Home folder deletions

[Badaz52]

We are having a strange issue with some staff users. Some staff are having files deleted from their home folders. Anything that is in the root gets deleted and anything in folders too but the folders remain. We have asked them to change their passwords and they have but it still keeps randomly happening. We have auditing turned on but it only keeps the logs for 40 minutes so we keep missing any indication of what is happening.

 

Does anyone know an effective way of logging things like this?

 

We use Panda Adaptive defense for our anti ransomware,malware etc and it isn't showing anything.

[mavhc]

Enable auditing of file deletion on the server as a starting point

[DarkMaster]

we had this with a rogue version of office deleting files

[synaesthesia]

we had this with a rogue version of office deleting files

 

Can you elaborate on that please?

 

@Badaz52 - do you have OneDrive or Google Drive in use?

[DarkMaster]

about a couple of years ago when opening word it would delete all files from users home drives, we would restore and then it would happen again. eventually downgraded the release and all worked fine. we use OneDrive but this wasn't affected.

[mikes]

think I remember an issue like this with a bad Offline files config - it was trying to cache network files locally but deleting them or something - this was back in the Windows 7 days though

[Badaz52]

Can you elaborate on that please?

 

@Badaz52 - do you have OneDrive or Google Drive in use?

 

We use OneDrive but there are no synchronization rules or permissions set up. It is weird as all of the folders are left intact but every file gets removed. Auditing shows it was the user and we have checked and no one else has logged in somewhere else as that user either remotely or locally. It seems quite random, some users can go a few days without issues.

[Steve21]

We use OneDrive but there are no synchronization rules or permissions set up. It is weird as all of the folders are left intact but every file gets removed. Auditing shows it was the user and we have checked and no one else has logged in somewhere else as that user either remotely or locally. It seems quite random, some users can go a few days without issues.

 

Is it all users or only those with laptops etc?

 

That sounds like what might happen if Offline files sync'ing and "updating" one area with the other etc. As it'll always sync the version it deems newest etc which would also remove files that don't exist on other source

 

Many thanks,

Steve

[Badaz52]

Is it all users or only those with laptops etc?

 

That sounds like what might happen if Offline files sync'ing and "updating" one area with the other etc. As it'll always sync the version it deems newest etc which would also remove files that don't exist on other source

 

Many thanks,

Steve

 

No its desktop users too. We also don't allow offline files as we disable the service using GPOs.

[synaesthesia]

This sounds eerily similar to the issue we have with Google Drive - Google's support have been poor regarding how long it's taken them to investigate but their most recent offering suggests deletions were taking place courtesy of Office applications. From the log's perspective, the users "did it themselves" which we can prove isn't true. Offline files was also a query for us as it appeared to start happening when I made a change to it (change being removing it entirely via GPO).

[Badaz52]

This sounds eerily similar to the issue we have with Google Drive - Google's support have been poor regarding how long it's taken them to investigate but their most recent offering suggests deletions were taking place courtesy of Office applications. From the log's perspective, the users "did it themselves" which we can prove isn't true. Offline files was also a query for us as it appeared to start happening when I made a change to it (change being removing it entirely via GPO).

 

It does sound similar, we don't use google drive and offline files is disabled across the site and has been for years. If it is the same thing is there no fix currently?

[Badaz52]

It is some staff, some of the time that is the strangest thing. We can go a day with nothing then two or three in one day. One staff member lost her files I restored them and she lost them again an hour later. Naturally during HT there was no change to their home folders.

[synaesthesia]

Likewise - out of nearly 90 staff it only affected about 15. Kept hitting dead ends in investigation as it didn't impact support staff, didn't impact desktop computers, however as very few support staff had laptops it was a bit of a red herring.

Although one member of staff who had 40,000 files deleted at one time, I have the laptop and account to hand and I can't for the life of me make it happen again. Next time I get 5 minutes I'm going to check some things like if the Office app updated.

[Badaz52]

Likewise - out of nearly 90 staff it only affected about 15. Kept hitting dead ends in investigation as it didn't impact support staff, didn't impact desktop computers, however as very few support staff had laptops it was a bit of a red herring.

Although one member of staff who had 40,000 files deleted at one time, I have the laptop and account to hand and I can't for the life of me make it happen again. Next time I get 5 minutes I'm going to check some things like if the Office app updated.

 

It does sound like exactly the same thing then. We have had no reports from support staff only teachers and the same it is about 10-15 of them. I have checked event logs, appdata modified times. Everything and I can't make it happen. The only thing that is consistent is it happens either at the start of the day or at the end.

[kennysarmy]

It does sound like exactly the same thing then. We have had no reports from support staff only teachers and the same it is about 10-15 of them. I have checked event logs, appdata modified times. Everything and I can't make it happen. The only thing that is consistent is it happens either at the start of the day or at the end.

 

Can you swap a couple of PC's between users, one user who gets the issue and another who doesn't to narrow down if it's the user or the device at fault?

 

Hopefully it will be the device then you can just re-image and ensure latest Windows, office version etc.

[Badaz52]

I've just stumbled across this

and it is something we have changed recently. As exams are ongoing some users haven't been saving their work so I moved the autorecover from their profile to their home folder and based on this post it would seem that PowerPoint behaves differently with autorecovery than Excel and Word do.

[psydii]

Microsoft are make big changes ahead of Server 2025, I wonder if some of this new code has found its way into the client-side Monthly updates. Last time they made such big updates (12 years ago) the problems caused/were caused by bugs at almost every level the systems, client tcp/ip, filesystem redirectors, client-side-cache, memory management, the smb server components, and then finally Office apps and the way they handled files too.

[synaesthesia]

Ooooh this is getting interesting - @Badaz52 what version of Office are you running exactly please? Powerpoint specifically, the build number.

We're on 2201 which looking at the update page might be a little old. If you're on similar...

[synaesthesia]

Just adding to this - an affected user I've had logged on for 2 days hasn't had an issue. I've just opened Powerpoint, started a new file - 5 minutes later and *bang* - deletions.

Autorecovery is set to G:\My Drive in this instance so not the home folder which is H:\

Changing this now and testing

[Badaz52]

Just adding to this - an affected user I've had logged on for 2 days hasn't had an issue. I've just opened Powerpoint, started a new file - 5 minutes later and *bang* - deletions.

Autorecovery is set to G:\My Drive in this instance so not the home folder which is H:\

Changing this now and testing

 

Our issue has gone away now. We changed the autorecover location to a sub folder in their home folder instead of the root and it has stopped. It seems that this only happens with powerpoint autorecovers and not word or excel. The version of PP we have is:

 

2112 build 14729.20260 365 apps for enterprise.

[synaesthesia]

Yeah, likewise. Set the autorecovery location back to the default appdata, and put in an update for Office 365. Also confirmed it doesn't happen with Word or Excel.

Setting it to the home folder gave us exactly the same symptoms as you - Google Drive was then safe, but the home drive lost files but not folders. I'll move to a subfolder in summer

A very oddly specific bug this one!