FolderRisk: Caution
Fonts C:\Windows\Fonts
Fonts installed for all users of the computer (TrueType, OpenType and others); registered in the registry.
What it’s for
C:\Windows\Fonts (%windir%\Fonts) is the folder of fonts installed for the whole machine. For a font to be permanently available, its file must be copied here and then registered, through Control Panel or the AddFontResource(Ex) API.
What it contains
- The font files shipped with Windows and those added by users or software:
.ttf,.otf,.ttc,.fon. - No inventory in the folder itself: permanent fonts are declared under
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts. - File Explorer shows it in a special view that groups font families.
- Fonts installed for a single user live elsewhere, in
%LOCALAPPDATA%\Microsoft\Windows\Fonts, as of Windows 10 version 1809.
Risks and best practices
- Do not delete system fonts: the interface can become unreadable and applications can fail.
- Install a font through File Explorer (right-click > Install) or a deployment, not by plain copy: installation is what registers it in the registry.
- A font locked by an application is removed in two steps: delete its registry value, then restart before deleting the file.
- Inconsistent font rendering is often fixed by restarting the
FontCacheservice. - Fonts from unknown sources are an attack vector: install trusted fonts only.
Useful commands
# Fonts declared in the registry (name -> file)Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts'
# Largest files in the folderGet-ChildItem "$env:windir\Fonts" -File | Sort-Object Length -Descending | Select-Object -First 10 Name, Length
# Available font familiesAdd-Type -AssemblyName System.Drawing(New-Object System.Drawing.Text.InstalledFontCollection).Families.Name
# Restart the font cache serviceRestart-Service FontCache