I have discovered that several of our file servers have a handful of local user profiles (i.e. in C:\Users on the server) for users who obviously don't have permission to logon directly (interactive, remote, etc) to those servers.
Through some analysis of the folders and event logs, I was able to first confirm that end users have not had any direct logons to these servers, and second, to correlate the exact creation time and date of one of the user profile folders with a logon of type 3 (network logon) - this is basically the type of logon that is made when a user accesses a shared resource like a file share (see https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624). Needless to say, this seems highly unusual since those types of logons should not create user profiles.
This only seems to occur very occasionally, like every few weeks a user profile gets created, even on busy file servers. At this point I'm thinking that this may be caused by some obscure Windows bug that may have been fixed by an update which we have not approved. Note that is happening on multiple Windows Server versions. I have seen it on at least 2008 R2 and 2012 R2.
I have searched the net high and low and am having a hard time even finding any mention of this type of occurrence, so I would appreciate it if anyone can answer any of my questions related to this issue: has anyone seen this before? Has anyone found a fix for it? Is there a particular Windows Update which fixed this? Any other ideas?