Corrected Laptop Time in BIOS - user profile files in windows now missing

donaghs

Just wondering if anyone ever seen this before. First time in my 20 years of IT work.

Assisting someone with a personal laptop issue, old laptop running Windows 10 education edition. Battery almost useless, windows keeps losing the time. e.g. thinks its something like 2050. Which means that the user cannot get online due to incorrect date/time.
the user cannot change the time in windows due to their organisation not giving them admin rights. And no remote support available.

I had a look, and noticed that the BIOS time/date was the same incorrect one as in windows. I changed that, saved changes and windows booted up and they logged in.
However.... all the work in the users windows profile is gone. All their word, excel, etc. every thing else looks fine - same programs installed.

Apart from the pain of them losing it, i'm baffled and have never ever seen this before.

Any thoughts?

HalfAndHalf

donaghs wrote: »

Just wondering if anyone ever seen this before. First time in my 20 years of IT work.

Assisting someone with a personal laptop issue, old laptop running Windows 10 education edition. Battery almost useless, windows keeps losing the time. e.g. thinks its something like 2050. Which means that the user cannot get online due to incorrect date/time.
the user cannot change the time in windows due to their organisation not giving them admin rights. And no remote support available.

I had a look, and noticed that the BIOS time/date was the same incorrect one as in windows. I changed that, saved changes and windows booted up and they logged in.
However.... all the work in the users windows profile is gone. All their word, excel, etc. every thing else looks fine - same programs installed.

Apart from the pain of them losing it, i'm baffled and have never ever seen this before.

Any thoughts?

Wow! Not something I’ve ever heard of before, did a quick Google and looks like you’re the first.

Are the docs in the profile stored on the lock disk or are they maybe redirected folders from a network share?

Have you tried changing the time back (to hugely forward of now like it was)?

Not that I’ve ever seen this before but gonna throw that out as maybe because the time is now before the doc create date it’s caused windows to throw a fit?

Good luck.

NickNickleby

Maybe the file is still there, but ignored because of its timestamp???

I vaguely remember it was possible to change file properties from the DOS window, if that worked for the timestamp as well, perhaps you can find it, edit it and Windows will once again recognise it.

Good luck.

the command was something like : 'attrib' (sorry I'm really digging deep into my memory here, at least 20 years since doing that kind of stuff.....)

HalfAndHalf

NickNickleby wrote: »

Maybe the file is still there, but ignored because of its timestamp???

I vaguely remember it was possible to change file properties from the DOS window, if that worked for the timestamp as well, perhaps you can find it, edit it and Windows will once again recognise it.

Good luck.

the command was something like : 'attrib' (sorry I'm really digging deep into my memory here, at least 20 years since doing that kind of stuff.....)

That’s a good shout there, do the files list through CMD with a DIR command?

donaghs

NickNickleby wrote: »

Maybe the file is still there, but ignored because of its timestamp???

I vaguely remember it was possible to change file properties from the DOS window, if that worked for the timestamp as well, perhaps you can find it, edit it and Windows will once again recognise it.

Good luck.

the command was something like : 'attrib' (sorry I'm really digging deep into my memory here, at least 20 years since doing that kind of stuff.....)

I googled this but found nothing. I did put the date way forward, and logged in again, but no difference.
All the user’s files from desktop, document, downloads, favorites, etc are gone.

Thinking maybe the files were not visible due to the lack of admin rights, I made a bootable Android usb and was able to browse everywhere on the disk, but can’t see any sign of the users files.

The files also don’t list in windows “dir” cmd search, but the user isn’t an admin, so if the profile was renamed to something else I thought maybe it wouldn’t have access. I’m starting the think they are just gone for good. Unless a hard drive recovery tool could maybe find something. But can’t install software with admin rights and don’t have a caddy for that hard drive size anymore

Very disappointing, but very strange too!

HalfAndHalf

donaghs wrote: »

I googled this but found nothing. I did put the date way forward, and logged in again, but no difference.
All the user’s files from desktop, document, downloads, favorites, etc are gone.

Thinking maybe the files were not visible due to the lack of admin rights, I made a bootable Android usb and was able to browse everywhere on the disk, but can’t see any sign of the users files. Very disappointing, but very strange too!

You say their organisation haven’t given your friend admin rights but it’s their personal computer?

