Windows Profile Corruption

You are handling a Windows profile-corruption ticket. The reflex — delete the profile and
start over — destroys user data nobody backed up. Confirm the state from the event log,
repair before rebuild, gate on data preservation. The tech works the device, via the RMM
where connected.

Climb the Troubleshooting Ladder base skill first: this device's past tickets, then the
documented profile architecture. A container profile (FSLogix and similar) follows that
product's playbook — route it; the local fix loses data there.

Read the Application log's User Profile Service events first: 1511 temporary profile, 1515
backup profile, 1521 or 1522 cannot load or locate, 1530 hive in use — often a scanner or
agent holding it. The ID separates a corrupt profile from one merely locked at logon, which
needs no rebuild.

Tell the user their original data is intact, but anything saved during the temp session will
vanish — save current work elsewhere now.

1. Locked, not corrupt (the 1530 pattern, intermittent temp logins that clear on reboot).
   Find the locker — AV or EDR at logon, backup agents, indexing — and fix its schedule; do
   not rebuild. If it's a managed security tool, coordinate with its owner rather than
   excluding profile paths.

2. Repair (single event, hive intact). Guide the tech through the registry ProfileList
   repair: the SID entry, the .bak duplicate pattern, ProfileImagePath and state per
   Microsoft's guidance — from documentation, not memory, and take a restore point first.
   Then reboot and verify a normal login. Registry work is tech-only.

3. Rebuild — repair failed, the hive is corrupt (1521 or 1522 persist), malware history, or
   corruption recurs. Check disk health and unexpected shutdowns first — a rebuild onto a
   dying disk is wasted work. Rebuild is a new profile plus data migration, only after the
   checklist below.

Data preservation is mandatory before any rebuild or deletion: nothing gets deleted before
this checklist is complete and verified — tell the tech so in those words. From the OLD
profile path, inventory and copy out Desktop, Documents, Downloads and Pictures; browser
profiles, exporting favorites and passwords properly rather than by folder copy; mail data
files — an OST re-syncs, but signatures and autocomplete live in the profile; app data per
the client's LOB list; and anything the user names. Confirm the copy is complete and
readable BEFORE the old profile is touched. Then create the new profile at a fresh first
login, migrate the data in, and reconnect mail, OneDrive and printers per the client's setup
doc. Never bulk-copy the old profile over the new one — that re-imports the corruption.

Verify with two clean logins including a reboot, and the user confirming data and mail are
present. Then note it (apply the PSA Note Discipline base skill): event IDs, branch,
inventory, cause, and verification.