Showing results for 
Search instead for 
Did you mean: 
Level 7

User mysteriously removed from his machine

I have a user who reported being removed from his machine on a sync.

See screenshot of local client sync:

See screenshot of machine audit. I do see entries with the wrong timestamp.

I've also checked the audit log for each helpdesk admin and see no changes to the machine object.

Is there any place else I can check to see why/how the user was removed from the machine?
0 Kudos
1 Reply
Level 7

RE: User mysteriously removed from his machine

we have noticed in our enviroment that safeboot is very sensitve to incorrect date and time stamps and with our large base of mobile workers this has resulted in a lot of account corruptions both on the server and the local device.

We have got around this by making sure our SB server sync with the NTP server then setting the client device to sync thier date and time with the server (the option can be set under the device properties tab in the managment console)

I know this dosnt show you how the account got removed but it most likely hasnt its jsut corrupt. so clear the machine audit, recreate the users token and turn on the time settings and you should see the problem go away. hope this helps
0 Kudos