NTUSER.DAT files TimeStamp showing as recently modified on Inactive accounts

[User27605043]

My End User Support group uses a GPO to check for user profiles on workstations that have not been active for a period of time and delete them.

This is done by running a script that checks the last modify date on the NTUSER.DAT files on the workstaions.  Recently they noted that NTUSER.DAT files were showing current timestamps for accounts that have been inactive for some time. 

Is there any possibility that ENS could be modifying  the file and thereby changing the TimeStamp?

[Pravas]

Hi @User27605043 ,

We may need to test by running a scan on the file. Please right click and choose Scan for threats.

If the last modified changes, then please log a ticket with support for investigation. 

Else it might be due to other factors.

Thanks

[User27605043]

From testing scanning I am not seeing ENS cause the file modify date to change. I think something else is causing it to happen. --- Everyone wants to blame the Anti-Virus.