Sloth

Thanks for the replys guys :-) McCoy you are right. Because I figured out what was causing the profiles to be created. I pretty much looked at the contains of the profiles and thought that it may be something to IE since the certificates were in there and what not. Anyways I tried everything and no luck.. Since the contains of the profile had hashes and certificates in it I thought maybe I will try to encrypt a file on the users home folder... anyways I created a txt file encrypted it, checked my server and sure enough a profile was created.. it is pretty interesting looking back on it now. it makes since that the server would have to have some info about the user who encrypted the file on the server so that that user could then decrypt it and view it's contents.... So the culprit seems to be NTFS filesystem encryption.

the UBCD for windows is pretty awesome. you can boot into an XP environment off of the cd and have a fair amount of apps. or you can just put the cd in while in windows on your hard disc. the CD has an autorun.inf that changes your start menu and you can run the apps included on the disc without having to install them. Photorec and testdisk are really good.. Recova is another good one which is also on the disc. but you can also just download those online as well. you don't need the ubcd4windows generally when just trying to get data off of a hdd I will use knoppix because it boots fast than the UBCD4Win

deep freeze is a really good program that prevents any changes to computers.. you can also look into mandatory profiles as well.

Hey Guys, I was on my 2003 box today and I noticed that there was a domain user's folder that was in C:\documents and settings\ the local security policy on the server only lets admins log in to the server so I was wondering if anyone knew how it was created. The users folder didn't have much in it just an applications data folder with only a few certificates in it, as well as ntuser.dat and a few other files. So it doesn't appear to be created from the default users profile... I thought some one may have ran a runas command but that creates a profile based on the default user. also under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList reg key the user shows up there but the "flags" dword is set to 5 where as other profiles that I have logged in with have other #'s the hkey for the user also lacks the ProfileLoadTimeLow and ProfileLoadTimeHigh dwords any help will greatly be appreciated.