I have discovered that several of our file servers have a handful of local user profiles (i.e. in C:\Users on the server) for users who obviously don't have permission to logon directly (interactive, remote, etc) to those servers.

Through some analysis of the folders and event logs, I was able to first confirm that end users have not had any direct logons to these servers, and second, to correlate the exact creation time and date of one of the user profile folders with a logon of type 3 (network logon) - this is basically the type of logon that is made when a user accesses a shared resource like a file share (see https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624). Needless to say, this seems highly unusual since those types of logons should not create user profiles.

This only seems to occur very occasionally, like every few weeks a user profile gets created, even on busy file servers. At this point I'm thinking that this may be caused by some obscure Windows bug that may have been fixed by an update which we have not approved. Note that is happening on multiple Windows Server versions. I have seen it on at least 2008 R2 and 2012 R2.

I have searched the net high and low and am having a hard time even finding any mention of this type of occurrence, so I would appreciate it if anyone can answer any of my questions related to this issue: has anyone seen this before? Has anyone found a fix for it? Is there a particular Windows Update which fixed this? Any other ideas?

  • 1
    To me this sounds more like some type of administrative function (logon script, group policy, software deployment) or third-party software. Is there anything like this in your environment that might be causing the issue? – pat o. Mar 30 '16 at 15:42
  • For example, a tool like PSExec will create a user profile on the target machine if you don't specify the -e switch. – pat o. Mar 30 '16 at 15:44
  • Thanks, pat o. No tools like PSExec were run, and I can't think of any other things like logon script, group policy, or software deployment that would have involved user profiles like that either. – optic Mar 30 '16 at 22:56

I found the cause. This is because of EFS. If a user encrypt a file and if he does not have a roaming profile then a local profile is created on the server.

  • Wow, that's an awesome discovery, tentaal! Marked as answer, thank you! I was able to replicate this, and also found a Technet blog post that mentions this behavior - it sound like it's by design: blogs.technet.microsoft.com/instan/2009/07/16/… – optic Jul 15 '16 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.