- Nov 25, 2011
- 84
- 0
- 18,640
I've run into a little problem with a client's computer regarding a corrupt user profile and missing files from the original profile.
Yesterday I got a call saying that when an employee tried to sign into their profile on a computer (Asus N56J - Windows 8.1) that they got signed into a temporary profile. They didn't care what needed to be done or what the best solution was - there was just one Excel spreadsheet (timesheet.xls or .xlsx) that was stored on the desktop of that 'missing' profile that they wanted back.
I've run into issues with profile corruption before and it is normally an easy fix.
1.) I logged in with another admin folder so I could view and copy the User folder for the user with the profile issues.
2.) Checked the C:\Users\"employee_name"\Desktop\ and the file was not there. The desktop was completely empty.
3.) Checked C:\Users\"employee_name"\Documents\ and this directory is completely empty as well. Did a search in C: for any excel files. No results with the name of the file that I am looking for.
4.) Checked the Event Viewer logs for details about the profile issues. Found the logs for the profile login issues along with the corresponding SID number (S-1-5-21-2151600647-873788246-747924819-1004)
5.) Opened regedit and browsed to: HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/CurrentVersion/ProfileList/S-1-5-21-2151600647-873788246-747924819-1004.bak. S-1-5-21-2151600647-873788246-747924819-1004 (without .bak does not exist.) Here is where I noticed some funny stuff going on. The ProfileImagePath registry key is pointing to: c:\Users\"some_other_employee_name\".
6.) Checked C:\Users\ for this other profile name that was listed in the registry key. Was not able to find this user profile. My suspicion is maybe they remained the account from an old employee and changed the name to the old employee at some point and something funny is going on in the registry?
7.) Change Windows settings to show all hidden files and protected system files. Nothing new shows up in C:\Users
8.) Checked the $Recycle.Bin folder on C:\. I found a folder called S-1-5-21-2151600647-873788246-747924819-1004. This folder has a few Word and Excel documents but nothing that corresponds to the name of the file that I am looking for.
9.) Client had already installed Recuva and started running it. Let the scan finish and it did not find any trace of the timesheet.xls(x) file. Nothing is found of the C:\Users\"some_other_employee_name"\ either.
At this point I backed up the user profiles and ran system restore. After the computer restarted it said the restore was not successful and mentioned that the antivirus was interfering. Uninstalled Avast and restarted the computer. Ran system restore again and it failed with the same error.
I am completely out of ideas. This was supposed to be a 15 minute fix, and I have spent 4 hours trying to solve this problem. Listed below are the only conclusions that I really have in the end...
And and all help is greatly appreciated.
- Somehow when the employee restarted the computer something happened with her profile (and possibly the registry).
- Recovery software is not able to find any traces of the spreadsheet. Her profile folder is there, but missing all the files and information that should be there.
- Windows Search does not return anything when searching for the filename or variations thereof.
- System restore does not work - can't remember the Error ID but it mentioned the AV. Removed AV and restarted. System restore still gives the same error message.
Yesterday I got a call saying that when an employee tried to sign into their profile on a computer (Asus N56J - Windows 8.1) that they got signed into a temporary profile. They didn't care what needed to be done or what the best solution was - there was just one Excel spreadsheet (timesheet.xls or .xlsx) that was stored on the desktop of that 'missing' profile that they wanted back.
I've run into issues with profile corruption before and it is normally an easy fix.
1.) I logged in with another admin folder so I could view and copy the User folder for the user with the profile issues.
2.) Checked the C:\Users\"employee_name"\Desktop\ and the file was not there. The desktop was completely empty.
3.) Checked C:\Users\"employee_name"\Documents\ and this directory is completely empty as well. Did a search in C: for any excel files. No results with the name of the file that I am looking for.
4.) Checked the Event Viewer logs for details about the profile issues. Found the logs for the profile login issues along with the corresponding SID number (S-1-5-21-2151600647-873788246-747924819-1004)
5.) Opened regedit and browsed to: HKEY_LOCAL_MACHINE/Software/Microsoft/Windows NT/CurrentVersion/ProfileList/S-1-5-21-2151600647-873788246-747924819-1004.bak. S-1-5-21-2151600647-873788246-747924819-1004 (without .bak does not exist.) Here is where I noticed some funny stuff going on. The ProfileImagePath registry key is pointing to: c:\Users\"some_other_employee_name\".
6.) Checked C:\Users\ for this other profile name that was listed in the registry key. Was not able to find this user profile. My suspicion is maybe they remained the account from an old employee and changed the name to the old employee at some point and something funny is going on in the registry?
7.) Change Windows settings to show all hidden files and protected system files. Nothing new shows up in C:\Users
8.) Checked the $Recycle.Bin folder on C:\. I found a folder called S-1-5-21-2151600647-873788246-747924819-1004. This folder has a few Word and Excel documents but nothing that corresponds to the name of the file that I am looking for.
9.) Client had already installed Recuva and started running it. Let the scan finish and it did not find any trace of the timesheet.xls(x) file. Nothing is found of the C:\Users\"some_other_employee_name"\ either.
At this point I backed up the user profiles and ran system restore. After the computer restarted it said the restore was not successful and mentioned that the antivirus was interfering. Uninstalled Avast and restarted the computer. Ran system restore again and it failed with the same error.
I am completely out of ideas. This was supposed to be a 15 minute fix, and I have spent 4 hours trying to solve this problem. Listed below are the only conclusions that I really have in the end...
And and all help is greatly appreciated.
- Somehow when the employee restarted the computer something happened with her profile (and possibly the registry).
- Recovery software is not able to find any traces of the spreadsheet. Her profile folder is there, but missing all the files and information that should be there.
- Windows Search does not return anything when searching for the filename or variations thereof.
- System restore does not work - can't remember the Error ID but it mentioned the AV. Removed AV and restarted. System restore still gives the same error message.
Facebook
Twitter
Instagram