Temporary Profiles on a Domain

Question

We are experiencing an increasing issue where users are logging into their computers with temporary profiles. Logging off and back on (sometimes multiple times) or restarting the computer resolves the issue for some users temporarily, but this has become a recurring problem.

The steps we've taken to address this include:

• Modifying the registry to remove .bak profiles.

Reverting the profile path to the original user directory.

Removing both TEMP and affected profiles, which led to data loss, despite backups being made.

We have already checked AD for users profile paths and this all seems correct

Specific cases include:

User A: Temporary profile issue resolved initially by registry changes, but the issue reoccurred after a few days. Profiles were ultimately removed, causing data loss (backup was available).

User B: This issue has persisted for over a week, requiring repeated logoffs and restarts.

Additional details:

Devices are running the latest Windows updates.

Logs show User Profile Service errors.

We have logged a case with Microsoft and got a ticket number however they are not responding to us. I requested a read receipt which came back saying email was deleted without being read.

We request assistance in diagnosing and resolving the root cause of this issueWe are experiencing an increasing issue where users are logging into their computers with temporary profiles. Logging off and back on (sometimes multiple times) or restarting the computer resolves the issue for some users temporarily, but this has become a recurring problem.

The steps we've taken to address this include:

Modifying the registry to remove .bak profiles.

Reverting the profile path to the original user directory.

Removing both TEMP and affected profiles, which led to data loss, despite backups being made.

We have already checked AD for users profile paths and this all seems correct

Specific cases include:

User A: Temporary profile issue resolved initially by registry changes, but the issue reoccurred after a few days. Profiles were ultimately removed, causing data loss (backup was available).

User B: This issue has persisted for over a week, requiring repeated logoffs and restarts.

Additional details:

Devices are running the latest Windows updates.

Logs show User Profile Service errors.

We have logged a case with Microsoft and got a ticket number however they are not responding to us. I requested a read receipt which came back saying email was deleted without being read.

We request assistance in diagnosing and resolving the root cause of this issue

Answer 1

Diagnosis Checklist

User Profile Service Logs

• Check Event Viewer→Applications and Services Logs→Microsoft→Windows→ User Profile Service
• Look for Event IDs like 1509, 1511, 1515, and 1518, which point to profile loading errors or corruption

Permissions on User Profile Folder

• Navigate to C:\Users\{username}
• Right-click→Properties→Security tab
• Ensure the user has Full Control over their own folder. Occasionally NTFS permissions are altered and the system can’t load the profile

Registry ProfileList Consistency

• Path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
• Ensure:
  • There are no duplicate SIDs with .bak
  • The State value is 0
  • The ProfileImagePath is correct and points to the expected folder

Disk Health

Run chkdsk /f and sfc /scannow on affected machines.

• A failing disk can cause delayed or corrupted profile reads, triggering the temporary profile fallback

Antivirus / Endpoint Security Software

Aggressive security software can lock or delay access to NTUSER.DAT, leading to profile loading failures.

• Temporarily test affected users with AV disabled or in safe mode

Roaming Profiles / Folder Redirection (if used)

• Check for slow connections or incorrect permissions to redirected folders.
• Look into Group Policy Objects (GPOs) that might interfere with user profiles

---

Resolution Steps

Option 1: Rebuild Affected Profiles Cleanly

• Log in as admin, back up user data.
• Remove the SID from:
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  • C:\Users\{username}
• Ensure no .bak keys or orphaned profile folders remain
• Reboot and let the profile be recreated cleanly
• Restore user data except NTUSER.DAT and AppData folders that might reintroduce corruption

Option 2: Implement a Centralized User Profile Monitoring System

Use Event Log forwarding to a central log collector or script a scheduled task that:

• Checks for .bak profiles
• Monitors profile creation times
• Sends alerts on recurring failures