Sum C:\Windows\System32\LogFiles\Sum

User Access Logging (UAL) database: two-year history of client accesses (users, IP addresses) to server roles and products.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Sum (Server User Management) holds the ESE database of the User Access Logging (UAL) service, enabled by default since Windows Server 2012. UAL aggregates client requests, identified by user and IP address, to the roles and products installed on the server, and is used for usage tracking and licensing. The active database is Current.mdb.

What it contains

Current.mdb, the active database. Every 24 hours, UAL copies the data to a {GUID}.mdb file that the WMI provider reads.
A new {GUID}.mdb file at the start of each calendar year, with history kept for up to two years.
SystemIdentity.mdb and supporting ESE files (.chk, .log, and so on).
Reading is done with the Get-Ual* cmdlets or the MsftUal_* WMI classes (root\AccessLogging namespace).

Risks and best practices

Moving or modifying the files triggers UAL’s recovery routine, which can empty the whole folder. To back up, copy all the files together.
The database holds user names and IP addresses. It is a valuable investigation source, but also personal data to protect.
On an internet-facing or very high-performance server, you can stop UAL with Stop-Service UALSVC then Disable-Ual (as administrator).

Useful commands

# List the UAL database (Current.mdb, {GUID}.mdb files, etc.)
Get-ChildItem -Force "$env:windir\System32\LogFiles\Sum" | Select-Object Name, Length, LastWriteTime

# Check the User Access Logging service state
Get-Service UALSVC

# See the installed roles and products tracked by UAL
Get-UalOverview

# See access per client user, with IP address
Get-UalUserAccess | Select-Object -First 20

Report a mistake