0

The server is Windows Server 2008 R2. The user is connecting with RDP to a remote desktop session on the server.

The server stopped and rebooted on 08/16. When the user logged back in to their RD session today 08/17, several (not all) folders on their desktop were missing. These folders also had files and documents.

What happened to the folder and files? Can we get these back?

I looked in the user's C:\Users\username folder and there are files:

08/17/2016 - NTUSER.DAT
08/17/2016 - ntuser.dat.LOG1
08/16/2016 - NTUSER.DAT{7abc05e5-605e-11e6-ac92-782bcb663a9a}.TM.blf
08/16/2016 - NTUSER.DAT{7abc05e5-605e-11e6-ac92-782bcb663a9a}.TMContainer00000000000000000001.regtrans-ms
08/16/2016 - NTUSER.DAT{7abc05e5-605e-11e6-ac92-782bcb663a9a}.TMContainer00000000000000000002.regtrans-ms

There is a NTUSER.DAT file dated today 08/17 and NTUSER.DAT files dated yesterday 08/16 with some long keys in the name. I don't know if these are useful in helping us or not. I've copied the users entire folder to a backup folder for now.

scottkeen
  • 19
  • 1
  • Do a chkdsk, and check if the system recreated another profile for the user, thus user to user.domain as an example – yagmoth555 Aug 18 '16 at 00:46
  • Would the other profile be in the C:\Users folder? The users name is "mabe" but there are not other user folders in the C:\Users folder with the name "mabe". The user is able to login fine, it's just that there are missing folders from her desktop. Anything I can do with yesterday's 08/16 NTUSER.DAT files listed above? – scottkeen Aug 18 '16 at 00:55
  • NTUSER.DAT is the users registry hive. It doesn't contain user files. You can't recover the users files from the NTUSER.DAT file. – joeqwerty Aug 18 '16 at 01:08
  • Thanks. I was wondering if the NTUSER.DAT had pointers to the hard drive where the data is stored. IOW, if the user had folders on their desktop with documents in the folders, and the NTUSER.DAT got corrupted and the pointers to the folders on the desktop were lost, then there would be no way to "see" them on the desktop. I probably don't understand NTUSER.DAT, just asking if this is possible. – scottkeen Aug 18 '16 at 01:20
  • Check there HKLM\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\ProfileList to see where is profile is, but if only one mabe, I guess its the good folder. – yagmoth555 Aug 18 '16 at 01:31
  • There are 2 profiles for user "mabe". Both have ProfileImagePath = C:\Users\mabe `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2940002209-1665715764-1772909678-1008` `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2940002209-1665715764-1772909678-1036` – scottkeen Aug 18 '16 at 01:55
  • In fact, all the users have duplicate profiles in `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList` not just user `mabe` – scottkeen Aug 18 '16 at 02:02

0 Answers0