Microsoft C:\ProgramData\Microsoft

ProgramData folder where Windows and Microsoft products keep data shared by all users (Windows, Defender, Crypto, and so on).

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Under %ProgramData% (FOLDERID_ProgramData, data common to all users of the machine), Microsoft receives the settings, caches and state that Windows and Microsoft products share across profiles. It is the machine-wide counterpart of each profile’s AppData\Roaming\Microsoft folder.

What it contains

Windows: system and shell data (shared Start menu, error reports, caches), covered in its own page.
Windows Defender: definitions, quarantine and platform versions of Microsoft Defender Antivirus.
Other folders depending on the installed components and products, for example Crypto, Search, NetFramework or Windows Security Health.

Risks and best practices

Defender, indexing and cryptography keep data here that they depend on, so deleting this folder or one of its subfolders breaks them. Clean only specific subfolders, such as error reports, with the intended tool (Disk Cleanup).
ProgramData is hidden by default: show hidden items or use -Force.
Several subfolders have permissions reserved to the system, and you are better off leaving them alone.
Before cleaning anything, measure each subfolder to see which product is using the space.

Useful commands

# Subfolders (the ProgramData folder is hidden: -Force)
Get-ChildItem "$env:ProgramData\Microsoft" -Directory -Force | Select-Object Name

# Approximate size per subfolder (may take a while; as administrator to read everything)
Get-ChildItem "$env:ProgramData\Microsoft" -Directory -Force | ForEach-Object {
  [pscustomobject]@{ Folder = $_.Name
    MB = [math]::Round((Get-ChildItem $_.FullName -Recurse -File -Force -ErrorAction SilentlyContinue |
         Measure-Object Length -Sum).Sum / 1MB, 1) }
} | Sort-Object MB -Descending

Folder contents

Folders 6

Report a mistake