end to wiping peoples files on their laptops. But it would be nice to have some sort of automated cleanup utility to delete old profiles from machines. For now the risk is not worth the benefit of a few gigs of hard drive space in our typical 4 year computer image lifetime.
Any suggestions or assistance you can give on why this GPO did the delete, or why the NTUSER.DAT file date does not accurately reflect the current time the profile is signed on? Is it possible that laptop users who this occurred to have been getting by with simply doing hibernation's or sleep mode and never did a full reboot in 120 days? That seems unlikely to me. 30 days sure, heck I've gone from monthly update Tuesday to update Tuesday between reboots, no big deal.
Thanks for your help.
More...
We have the following GPO set :
System/User Profiles- Delete user profiles older than a specified number of days on system restart (120 days).
Today two laptop users working from home since March rebooted due to issues and when they logged back in it was like a brand new PC. Sure enough they have brand new profiles. No there was not a TEMP profile created or logged. For whatever reason even though they work daily, their user profiles have been wiped clean. The only thing I can think of is this GPO, otherwise we have no other means to delete a users profile, at least in any kind of automated way. I've only seen this on Dell XPS laptops... never on our Optiplex or Precision desktops... if that matters.
This has happened to numerous people in the past and we thought it was just the value of this GPO. For example it was once originally 30 days, then we upped it to 90 days. Another high profile case came through and we upped it to 120 days, thinking surely someone will log into a computer at SOME point within 120 days. I've read that it checks the date of the NTUSER.DAT file in the C:\users\username folder. I've checked mine and my NTUSER.DAT file has a file modification date of 6/10/2020 - thats 7 days ago, yet today as of this post 6/17/2020 I am actively on this machine and typing out this response right here. I too have a Dell XPS laptop.
Right now we have one user who is completely distraught and escalated with management the deletion of her files from her laptop. Believe me, if she could sue Microsoft she would... loosing hours of work. The other user that had the problem today had most of his stuff in his Recycle Bin, which I was able to restore. He also uses RDP to a hardwired machine in the physical office... so while it was disruptive to recreate shortcuts, preference, walk through the Outlook first time startup wizard... he was ok. But the other person's recycle bin only restored so much. It did not catch all of her files.
For now I've changed this GPO from 120 days to Not Configured. Hoping that puts an end to wiping peoples files on their laptops. But it would be nice to have some sort of automated cleanup utility to delete old profiles from machines. For now the risk is not worth the benefit of a few gigs of hard drive space in our typical 4 year computer image lifetime.
Any suggestions or assistance you can give on why this GPO did the delete, or why the NTUSER.DAT file date does not accurately reflect the current time the profile is signed on? Is it possible that laptop users who this occurred to have been getting by with simply doing hibernation's or sleep mode and never did a full reboot in 120 days? That seems unlikely to me. 30 days sure, heck I've gone from monthly update Tuesday to update Tuesday between reboots, no big deal.
Thanks for your help.
More...