Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. ServiceProfiles
FolderRisk: Do not touch

ServiceProfiles C:\Windows\ServiceProfiles

C:\Windows\ServiceProfiles: profiles of the Local Service and Network Service accounts (AppData, NTUSER.DAT, caches, user-mode service dumps).

Updated on By AltF4 Formation

What it’s for

ServiceProfiles holds the profiles of the accounts that many Windows services run under: Local Service (LocalService) and Network Service (NetworkService). Like an interactive user, these accounts need somewhere for their data, their Registry hive and their temporary files. The System account keeps its own elsewhere, in System32\config\systemprofile.

What it contains

  • One subfolder per account, LocalService and NetworkService, each with a profile layout (AppData, NTUSER.DAT…).
  • User-mode dumps when a service crashes: they are written to the profile of the service account concerned, so here for these two accounts.
  • Service caches: the font cache (LocalService\AppData\Local\FontCache) and the Delivery Optimization cache (NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization), often the largest.

Risks and best practices

  • Deleting or moving a profile makes the services concerned lose their configuration, or even fail to start. If a subfolder is huge, fix the cause (a looping service, over-verbose logging) instead of purging by hand.
  • For the Delivery Optimization cache, the Delete-DeliveryOptimizationCache command empties it cleanly.
  • The permissions keep the service accounts isolated from each other, so leave them alone.
  • Service dumps can contain sensitive data: protect them like any memory dump.

Useful commands

Fenêtre de terminal
# As administrator: size of each service profile
Get-ChildItem "$env:windir\ServiceProfiles" -Directory | ForEach-Object { [pscustomobject]@{ Profile = $_.Name; SizeMB = [math]::Round((Get-ChildItem $_.FullName -Recurse -Force -File -ErrorAction SilentlyContinue | Measure-Object Length -Sum).Sum / 1MB, 1) } }


# Services running under these two accounts
Get-CimInstance Win32_Service | Where-Object StartName -in 'NT AUTHORITY\LocalService', 'NT AUTHORITY\NetworkService' | Select-Object Name, StartName


# Possible service dumps
Get-ChildItem "$env:windir\ServiceProfiles\LocalService\AppData\Local\CrashDumps" -Force -ErrorAction SilentlyContinue

Report a mistake