mysterious user profile on server 1

[bookouri]

I have an AD domain with a 2003 member server that is used for misc file storage mostly. Its not a dc or exchange server or web server or anything special. Doing regular maintenance I noticed that there was a user profile created on the server that has no business being there. The profile is an active regular user who does not have any access to this server. The server is in a locked server room and this user doesn't even work in this physical facility but across town in another building. I looks like what i would have expected if a user managed to walk into the server room and log on to the server using their creditials, but this user has never been here. The only thing i could think of was that the user had stumbled across Remote Desktop and tried to log on to the server for some reason, bored, killing time or whatever. But I tested this with a test user, and since the user has no admin access remote desktop kicks them out as you would expect, and it does not try to create a user profile on the machine. I can't figure out any way to re-create this situation so I don't know what is going on.

Can anybody give me any idea how a non-admin user profile could have been created on a 2003 server without the user having physical access to the server? What remote event could have triggered creation of a user profile on this server?

thanks for any suggestions

 

[goombawaho]

I don't know of logical and technical reason why that would happen.

Best to look at the folder creation date of the user profile and then
A) ask the user if they did anything different that day.
B) ask other IT people including your boss if they've been doing anything.

Maybe this is a test of your ability to notice things.................
Best to report it even if you don't have a cause.

 

[bookouri]

Yep, already did all those and have no explanation so far. I know the date and time and that the user WAS logged on to his local machine that day about that time. So its still a mystery.