This message was deleted.

This is due to locked credentials.

thanks for the tip, storing this for a cya

@Balint Oberrauch Do you have more information for this outcome? did you test this with your problematic servers or was this recommendation from a ticket?

I tested this, no more issues since then.

Just was curious how you stumbled on this?

Disabling Defender fixed it at first. handle64.exe by Sysinternals showed an open handle from lsass.exe on the Credentials folder and since excluding it we have no more locked Profiles.

Ok cool. Thanks man

our security department won't exclude it because of security reasons 😞

This has resolved issues with leftover local_username directories we were seeing on multiple servers, thanks 👍

@Selimir I do see it listed here. I know it’s not win10. But if MS recommens it for a DC, why will they not allow you to test with it on a VDI/RDSH? Process exclusions for AD DS and AD DS-related support files %systemroot%\System32\ntfrs.exe %systemroot%\System32\lsass.exe https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus?view=o365-worldwide#the-list-of-automatic-exclusions