Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. Security
FolderRisk: Do not touch

Security C:\Windows\Security

Local security configuration database and logs used by secedit and the Security Configuration and Analysis snap-in.

Updated on By AltF4 Formation

What it’s for

C:\Windows\security is the workspace of the Security Configuration Engine. The secedit tool compares the current configuration with security templates, analyzes or applies them, and writes the result to %windir%\security\logs\scesrv.log. It is the foundation of the local security policy you edit with secpol.msc.

What it contains

  • logs\scesrv.log: log created by the system, overwritten each time secedit /analyze, /configure, /export or /import runs. Results are grouped by policy type.
  • database: the machine’s security databases (.sdb), including secedit.sdb, the local policy database.
  • Databases you create in the Security Configuration and Analysis snap-in go to Documents\Security\Database in your profile, not here.

Risks and best practices

  • Do not modify or delete the files in database: they underpin the application of local policy. Change settings with secpol.msc, gpedit.msc or secedit.
  • After a secedit /configure, read scesrv.log to find settings that could not be applied. The next command overwrites it, so copy it first.
  • Export the current configuration before changing it so you can roll back.
  • If system permissions are damaged, secedit /configure with the defltbase.inf template restores Windows defaults. It is a last resort; test it on a VM first.

Useful commands

Fenêtre de terminal
# Last lines of the secedit log
Get-Content "$env:windir\security\logs\scesrv.log" -Tail 40
Fenêtre de terminal
:: As administrator: export the local security policy to a file (changes nothing)
secedit /export /cfg "%TEMP%\secpol-export.inf" /areas SECURITYPOLICY


:: Compare the current configuration with a template (the result goes to scesrv.log)
secedit /analyze /db "%TEMP%\analysis.sdb" /cfg "%TEMP%\secpol-export.inf"

Folder contents

Files 1

Logs 1

Report a mistake