I'm on a Windows 7 PC on a domain in my office. Looking at my c:/users folder today, I found 314 folders totaling 131 GB. The folder names appear to be intentionally random, and each one contains a fully fleshed-out windows profile. Our tech support team has no idea what could cause this, but they tell me it is affecting multiple PCs.
With some effort, I was able to delete all but one of the folders (I had to use Unlocker to free them and flag for delete on reboot.) The one that I couldn't get rid of has two sub-folders held open by c:\windows\system32\lsass.exe
I have admin rights on the box, but cannot access, delete, or take ownership of the two "Credentials" folders.
I'm looking for any clue as to what might be happening here and how to stop it.
I spent a lot of time in Google, but only came away with dusty memories of the Sasser worm. (Not a likely cause. We have up-to-date antivirus, lsass.exe is signed by MS, and I didn't see any of the signature files of that worm.)
After the last reboot, a new folder appeared with a matching naming scheme.
Update: Many thanks to arana and EMK. Landesk is likely the culprit. We have a ticket open with our Landesk tech. I will post the solution here when the issue is resolved.