[jandarsun8]

I've got a user who's profile has been getting corrupted and is now happened four times. This last time was on a different machine with a fresh image on it. I have no clue why it's only his account that seems to be getting corrupt. Any ideas on what it might be? There are no unusual errors in Event Viewer that I can see.

This is a sales rep who connects through the Cisco Anyconnect VPN and all of the users are in the Power Users and Network Users groups under XP. He's the only sales rep that is having this issue. This is now two different images on two different machines that this has happened to. With no errors in Event Viewer, I'm not sure where to start looking as to what the problem is.

[Judas]

Perhaps the Image itself is the cause?

Attempt a fresh clean from disk install and setup and make an image of that just to see..

I've personally seen a Ghost image of an OS that was working 100% before that was in the middle of a meltdown apparently cause similare symptoms.

[jandarsun8]

I don't think it's the image but since is one of the last few that we've imaged, it very well could be. I'll have to do more testing on it on Monday when I get back to work, it's just been irritating. Thanks for the suggestion, at least it's something to look at for starters.

We've got a 140 sales reps that we just re-imaged over the course of two and half weeks for our NSM (National Sales Meeting) in Jan and most of them went with out a hitch. There's been a couple blue screens here and there afterwords but this is the first with multiple corrupted profiles for one person.

Could be the image though as I really haven't got anything else to go off of. I'll post what I find though.

[Tipstaff]

I would also ask that rep what they are using on the machine device wise, and what, if any software they are trying to install or have installed afterwards. It could be that the rep is hooking up a device that is causing the corruption, such as a Blackberry, or is carrying around a virus or some such malware from machine to machine via a USB drive. You could have that user refrain from installing anything, and then slowly get them to install stuff piece by piece to see if any of them corrupt the profile again.

Something else to consider would be to create a new profile for the user, or do whatever you need to do in order to start this user off from scratch. Even if it's just a temporary new profile at least you'd be able to find out if it's something they are doing after the fact, or that it's an issue with their existing profile.

BTW, how long does it take for the profile to get corrupted?

[Takaharu]

I would assume that you're working in a domain. You may want to try looking over your group policies to assess whether there is a rogue policy that is being applied only to that particular sales rep or that there is a policy that is causing an issue.
I had a problem recently where a couple of our agents tried to log onto computers and their profile had not applied the group policies correctly but after another attempt they managed to log on properly. What had happened was that there was a group policy that I had changed during the day that was causing an issue to the agents and, when they logged onto the first computer the PC was retrieving the up-to-date policy from the domain controller that had the fault. The next computer that they had tried already had cached versions of the policies and they were able to log on correctly. In my case I knew what policies that I had changed so I knew what I could correct but it is very difficult to find a culprit policy if you're unsure of where to look.

If all seems fine in all other scenarios you may want to consider removing the user's account and re-creating it. It's no sure-fire way of solving the situation but sometimes (very rarely) an account can become corrupted. It happens once in a blue moon (we've only ever had three in almost 10 years that I know of in our company) but it can happen. It's relatively easy to re-map any files, folders, settings and e-mails to a new user account if you need to do so. If you use roaming profiles, however, I would recommend duplicating the profile over time, rather than using the same one, just in case it was something in there.

If you're not using a domain then try removing the user account from each of the computers and then recreating them. Also, if you're not in a domain and you have that many staff members, why ever not?

[jandarsun8]

After much testing, it ended up being his AD account for the domain was corrupt. I've never experienced that before but as Takaharu mentioned it's rare and does happen. I ended up making a second account for him and mapping his Exchange account and everything else tied to his old account to his new one. It was a pain but it did get fixed.

I know it's been about two weeks for this post but I thought I'd throw this up here on what the problem was in case anyone else ran across this.

[Takaharu]

Just be glad it wasn't a user account that you used for running a service.
Twice, we've had events that flagged up in the Event Viewer that were a result of changing a password for a username that was running a service. To amend it, I had to first change the username that the service was being logged on under, find the distinguished name using LDAP then remove it from AD using ADSI edit. Took me days to research and implement the solution.

Anyway, glad it worked out for you.