Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Users
  3. <utilisateur>
  4. AppData
  5. Roaming
  6. Microsoft
FolderRisk: Caution

Microsoft C:\Users\<utilisateur>\AppData\Roaming\Microsoft

The %APPDATA%\Microsoft folder: personal data of Windows and Microsoft that follows a roaming profile (Credentials, Crypto, Protect, certificates).

Updated on By AltF4 Formation

What it’s for

AppData\Roaming (variable %APPDATA%) holds the application data of a user that can follow them from one computer to another in a roaming profile. Its Microsoft subfolder carries the personal data of Windows and Microsoft products. The machine-wide counterpart is C:\ProgramData\Microsoft.

What it contains

  • Windows: recent items, the personal Start menu, the Startup folder, templates and network shortcuts. It has its own page.
  • Credentials, Crypto, Protect and SystemCertificates: the user’s credentials, keys and certificates. Protect holds the Data Protection API (DPAPI) master keys, in a subfolder named after the user’s SID.
  • Folders of Microsoft applications (Office, Teams, legacy Edge…) depending on what is installed.

Risks and best practices

  • Deleting Protect or Crypto makes DPAPI-encrypted data unreadable, and deleting the whole folder loses saved passwords, personal certificates and settings.
  • With a roaming profile or folder redirection, this folder is copied to the server at each session, so its size lengthens sign-in.
  • Large or disposable data belongs in AppData\Local, which does not follow the profile.
  • These folders hold secrets: do not open their permissions to other accounts.

Useful commands

Fenêtre de terminal
# DPAPI subfolder: it is named after the current user's SID
whoami /user
Get-ChildItem "$env:APPDATA\Microsoft\Protect" -Force


# Possible redirection of %APPDATA% (roaming profile or folder redirection)
$env:APPDATA

Folder contents

Folders 3

Report a mistake