Win7 deleted my user

[CU]

My machine locked up over night and when I booted it backup only my account called "backup" which has admin rights and is used for making backups is now listed. My user account is now missing. I logged in as backup and can see my user directory still there. What is the best way to restore my user account? Can I create a new user and tell it to use my old user directory? Are all user settings stored in your user directory? Anybody have this happen before or no what could have caused it?

 

[inachu]

I suspect that account you can not see is now corrupt.

It is best to save that data in the user profile then rename it.
Then visit inside the registry: H KEY LOCAL MACHINE/software/Microsoft/Windows NT/Profilelist

Find the profile then delete it.

reboot then you should be able to log back into the account then as you sign in then it will create new profile with new desktop then you can copy over the old data from the old profile folder depending if you found it worthy to save or not.

Profile corruption is not too rare to happen.

 

[CU]

It is best to save that data in the user profile then rename it.
Then visit inside the registry: H KEY LOCAL MACHINE/software/Microsoft/Windows NT/Profilelist

Find the profile then delete it.

reboot then you should be able to log back into the account then as you sign in then it will create new profile with new desktop.

So, copy my user directory and delete my profile in the registry. Then my user should show up on the login screen again without me having to recreate the user? Where is the actual user account login information stored?

I forgot to mention when I looked for my user in the manage user control panel, I didn't see it. Only quest and backup. Not sure if that makes a difference or not.

 

[inachu]

Click on START BUTTON,CONTROL PANEL, USER ACCOUNTS

 

[inachu]

If you did not see it from there then it might not show up at all and might have been accidently deleted.

No idea on how an account can be deleted with no user interaction unless a virus or script for a virus was run to create havok on your pc.

I suggest you scan your pc for viruses/malware then run chkdsk c: /f

 

[CU]

Yeah, the user doesn't show up in the control panel. At least my user directory and data is still there.

If a virus did it, I would have thought it would have deleted the data also, but maybe it wanted to be more of a nuisance than a royal pain. I have Microsoft Security Essentials installed and I believe I have malwarebytes installed also which I can run.

 

[Ketchup]

Well, if the rest of your data is there, copying your data to a new account might not be the end of the world.

The bigger question for me would be why. The top things I am thinking of is drive corruption or a virus.

 

[Burpo]

He could also try a System restore to before it happened.

 

[CU]

I thought about a system restore and windows did make recent ones. Any way to see what changes between the restore points and what you have now.

 

[corkyg]

I thought about a system restore and windows did make recent ones. Any way to see what changes between the restore points and what you have now.

The Restore date should tell you that. You want to restore to a date before the problem started. Anything done since then will not be. Also, you can undo a system restore.

 

[CU]

Considering I don't know the last time I rebooted it the problem could have existed for awhile and not presented itself until a reboot. Worth a shot though. I am going to work on it tonight, so I will try that first.

 

[CU]

Just started working on it and noticed my user is still listed in HKEY_LOCAL_MACHINE/software/Microsoft/Windows NT/CurrentVersion/Profilelist

I also see my user under user profiles in the system properties advanced tab.

It just doesn't show up under control panel account or at login.

Does that help any in finding out what happened?

 

[inachu]

Just started working on it and noticed my user is still listed in HKEY_LOCAL_MACHINE/software/Microsoft/Windows NT/CurrentVersion/Profilelist

I also see my user under user profiles in the system properties advanced tab.

It just doesn't show up under control panel account or at login.

Does that help any in finding out what happened?

No.

the security ID pid for that old user name is missing for the account and you must create via the steps I mentioned above.

I am just one person supporting almost 500 computers all alone and see this often at my facility I support.

Forcing to reuse the same without deleting it first will mean logging in with a temp profile which will load new each time you do that.

 

[Burpo]

Restore! It will work or it won't.. It's that simple..

 

[CU]

Restored back two restore points no luck. Any further and I get into programs being installed or uninstalled. Think I will try inachu's method next.

 

[VirtualLarry]

Sure the user was actually deleted, and not just flagged as "hidden" somehow. ("Hidden", meaning that you can't see it or log into it.)

NVidia's drivers, if you install the NVidia update service, creates a "hidden" user for the NV drivers to use. You can see it if you go into Parental Controls, I believe.

 

[CU]

Well I renamed my old user folder and deleted the key for my user in the registry. I then created a new user. I had to use a different user name though. It kept saying I could use special characters like &:;, etc. But I was only entering Eric. So I don't know what the problem was. Any way I just used another name. I then logged in as the new user then back as the backup user and copied all my old user files including hidden files into the new user folder. I didn't copy the old ntuser files though. It worked mostly. My desktop icons lost there positions and the taskbar and system bar are different. My pinned apps are gone and I think I few things may not be auto starting anymore. But overall it seems to have worked.

Something else strange. I use to have my login picture set as a chess piece, but that doesn't seem to be any option anymore.

 

[CU]

Sure the user was actually deleted, and not just flagged as "hidden" somehow. ("Hidden", meaning that you can't see it or log into it.)

NVidia's drivers, if you install the NVidia update service, creates a "hidden" user for the NV drivers to use. You can see it if you go into Parental Controls, I believe.

Probably doesn't matter now, but how do you hide and unhide users?

 

[CU]

Something else is strange all my pictures no matter where they are located in my user folder are no longer accessible when I double click them. I get "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." Although I can right click and open in paint without any issue. Any thoughts?

Edit: It seems the are associated with Windows Photo Viewer. When I right click and try to open them in that I get the same error. I cannot find Windows Photo Viewer in my start menu, so maybe the program is missing?

Edit2: OK I found other things that give that same error. When I right click on the desktop and choose personalize or screen resolution I get the same error. I also cannot set Chrome as my default browsers. Clicking the button to do it in Chrome has no effect.

 

[VirtualLarry]

Starting to sound like you have some uber-virus, OR, your drive is failing, and losing sectors.

Can you run something that will display SMART data? Like CrystalDiskInfo, or HDTune Free?

 

[CU]

CrystalDiskInfo says the drive is good. Malwarebytes and MS Security Essentials find nothing. I really think coping the user folder over has messed with permissions.

 

[CU]

I switched to the backup user and I don't get any of these errors. So, it is limited to my user.

 

[inachu]

Sometimes a virus/malware will make it look like a file name is like example.txt but will have the true extension hidden from you.

A few here at anand like to use http://www.herdprotect.com/

Please download and start scanning.

 

[CU]

I haven't heard of herdprotect before. I can try it tonight. I also thought about creating another user and copying a folder at a time in to the new user until it breaks. Or maybe don't copy hidden or os files this time, but the MS link I found said to copies those also.

This is the link I used along with inachu's instructions.
http://windows.microsoft.com/en-us/windows/fix-corrupted-user-profile#1TC=windows-7

 

[CU]

Glad the forums are back.

Now for an update. WD software said the drive was fine. HerdProtect says I am good. Other things I have noticed. I cannot double click a folder on my desktop, but I can right click open that folder. The double click gives me the same error as double clicking an image file. Movies are the same way. Although I can open windows media player and play them. I also cannot run c:/windows/explorer.exe by double clicking on it. Even though it is executable by SYSTEM, Adminstrators, Users, and TrustedInstaller. And my new user is in Adminstrators, HomeUsers, and Users. I also created another new user and didn't move any files over to it and it functions fine. So, something happens when I copy my user directory over. I copied everything including hidden files and os files except for the ntuser files just like the link said.

Also my original user still lives, that is why I could not create another user with that name. I can only see it when I run netplwiz. It only belongs to HomeUsers though. Would a user only in that group show up on the login screen? Could that be the original problem?