Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Users
  3. <utilisateur>
  4. NTUSER.DAT
FileRisk: Do not touch
  • Hidden

NTUSER.DAT C:\Users\<utilisateur>\NTUSER.DAT

NTUSER.DAT: the user's Registry hive (HKEY_CURRENT_USER) with their preferences and application settings. Locked while the session is open.

Updated on By AltF4 Formation

What it’s for

NTUSER.DAT is the file behind a user’s own Registry hive. Windows loads it at sign-in under HKEY_USERS\<SID>, and HKEY_CURRENT_USER is the alias for the session you are in. The user’s Software\Classes hive is separate, in AppData\Local\Microsoft\Windows\UsrClass.dat. The machine’s hives live in System32\config.

What it contains

  • The user’s preferences: interface, file associations, printers, mapped drives, application settings, programs started at sign-in (Run).
  • Usage traces that matter in an investigation: recent documents (RecentDocs), Run box commands (RunMRU), programs launched (UserAssist).
  • The companion files NTUSER.DAT.LOG1, NTUSER.DAT.LOG2, .TM.blf and .regtrans-ms, which are the hive’s transaction logs.
  • Hidden and system attributes, and locked while the session is open. The template copied to new profiles is the NTUSER.DAT of the Default profile.

Risks and best practices

  • If the file is deleted, renamed or replaced, the profile no longer loads and Windows signs the user in with a temporary profile (event 1511 in the Application log, User Profiles Service source). A corrupted hive is restored from backup or replaced by a fresh profile. Do not try to repair the file by hand.
  • Do not copy the file while it is in use. reg save HKCU or a profile backup that handles locking gives a consistent copy.
  • To edit another user’s Registry offline, load their hive with reg load, then always unload it with reg unload. A hive left loaded keeps the file locked.
  • To edit the Default profile, load C:\Users\Default\NTUSER.DAT, make your changes and unload it before you generalize the image.

Useful commands

Fenêtre de terminal
# File presence and its transaction logs (hidden)
Get-ChildItem "$env:USERPROFILE\NTUSER.DAT*" -Force | Select-Object Name, Length, LastWriteTime


# Back up the signed-in user's hive to a file
reg save HKCU "$env:TEMP\hkcu-backup.hiv"


# Load another user's hive (as administrator, with that user signed out), then unload it
reg load HKU\TempHive "C:\Users\<utilisateur>\NTUSER.DAT"
reg unload HKU\TempHive

Report a mistake