365 desktop files being deleted

Question

We have had 2 users report there desktop files/folders being removed after a password change. I have now found the same behavior one of my computers. It seems that I had about 100 files and folders sent to the recycle bin at 1:43am from my desktop environment. This issue is only occurring on our recently deployed 365 machines, so I am not sure if its a policy that needs to be changed. Let me know what other info you need to understand this unexpected behavior.
thx
PJ

Answer 1

Hi @peter jilek

Welcome to Q&A forum, I have following questions to confirm.

1 >> We have had 2 users report there desktop files/folders being removed after a password change.

<< Could you please tell us what password did these 2 users change? Such as O365 account password or others.

2 As I find that you add a tag with OneDrive, are the Desktop folder and other Windows known folders synchronized to OneDrive?
If yes, are deleted files large?
I suggest you click OneDrive icon > Help & Settings > Settings, tick the box of "Before many files that I deleted on my PC are removed from the cloud".
Please also tick the box of "Save space and download files as you use them" for a test.

3 Is there any security software enabled on computers, if so, please turn it off temporarily to check this issue.

Any updates, you could let me know.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 2

Hi,
The password change was on the corp AD. I have noted the local onedrive settings and can confirm that users (now at 5) have the 'notification before delete' selected. This notification option did not occur. With my case as an example the file/folder deletions took place between 5pm to 4am.
Looking at the 365 audit trail, we have found that the user 'system account' was the cause of the deletions. We are not sure how to trace the trigger for this action.
thx
PJ