SystemProfile C:\Windows\System32\config\SystemProfile

C:\Windows\System32\config\systemprofile: profile of the System (LocalSystem) account for services and tasks running as SYSTEM, with their user-mode dumps.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

systemprofile is the profile of the Local System account (SYSTEM, LocalSystem), which runs most Windows services and many scheduled tasks. These processes find their AppData and temporary files here, like an interactive user. The Local Service and Network Service accounts keep theirs in C:\Windows\ServiceProfiles.

What it contains

A profile layout: AppData (with Local and Roaming), Desktop, Documents, usually close to empty.
User-mode dumps of services running as System, in AppData\Local\CrashDumps.
Whatever monitoring, backup or asset-management agents leave behind, and scripts launched as SYSTEM (scheduled task, deployment, psexec -s).
For a 32-bit process, Windows uses SysWOW64\config\systemprofile instead.

It is a good place to dig in an investigation: a script or agent run as SYSTEM may have left files here.

Risks and best practices

Services load the profile at startup, so deleting or moving it disturbs them. For a large service dump, keep it while you analyze it, then delete only the .dmp concerned.
The folder sits under System32\config, next to the Registry hives, which are very sensitive. Open it from an administrator session and leave the permissions alone.

Useful commands

# As administrator: most recently modified files in the System profile
Get-ChildItem "$env:windir\System32\config\systemprofile" -Recurse -Force -File -ErrorAction SilentlyContinue |
  Sort-Object LastWriteTime -Descending | Select-Object -First 20 FullName, Length, LastWriteTime

# Possible dumps of System services
Get-ChildItem "$env:windir\System32\config\systemprofile\AppData\Local\CrashDumps" -Force -ErrorAction SilentlyContinue

Report a mistake