Member Avatar for kanoy83

Hi Guys,

One of our staff PC has a problem, the scenarios:

Specs: (Alias Names)

  • Windows 7 Pro, 32 Bit, 2 GB RAM
  • Company Name: Contoso
  • Staff PC under Domain Alpha
  • PC Name: Contoso1-PC
  • Local Users are: administrators and john
  • User profiles:

    • operations (contoso domain)
    • john (local)
    • administrator (local)
  • MS Outlook connected to operations@contoso.com

Thursday:
IT

  1. remove/uninstall chat messengers, blocked linkedin,facebook,twitter,youtube
  2. change User Account Type (Local Staff John Doe) from User to Guest
  3. shutdown the system

Friday

  1. turn on the PC and staff asks for the correct username
  2. provides the username, Contoso1-PC\john
  3. staff login to his local account using his password

Saturday

  1. staff called and his desktop files are gone and document files are gone
  2. IT check the Users folder there are particular folders:
  3. john and john.contoso1-pc
  4. both folders empty
  5. outlook not connected
  6. account is totally FRESh
  7. IT check on webmail under Domain Alpha, not working the usual password, webmail.contoso.com/owa
  8. after an hour, the usual password works
  9. IT tried to connect MS outlook 2003 using operations@contoso.com not working saying "outlook.pst is not offline file"

PROBLEM:

  1. files are gone :(
  2. Totally FRESh account

I don't know what happen, guys please help, the FIles are gone.

Hoping your best solution.

THanks.

Edited by Reverend Jim because: fixed formatting
  • 4 Contributors
  • 5 Replies
  • 381 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by solarfinder

Dani AI

Generated

Short summary and practical next steps (based on the thread and the replies from and ):

The behaviour you saw is almost always a profile/SID issue or an account deletion/re-creation — not a mysterious Vista/Win7 “auto-delete” when you change an account type. If Windows is given a different SID (for example a new local account vs the old domain account, or an admin deleted and recreated the account) it creates a fresh profile and the old files will not appear in that new profile. A corrupted profile can also force Windows to log a user into a temporary profile. and are right to point at deletion/SID/profile differences; the steps below show how to check and recover safely.

Quick forensic checks (do these first, as an admin):

  • Look for the old profile folders (show hidden/system files) under C:\Users.
  • Check which SID maps to the active profile: open Regedit and inspect
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
  • From an elevated command prompt run:
    whoami /user
wmic useraccount get name,sid
vssadmin list shadows
  • Right‑click the old profile folder -> Properties -> Previous Versions (if System Protection / Shadow Copy exists).

If you find a temporary profile or a SID/.bak entry: back up the registry first, then fix the ProfileList entry (remove/rename the incorrect key or the “.bak” per Microsoft guidance, set RefCount/State to 0) so Windows loads the original profile. To regain access to files you may need to take ownership and grant administrators rights:

takeown /F "C:\Users\John" /R /D Y
icacls "C:\Users\John" /grant administrators:F /T

Outlook note: if PST/OST files were profile‑local, search C:\Users\<oldname>\AppData for *.pst/*.ost. Copy any PST to a safe location before attempting repair (scanpst.exe) or creating a new Mail profile via Control Panel -> Mail.

Prevention checklist: enable System Protection/Shadow Copies, use folder redirection or roaming profiles for important data, disable (do not delete) AD accounts when needed, and always back up user data before changing account types. If recovery steps are unclear or files are still missing, stop using the machine (to avoid overwrites) and consider a disk image + professional recovery.

Recommended Answers

All 5 Replies

Member Avatar for BigPaw

Seems like Admin deleted the User account and then created a new one as Guest. Changing a Standard account to a Guest account is not straightforward, but should not result in the loss of files.

If those files were on another part of the network, or even the drive, does your network allow Guest privileges to access them?

Member Avatar for gerbil

Interesting. I had to experiment to be sure, because account information on the web is conflicting and some of it is quite wrong, and my experience with them was moderate... so on my W7 machine I enabled the Guest account; I also created a new User account, Justonce, logged in as him and had him build and save some files in his Documents folder and elsewhere... the desktop, other drives. Then I added Justonce to the Guests Localgroup, and deleted him from the Users Localgroup. Logged him out, logged the new guest Justonce in.... all his files stood, desktop, his Documents and saves to other drives. Restarted, and logged him in... all files remained. He could not rename himself or move himself from Localgroup Guest.
Hmmm. So then I logged in as the Guest [not Justonce] and discovered that the Guest can only save to his Documents and not to any other drive. He can read on other drives.
So an account in the Localgroup Guest is not the same as the Guest account: the Guest can only save to his Documents, whereas a Localgroup Guest [Justonce in this case] can save to other drives also. And the Guest account Documents is NOT deleted when he logs out, or when the sys is restarted - the Guest account persists until it is removed.
So all I can think is, it is as BigPaw said: your IT deleted the User account and all its folders, and created a new user as a Localgroup Guest. It would not be as a Guest account because then there would be only one username. They did not move the account to another group. So I think your IT has been a bit silly. My guess, your hope, is that they moved the files. Thing is, when you delete an account you have the option to save its files to a desktop folder named after that account. Or you can press the other button, and delete them along with the account.... If they existed still then they would be visible to an administrator account.
My machine is not part of a domain but I would guess the same account rules apply there.

Edited by gerbil
Member Avatar for kanoy83

hi guys,
i found the solution, it was soem forums, i use previous version of the staff folder that were change to guest, and now i return it to power users and restore the files using previous version in the c:\users\staff folder

Thanks!

Member Avatar for gerbil

Good-oh. Seems domain usergroup gives more options to manipulate accounts.

Edited by gerbil
Member Avatar for solarfinder

This is my sysadmin hat coming on. If I may ask, why was the user changed from user to guest? Was this an instance where a user changed roles or was terminated? Was this device used for multiple users and you wanted to limit access?

I am just curious as to the why's to ensure you do the correction function in the future. I most definitely wouldn't rely on the previous version functionality in the future as those files are so simple to delete, and I'm surprised your IT group left it enabled. Are you looking to setup a single machine with multiple profiles or is this a limited use computer? Either way, it sounds like you are domain controlled and that affords you a good deal of configuration options for your domain joined devices. If this is something you're interested in learning more, please let me know.

Again, just my IT hat popping on.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.