Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of our staff PC has a problem, the scenarios:

Specs: (Alias Names)

  • Company Name: Contoso
  • Staff PC under Domain Alpha
  • PC Name: Contoso1-PC
  • Local Users are: administrators and john
  • User profiles:
    • Operations (Contoso domain)
    • John (local)
    • Administrator (local)
  • MS Outlook connected to operations@contoso.com

Thursday: IT

  1. Remove/uninstall chat messengers, blocked LinkedIn, Facebook, Twitter, YouTube
  2. Change User Account Type (Local Staff John Doe) from User to Guest
  3. I change the type from User Accounts > Properties > Group Membership > Others > Guest
  4. Shutdown the system

Friday

  1. Turn on the PC and staff asks for the correct username
  2. Provides the username, Contoso1-PC\john
  3. Staff login to his local account using his password

Saturday

  1. Staff called and his desktop files are gone and document files are gone
  2. IT check the Users folder there are particular folders:
  3. John and john.contoso1-pc
  4. Both folders empty
  5. Outlook not connected
  6. Account is totally fresh
  7. IT check on webmail under Domain Alpha, not working the usual password, webmail.contoso.com/owa
  8. After an hour, the usual password works
  9. IT tried to connect MS outlook 2003 using operations@contoso.com not working saying "outlook.pst is not offline file"

Problem:

  1. Files are gone
  2. Totally fresh account

I don't know what happen, guys please help, the files are gone.

share|improve this question

closed as unclear what you're asking by TildalWave, Adnan, NULLZ, Terry Chia, Xander Jul 7 '13 at 12:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
What's your question? –  Adnan Jul 7 '13 at 8:55

2 Answers 2

Although you aren't really asking a security question here - hopefully it will be migrated to SuperUser for technical help - there is a security question here of "how did this go so wrong?"

Various things immediately spring to mind:

  • Backups. If you don't have working backups of your important files, you are going to lose them. Guaranteed.
  • Separation of function. Your operations PC should be used for operations work and nothing else. Letting John log onto it to do non-operations work is asking for trouble.
  • Change control. Your IT guys have come up with their own fix to this problem and didn't test it properly before putting it into production.
  • Thinking security is a technical problem. You were trying to set up John's computer so it wouldn't let him access Facebook etc instead of just saying: "John, don't browse the web on the operations machine, it's a security risk."

I know this isn't much help now, but once the immediate crisis is passed, these are things to think about for the future to prevent there being a next time.

share|improve this answer

The core of your problem is that the USER account was downgraded to a GUEST account.

Mind you: a "guest" account is made for someone who does not frequently work at the computer, but merely "visits" it once and probably never returns to the computer again. Therefore, a "GUEST" account does not save anything. "GUEST" accounts are designed to have a clean profile each time the machine is booted. This means your beloved folders are indeed empty since the "GUEST" is no permanent user.

A "USER" account would have been low enough for your purposes and personally, I have a hard time to believe that IT messed this up. That is, unless access to the computer was meant to "forget" files instead of remembering them — which could be the case in very strictly secured working environments. But in that case, you would know about it and wouldn't wonder that files are gone which weren't meant to be stored on the computer in the first place due to company policy which IT merely enforced.

To wrap it up: don't expect a "GUEST" account to remember anything (files, passwords, etc.) as it's not meant to do that. Guess why it's called "GUEST"...

EDIT

As Graham Hill correctly pointed out in a comment to my answer, I confused "guest mode" with "guest account". Guess the confusion about what OP is asking shuffled some of my braincells.

Anyway, reading the description of OP again, one thing jumps into the eye:

Account is totally fresh

To me, this indicates the old account was indeed completely deleted and a fresh GUEST account created using the same credentials. Graham seems to share this suspicion, so chances are we're on the right track.

share|improve this answer
    
I think you're confusing "guest mode" with "guest account". The former automatically destroys the profile at the end of the session, the latter should not. I suspect the profile was destroyed at the point where the account was fiddled with. –  Graham Hill Jul 7 '13 at 12:12
    
@GrahamHill Yep. Reading the "question" again a few minutes ago, it started to dawn upon me that the old account most probably was deleted (aka destroyed) and a new account (with same username+pass) created. So I agree with your suspicion. But the more I read the question, the less I'm sure I really get what OP is asking. A solution? A reason? Hmmm... question is put on hold meanwhile. Maybe that's best. –  e-sushi Jul 7 '13 at 14:49
    
Another possibility is that if you destroy a user's profile, Windows creates a brand new empty one. (It kinda has to - the profile contains the user registry keys as well as the user data files, so without a profile you can't log on.) –  Graham Hill Jul 8 '13 at 0:26
    
@GrahamHill Endless options... ;) –  e-sushi Jul 8 '13 at 10:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.