Protect C:\Users\<utilisateur>\AppData\Roaming\Microsoft\Protect

The user's DPAPI master keys (subfolder named after their SID): without them, saved credentials and encrypted secrets cannot be recovered.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Protect holds the user’s DPAPI (Data Protection API) master keys. DPAPI encrypts per-user data such as saved credentials, certificate keys and application secrets. The master keys are themselves protected by the user’s sign-in information.

What it contains

One subfolder named after the user’s SID, with hidden files named by GUID (the master keys) and a file that points to the current preferred key. Windows creates new keys periodically and keeps the old ones so it can still decrypt older data. For a domain account, a backup of these keys can be retrieved from a domain controller.

Risks and best practices

Without the matching master key, saved credentials and other protected data become unreadable, with no local recovery. Do not delete, move or edit these files.
Even a partial copy of these files is highly sensitive: keep it out of tickets, archives and shares.
Include the full profile in backups, and protect those backups (encryption, restricted access).
A password reset by an administrator, outside the normal change flow, can prevent decryption of local DPAPI data. Warn the user.
For domain accounts, the key backup held on domain controllers makes recovery possible.

Useful commands

# Current user's SID (name of the subfolder)
whoami /user

# Subfolders present (hidden, read-only)
Get-ChildItem "$env:APPDATA\Microsoft\Protect" -Force | Select-Object Name, LastWriteTime

# Number of key files for the current user
(Get-ChildItem "$env:APPDATA\Microsoft\Protect\$([Security.Principal.WindowsIdentity]::GetCurrent().User.Value)" -Force -File).Count

Report a mistake