Is it a work laptop they’re using at home? I ask because all of the folders you name can be redirected folders by group policy. Perhaps the laptop is only configured to work on LAN and doesn’t have a VPN client?

HalfAndHalf

In fact the more I think about it, if it is a work laptop or has found its way home from work, could the browsing issue also then be a proxy configuration problem? Maybe it’s pointing at some firewalls or internet gateway of some description, or has a static IP set?

Sorry, this is one of those problems that gets my support brain twitching....it’s been a few years though.

donaghs

HalfAndHalf wrote: »

You say their organisation haven’t given your friend admin rights but it’s their personal computer?

Is it a work laptop they’re using at home? I ask because all of the folders you name can be redirected folders by group policy. Perhaps the laptop is only configured to work on LAN and doesn’t have a VPN client?

It was a personal request, but their work laptop, which they use at home, since lockdown. They don’t appear to have a vpn client. Since not on LAN they had used google drive for sharing with colleagues. I can only hope they enough useful stuff backed up.

No static ip, works fine getting a dhcp address from home broadband. Fixing the time fixed the browsing issue - but lost the files.

NickNickleby

treat the following as very dangerous rubbish.

I fixed my wife's login before, by searching through the Registry and making some change I'd found in Google. I think it controlled the profile files. perhaps I'm imagining it, but perhaps there was a field like "the old profile filename and location" , but exactly where in the registry this was, I cannot remember. But certainly I tweaked something to do with the profile.

even now, I'm not opening the Registry to snoop, I'm so afraid of it.

HalfAndHalf

donaghs wrote: »

It was a personal request, but their work laptop, which they use at home, since lockdown. They don’t appear to have a vpn client. Since not on LAN they had used google drive for sharing with colleagues. I can only hope they enough useful stuff backed up.

No static ip, works fine getting a dhcp address from home broadband. Fixing the time fixed the browsing issue - but lost the files.

Have they had access to the folders and files while at home and it’s definitely changing the BIOS time that’s caused it? I’ve wasted many a day tracing a problem I thought I’d caused because of coincidence.

I might way off course but with what you’ve said it does feel like a redirected folder issue, especially if they’ve had to use Google drive to share files so they’re working around an issue using the normal way.

NickNickleby

Profile List - Manual Registry Edits
Registry Hive: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList



That's where I found it. I think I renamed the 'current' one to .old and removed the .bak from the other entry below (or perhaps above) it.

This is risky, but as the guy said ... "worse? WORSE?? how could it be worse? Jehovah! Jehovah!"

NickNickleby

BTW, if BIOS is forgetting the time, and if the technology hasn't changed since my time then there's probably a coin battery on the motherboard that needs replacing. It also helps the BIOS to remember that a hard disk exists and some of its details.. careful !!

HalfAndHalf

NickNickleby wrote: »

BTW, if BIOS is forgetting the time, and if the technology hasn't changed since my time then there's probably a coin battery on the motherboard that needs replacing. It also helps the BIOS to remember that a hard disk exists and some of its details.. careful !!

Also a good shout, failing or failed CMOS battery would definitely screw the time/date. Not sure on causing profile related issues but would also cause issues booting to the OS and loading hardware related drivers.

jhud

NickNickleby wrote:

Profile List - Manual Registry Edits Registry Hive: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

NickNickleby wrote:

That's where I found it. I think I renamed the 'current' one to .old and removed the .bak from the other entry below (or perhaps above) it.

Had this happen with users I have dealt with mainly with window 7 but in order to do registry edit you need admin. There work IT department is the only one who can support this. If you can boot with Ubuntu then maybe see files nothing else you can do.

Just one thing did you see the files before changes or they are telling you they were there. The amount of times users have mistakenly told me one place and I have found them elsewhere.

free_man

I remember that there was a Windows10 update which screwed up user profiles about 1-2 yrs back.
Check the work/home laptop is still using that particular windows10 version.

The BIOS time setting might have triggered whatever caused the issue in the windows10 update.

HalfAndHalf

Did ye get it sorted?

DopeTech

It won't get the files back but if it's that old the company should be swapping it out for a new laptop. Do they have an it department or person? Have they looked at it? Really she shouldn't be getting anyone else to look at it without it being ok'd first.