PC was transferred from domain to WG.
PC has local admin accounts:
gaadmin
res.local
New user account was created
gauser01
Upon login with res.local everything's fine, multiple restarts, all good.
Upon login with gauser01 (newly created user account) the admin account res.local (local admin account) gets deleted.
Event Viewer doesn't have any 4726 (user account deletion) or 4743 (computer account deletion) events.
See screenshot confirming the profile folder exists, while the account is not present.
Please advise how to track what removes the account.


