EXE files disappear on logon for domain profiles

Question

I have an issue where EXE files disappear on logon for domain profiles. Here is what I know:

-EXE files will remain when they are downloaded to local profiles. We have to place the Zoom EXE file on the local admin account and place a shortcut to that on the user's desktop in order for it to remain otherwise, we have to re-download and install.

-The EXE files are disappearing on sign on and not sign off. I placed a WebEx Teams EXE file on a machine's domain profile's desktop and navigated to that desktop using file explorer on my machine. I signed out on the other machine and the file remained. I signed in on that machine and the file disappeared.

-I do not believe a group policy is the culprit. I moved my machine to an OU that did not have a GPO applied to it and placed a WebEx Teams EXE file on my desktop and it still disappeared.

I'm lost now. Does anyone have a clue what might be going on?

Answer 1

Sounds like it might be a user logon script. Trace the activity with Process Monitor.

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

Search for the .exe file and see what process deletes it.

https://www.bing.com/search?q=how+to+use+process+monitor