NTUSER.DAT C:\Users\Default\NTUSER.DAT

NTUSER.DAT of the Default profile: template hive copied into every new profile; used to preset HKCU for future users (CopyProfile, reg load).

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Template hive for HKEY_CURRENT_USER: when a new user signs in for the first time, Windows copies this file as the NTUSER.DAT of their profile. Anything written here before that first sign-in becomes the starting value for every new account, local or domain. It is the classic way to customize a reference image.

What it contains

A complete Registry hive stripped of any personal preference: the starting values of HKCU\Software, keyboard, taskbar and so on.
Companion files NTUSER.DAT.LOG1 and .LOG2, and sometimes .TM.blf files created while the hive is loaded.
It is not loaded during normal operation. Do not confuse it with HKEY_USERS\.DEFAULT, which is the hive of the SYSTEM account (config\systemprofile).

Risks and best practices

Only profiles created after the change are affected; existing profiles keep their own NTUSER.DAT.
To edit it: reg load, change, then reg unload. Unloading fails if a handle stays open (Regedit open on the key, a PowerShell variable pointing at the key); close them, run [gc]::Collect() if you used the PowerShell Registry provider, then retry.
A corrupt hive, or one left loaded, prevents new profiles from being created: test with a fresh account.
To scale this up, prefer CopyProfile in the answer file (the profile customized in audit mode is copied to Default during the specialize pass) or Group Policy, which can be replayed without touching the hive.

Useful commands

:: Load the template profile hive under HKU\DefUser (as administrator)
reg load HKU\DefUser C:\Users\Default\NTUSER.DAT

:: Example of a value to preset
reg add "HKU\DefUser\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f

:: Always unload before signing out
reg unload HKU\DefUser

Report a mistake