Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Security
  4. Database\secedit.sdb
FileRisk: Do not touch

Database\secedit.sdb C:\Windows\Security\Database\secedit.sdb

secedit.sdb: local security database used by secedit and the local security policy; stores the configuration applied to the machine.

Updated on By AltF4 Formation

What it’s for

secedit.sdb is the machine’s security database, the one secedit and the security policy consoles use to apply and compare settings: password and lockout policy, user rights, security options, service and file ACLs. It is the file that keeps the local security configuration in place.

What it contains

  • A binary (.sdb) database where the Security Configuration Engine (SCE) records applied settings, and the analysis state when one is run.
  • Databases you create yourself with secedit /db or with the Security Configuration and Analysis snap-in are separate files, not this one (see Documents\Security\Database in the profile).
  • The initial Windows configuration comes from templates in %windir%\inf (for example defltbase.inf for a workstation), applied at installation.

Risks and best practices

  • Do not replace or delete this file: a missing or corrupt database stops secedit and local security processing from working.
  • To export the effective configuration in readable form, use secedit /export (with /mergedpolicy to include domain policy) before any change.
  • To return a non-domain machine to defaults, the documented method is to reapply the base template with secedit /configure; this rewrites every local security setting, so keep it for machines you fully control. On a domain computer, the GPO takes over again at the next cycle.

Useful commands

Fenêtre de terminal
:: Export the effective security policy, domain included (as administrator)
secedit /export /mergedpolicy /cfg C:\Temp\current-secpol.inf


:: Compare the machine with a template
secedit /analyze /db C:\Temp\analysis.sdb /cfg C:\Temp\template.inf /log C:\Temp\analysis.log


:: Reapply the base template: rewrites all local security settings (as administrator)
secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Report a mistake