Phantom Profile

[Tim_S]

I have a strange occurance happening and I don't know
exactly why it is happening.

I get a second "Phantom" profile being created in XP.

Meaning, that when I log on to the Local account, I see a
1. UserName.MachineName (local account)
2. UserName (Domain account)
3. UserName.Domain.000

The profile #3 above contains a My Documents folder that
is empty and NOTHING else. This is the phantom profile.

I can log on to the local profile and delete #3 without
issue. Log on to the #2 account (which is the valid
domain account that has my data) The #3 profile tree does
not reappear at time of logon. Later in the day, it pops
up.

Now I suspect that on our systems there is a Daily Scan
of Symantec AV running about 11:30am. And Tivoli does a
occasional inventory scan (random but not daily). Could
one of these be creating this folder as a temporary
folder and not deleting it? Or could it be some network
driven software that is probeing for vurlnerabilities by
our network god's?

 

[Drew Cooper [MSFT]]

I don't know if this can happen in other ways, but a failed profile load
will create a new profile on the machine with the .<number> naming
convention. Here's a long series of guesswork that's probably wrong but
might help you anyway:
Something could be logging on as you, trying to load your profile, and
failing. That something may be a scheduled task. Whatever it is, it might
be failing because your profile is in use. Some filter driver (like AV
software) might be holding handles open. Maybe you have your My Documents
folder open on your desktop.

Hope some of that gave you a useful clue in your investigation.