Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. catroot
FolderRisk: Do not touch

catroot C:\Windows\System32\catroot

Security catalogs (.cat) for signed Windows components and drivers, used to verify file integrity. Do not modify.

Updated on By AltF4 Formation

What it’s for

catroot holds the catalog (.cat) files installed with Windows, its updates and its drivers. A catalog bundles the cryptographic hashes of the files in a package and carries that package’s digital signature: Windows uses it to check that a file has not been tampered with. The associated database lives in the neighboring catroot2 folder.

What it contains

  • Subfolders named with a GUID. The one for system components and drivers is {F750E6C3-38EE-11D1-85E5-00C04FC295EE}.
  • Many .cat files named after the package or update.
  • Servicing and driver installation manage these files, so you do not own them.

Risks and best practices

  • Without its .cat files, signature checks on files and drivers fail, with update or driver installation errors to match.
  • For a catalog signature problem, it is catroot2 (the database), not catroot, that you reset: stop the CryptSvc service, rename catroot2 to catroot2.old, then restart the service. Windows recreates the database.
  • An unsigned catalog outside any legitimate package deserves investigation.

Useful commands

Fenêtre de terminal
# List the catalog subfolders
Get-ChildItem -Force "$env:windir\System32\catroot" | Select-Object Name, LastWriteTime


# See a few catalog (.cat) files
Get-ChildItem "$env:windir\System32\catroot" -Recurse -Filter *.cat -ErrorAction SilentlyContinue | Select-Object -First 10 FullName, Length


# Check a catalog's signature (replace the name)
Get-AuthenticodeSignature -FilePath "$env:windir\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\<name>.cat"

Report a mistake