Windows update deletes profiles

Question

Hi

In the last 6 months or so we have had several laptops where, after Windows Updates have run, the user's profile is deleted. These laptops are joined to our Azure AD (which syncs to our on-premise AD).

This is NOT the issue I've seen many times where a temporary profile is created but you can still get access to the data and copy it back.

When the user logs on after the updates it is resetting their profile as if it is the first time they have logged on. All data is gone. The laptop is not resetting, just deleting the user profile.

I only have a note of the updates which were run for the most recent one - it was CU for Windows 10 21H1 (KB5015807) and Security Update for Office 2016 (KB5002112)

I can see entries in the event logs stating "Windows Search Service indexed data for user 'COMPANY\user.name' successfully removed in response to user profile deletion" - but I can't see any reason WHY the profile is deleted.

We know people shouldn't store data on laptops or should take backups but most don't. That's another discussion. But it still doesn't explain why the profiles are being deleted - this should not be happening. I've even tried trial versions of data recovery software but these aren't finding the missing profiles, which I really don't understand.

Has anyone got any ideas why this is happening as we are getting a log of flack for this as we don't have a resolution.

Thanks

Answer 1

Search is not removing the profile, it is only reacting on the removal. ProcMon may help you get to the bottom of what does the deletes.
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi

Thanks for the reply

Yes, I realise that Search isn't deleting the profile. I highlighted this as really the only log entries I can see which are showing that the profile is being deleted.

There is also another entry for Search which says "Windows Search has created default configuration for new user 'COMPANY\user.name"

I'm not sure how procmon helps to determine what is happening, unless it is actually running when the profile is being deleted, or am I missing something ? The deletions seem to be totally random at the moment (as far as we can tell) and we can't reproduce the problem because of this .

Thanks

Answer 3

Hello,
This may be best addressed by opening a support case.
There are a couple of registry values to check, one around WMI controlling profiles and a policy where profiles are deleted after some number of days
Registry setting to check values on a report back:
WMI controlling values:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\UserState\UserStateTechnologies\ConfigurationControls
RoamingUserProfile
HKLM\Software\Microsoft\Windows\CurrentVersion\UserState\RoamingUserProfile
CleanupProfiles

GPO controlling value:
HKLM\Software\Policies\Microsoft\Windows\System
CleanupProfiles

Ideally we would like to see a procman from boot would be useful, but may not be easy to capture as this appears to be intermittent.
If you open a support case can you share the number of the case so it can be directed to the appropriate people.

Thanks
Darrell