Desktop shortcuts dissapear

NoelDP · 29 Mar 2013

That sounds like it may be a filesystem problem, or a firewall getting in the way (or malware)
What Anti-Virus and Firewall are you using?
What other AV's have EVER been installed?

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.

Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply.

UsernameIssues · 30 Mar 2013

Thanks Noel,

Symantec Endpoint Protection is the only AV ever on these images.
(These are corporate boxes at my office.)

The Windows Firewall is in whatever state these screens indicate (off?):

SFC and CHKDSK came up clean.

The NAS array that some of the shortcuts pointed to is weird...
...so I guess it was this: Broken shortcuts are deleted from the desktop in Windows 7
What threw me were the local shortcuts to network adapters that threw me.

On this laptop - the shortcuts to network adapters go away (maybe other stuff too - hard to tell). I'm keeping an eye on that - but I've not found the events causing that. Maybe I rush undocking it while bit is going to sleep.

NoelDP · 30 Mar 2013

I'm not familiar with SEP - but it appears to have its own firewall and so should have switched the Windows firewall off (properly!).

Are these OEM installs - re-imaged? If the OEM install is still in use, then the chances are that the original AV wan't removed properly, and you need to address that, and possibly remove/reinstall SEP.
Obviously, if a clean image was used, then that wouldn't apply.

Nothing in the Event logs??

UsernameIssues · 30 Mar 2013

I think that the computers are re-imaged with a company build.

I've looked thru the event logs several times - finding nothing - but I was looking in the regular app and system logs.

Searching for "System Maintenance troubleshooter" "event log"...
...lead me to this:
Control Windows 7 Scheduled Maintenance Behavior Through Group Policy | Anything about IT
...which says to look here:
"...event log under Application and Service Logs \ Microsoft \ Windows \ Diagnosis-Scheduled"

I do see a couple of events like those shown at the bottom of that article. And I guess it decided to remove some local shortcuts that should not have been considered broken*. I see the same events logged on other boxes too. I'll keep an eye on the desktop and see if it removes local shortcuts again.

*I do not see any entries for the unused shortcuts/file/folders part of this task and yet shortcuts to local folders were removed too.

I see several of these "remove broken shortcuts" events on my laptop's logs too - which is scary since it does not detail which shortcuts it opted to remove. There are entries indicating that info was sent to the action center. I see the action center's flag in the notification area, but I don't recall ever seeing a notice relating to broken or old shortcuts.