Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. usermode
  5. userenv.log
LogRisk: Caution
  • Legacy from XP

userenv.log C:\Windows\debug\usermode\userenv.log

userenv.log: old debug log of the Userenv library (profiles, Group Policy). Today you enable gpsvc.log, in the same folder, instead.

Updated on By AltF4 Formation

What it’s for

userenv.log is the old debug log of the Userenv library, which loads profiles and applies Group Policy. It predates Windows Vista. Today, verbose Group Policy logging is written to gpsvc.log in the same usermode folder. That is the one to enable and read. On a recent machine, do not expect to find userenv.log.

What it contains

  • When logging is on, traces of profile loading and policy processing, with the matching error codes.
  • On a recent machine where nothing was enabled, the file does not exist.

Risks and best practices

  • The system does not need it, so deleting it changes nothing.
  • Verbose logging left on slows down sign-ins and makes the file grow. Turn it off once the troubleshooting is done.
  • The content can name users and policies, so review it before sharing.
  • For current troubleshooting, enable gpsvc.log with the GPSvcDebugLevel value below instead. The C:\Windows\debug\usermode folder must exist.

Useful commands

Fenêtre de terminal
# Does the file exist?
Get-Item "$env:windir\debug\usermode\userenv.log" -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime


# Current alternative: enable gpsvc.log (value 0x30002), then sign in again
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v GPSvcDebugLevel /t REG_DWORD /d 0x30002 /f


# Group Policy event log, which remains the first source
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 20

Format

Plain text. Each line usually carries a process and thread ID, the time, then the message.

Rotation and archiving

The file keeps growing as long as logging stays on. Copy it before emptying it if you need to keep it.

How to read it

Find the time of the sign-in in question, look for lines containing “failed” or an error code, then confirm with gpresult /h report.html and the Group Policy Operational log.

Report a mistake