FileRisk: Caution
- Legacy from XP
win.ini C:\Windows\win.ini
INI configuration file inherited from Windows 3.x, kept for legacy application compatibility; actual configuration lives in the registry.
What it’s for
win.ini is an INI file dating from Windows 3.x. Windows no longer uses it for its own configuration, but old applications still read and write it through the private profile APIs such as GetPrivateProfileString. For some sections Windows redirects these accesses to the Registry through IniFileMapping entries (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping).
What it contains
- A minimal default content: a ‘for 16-bit app support’ comment and sections such as [fonts], [extensions], [mci extensions], [files] and [Mail].
- Entries added by old software (file associations, 16-bit application settings).
- Historically, load= and run= lines in the [windows] section launched programs at sign-in.
Risks and best practices
- Applications may expect to find this file, so keep it and edit it only for a specific application, after a backup.
- load= and run= lines have served as a persistence point for malware: a win.ini containing unexplained entries should be investigated.
- Writing to C:\Windows requires administrator rights; the Registry redirection means the file may not reflect the whole configuration.
Useful commands
# Read the fileGet-Content "$env:windir\win.ini"
# Look for historical autostart linesSelect-String -Path "$env:windir\win.ini" -Pattern '^\s*(load|run)\s*='
# INI to Registry mappingsGet-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping' | Select-Object -First 20 Name