[2004, 20h2] March CU - Missing User Files

[smarties11]

Hi All,

 

Is anyone seeing any issues, since installing March 2022 CU, with users 'losing' files on their home drives? Could possibly be related to folder redirection, as we use group policy to redirect Documents to a file server?

 

I've had two users reporting missing files today - where the vast majority of their files missing - but much of the folder structure is still intact. I've also identified some other users who are affected but haven't realised. Looking at file history, it started happening yesterday, and in to today - I approved the March CU late Friday evening for clients and patched the servers Friday evening. It hasn't affected any other file shares, just redirected documents - so this is where my suspicions are currently pointing - possible issue with March CU and redirected documents.

 

I've had a google search and on here and can't find anything relevant.

 

Interested to hear from others?

 

Thanks

[smarties11]

Hi All,

 

A bit more detail to share.

 

We've had a further 6 members of staff affected by this today. It isn't affecting students (but we have students in the 'guest users' local group so profiles are not saved).

 

I'm using Netwrix Auditor to audit the user shares, which has confirmed that the deletions are originating from the user account and terminal that the user is currently logged in to, as I suspected.

 

It always happens within a few minutes of logon (today it was 3m, 3m, 7m, 2m, 5m, and 2m after logon respectively for the 6 users affected).

 

I've checked back manually through all users prior to installing Auditor, and in total we've had 13 cases prior (with two of those also being in today's 6, i.e. re-affected)

 

Now I can identify them quickly through Auditor, I can run the report twice a day then quickly restore the files from shadow copies before users notice. Interestingly, only 2 have noticed, which were the 2 that caused me to look further.

 

So this is something that is occurring very quickly after logon in all cases. It's only happened so far on PCs that have installed the March CU (but that is pretty much all our estate, now) and only started on Monday morning, after deploying March CU in SCCM on Friday evening.

 

The other update I also deployed at the same time, and again is installed on all affected PCs is the Office 365 ProPlus Client - 2201 14827.20220

 

Tomorrow I'm going to install some file auditing tools on one of the machines it has occurred on, to see if I can replicate it and see what process is removing the files. I'm still suspecting redirected folders; we also redirect favourites, downloads etc so could be Edge?

 

Typically this is the first time I've deployed updates this quickly after RTW, I usually wait a couple of weeks - but have been mindful of NCSC guidance to apply patches immediately in the current threat landscape, particularly where there were some fairly high level exploits fixed this month.

 

Any ideas appreciated!

Edited March 16, 2022 by smarties11

[smarties11]

UPDATE: procmon shows that the files are being deleted by powerpnt.exe - new thread made here -> http://www.edugeek.net/forums/office-software/226894-powerpoint-deleting-user-files-after-2201-14827-20220-update.html

 

Mods feel free to merge / delete this thread as you see fit.