Confirming this happened to me with a terminal Server 2008 R2 as well. Locked/corrupted almost every user profile so it was generating temp profiles at login. LockHunter showed that System was locking each profile's NTUSER.DAT and other registry hive files even after reboot, and couldn't unlock them. Errors 1530, 1508, 1533 etc. in event log.
Shouldn't have been installed on a server in the first place, especially with active protection, but that was it. Uninstalling MBAM reverted the profiles to normal.
There were also VSS errors in the event log.
—
Ryan Link
Solutions Engineer | Concept Technology Inc.
Office: 615.xxx.xxxx
Technical Support: 615.xxx.xxxx
www.concepttechnologyinc.com
Nashville Business Journal's "Small Business of the Year" 2016