Restricted Users folder in Documents and settings

[Sloth]

Hey Guys,

 

I was on my 2003 box today and I noticed that there was a domain user's folder that was in C:\documents and settings\

the local security policy on the server only lets admins log in to the server so I was wondering if anyone knew how it was created.

 

The users folder didn't have much in it just an applications data folder with only a few certificates in it, as well as ntuser.dat and a few other files. So it doesn't appear to be created from the default users profile...

 

 

 

I thought some one may have ran a runas command but that creates a profile based on the default user.

also under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList reg key

the user shows up there but the "flags" dword is set to 5 where as other profiles that I have logged in with have other #'s

the hkey for the user also lacks the ProfileLoadTimeLow and ProfileLoadTimeHigh dwords

 

any help will greatly be appreciated.

[featured_spectre]

Could have simply been copied by accident.

[DMcCoy]

I have seen this on 2003 and 2008 servers, I never did track down the process that causes the profile creation, although I am sure it wasn't the users logging into the server.

[Sloth]

Thanks for the replys guys :-)

 

McCoy you are right.

 

Because I figured out what was causing the profiles to be created. I pretty much looked at the contains of the profiles and thought that it may be something to IE since the certificates were in there and what not.

 

Anyways I tried everything and no luck..

 

Since the contains of the profile had hashes and certificates in it I thought maybe I will try to encrypt a file on the users home folder...

anyways I created a txt file encrypted it, checked my server and sure enough a profile was created..

it is pretty interesting looking back on it now. it makes since that the server would have to have some info about the user who encrypted the file on the server so that that user could then decrypt it and view it's contents.... So the culprit seems to be NTFS filesystem encryption.

Edited February 2, 2013 by Sloth

[Patrickv]

Remote Desktop Connection purhaps, I have seen an example of a domain user login into a server remotely.

[MordyT]

EFS will do it since you have to spoof kerberous login or something like it.

 

GPO to prevent EFS solved it for me.