Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 3 subscribers
  • Views 4059 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NTUSER.DAT scanning and Profile Cleanups failing

Paul Granberg

Afternoon All,

 

  In the last few months we have been noticing that our automatic cleanups for Roaming profiles has not been occurring.  We have defined in Group Policy that any redundant profile older than 30 days should be removed from target machines.

  However it looks like our weekly system scans by Sophos are updating something in the NTUSER.DAt files located in C:\users\%username% .  As a result the time/date stamp is updated.

  Because the stamp is changed, none of the profiles ever get cleared as they all appear to the machine as having been accessed in the last 7 days.

 

  Is anyone else seeing this?

 

  Thanks in advance.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Paul Granberg,

    scans by Sophos are updating something in the NTUSER.DAt files
    never in, unless of course a cleanup is necessary - which shouldn't be the case with NTUSER.DAT.

    the time/date stamp is updated
    there are usually three, as you say updating something - are you talking about Last modified? As files are opened for read by the scanner only the Last accessed time would change, the scanner is instructed to preserve the value present. Haven't heard that it fails to do so. I assume "something else" is also involved.
    Also you should see the relevant timestamp change for all other scannable files as well. NTUSER.DAT doesn't get special treatment.

    Christian

Reply
  • 0

    Hello Paul Granberg,

    scans by Sophos are updating something in the NTUSER.DAt files
    never in, unless of course a cleanup is necessary - which shouldn't be the case with NTUSER.DAT.

    the time/date stamp is updated
    there are usually three, as you say updating something - are you talking about Last modified? As files are opened for read by the scanner only the Last accessed time would change, the scanner is instructed to preserve the value present. Haven't heard that it fails to do so. I assume "something else" is also involved.
    Also you should see the relevant timestamp change for all other scannable files as well. NTUSER.DAT doesn't get special treatment.

    Christian

Children
No Data
Unfiltered HTML