What Is NTUSER.DAT? Location, Safety & Fixes in Windows

You enable "Show hidden files" in File Explorer, browse to your user folder, and there it is: NTUSER.DAT. Maybe you've seen it mentioned in a forum thread about slow logins, or a support page about corrupted profiles. The question "what is ntuser.dat" tends to produce a lot of half-answers, so let's settle it properly.

NTUSER.DAT is a registry hive tied to your Windows account, and it stores the settings that make your desktop, apps, and preferences feel uniquely yours. It's not a document, it's not malware (usually), and it's definitely not something you should delete out of curiosity.

In this guide, I'll cover where this file lives, how to open it safely, whether you can ever delete it, why it might be eating disk space, what those .LOG1 companions are for, and how to recover from a corrupted profile.

What Is NTUSER.DAT? The Windows Registry Hive Explained

NTUSER.DAT Definition and Core Purpose

Think of the Windows Registry as the operating system's filing cabinet. Most people have heard of HKEY_LOCAL_MACHINE, the drawer full of system-wide settings. NTUSER.DAT is the personal drawer. It's a per-user registry hive that holds everything from your desktop wallpaper and taskbar layout to application preferences and recently opened file lists.

When you sign in, Windows reads this file and maps it to HKEY_CURRENT_USER (HKCU) in the Registry Editor. Every change you make to HKCU during a session — switching your theme, changing Notepad's font, telling a chat app to launch on startup — gets written back to NTUSER.DAT. Microsoft's documentation on user-profile registry hives describes exactly this mechanism, and it's been the backbone of Windows profiles since the NT era.

The file stays hidden in your profile folder for good reason. Double-clicking it won't open anything useful, and treating it like a regular file invites accidental damage.

Why Each Windows User Profile Has Its Own NTUSER.DAT

Every account on a Windows machine gets its own isolated hive. That's how two people can share one PC without inheriting each other's browser bookmarks, desktop shortcuts, or app settings. When a new user profile is created, Windows seeds it from the default profile at C:\Users\Default\NTUSER.DAT — essentially a clean slate of standard settings.

Over time, that file grows and changes based on what you actually do. Install a user-scope app? New registry keys appear. Search for a file in Explorer? WordWheelQuery logs it. Open a folder in a particular view? ShellBags record it. Within a few months, NTUSER.DAT contains a surprisingly detailed history of your Windows life — which is why forensic analysts find it valuable, and why you shouldn't casually remove it.

NTUSER.DAT Location: How to Find the Hidden File in Windows 10 and 11

Complete File Path and How to Show Hidden Items

The standard location is simple:

C:\Users\<your username>\NTUSER.DAT

But hidden items are off by default. To see it in Windows 10, open File Explorer, click the View tab, and tick the "Hidden items" checkbox. In Windows 11, it's View → Show → Hidden items. You'll also spot NTUSER.DAT.LOG1 and NTUSER.DAT.LOG2 in the same folder. Those are transaction logs, which I'll explain later.

Two other places carry similar hives:

• Service accounts: C:\Windows\ServiceProfiles\<ServiceName>\NTUSER.DAT — used by Local Service, Network Service, and other built-in accounts.
• The system account: C:\Windows\System32\config\DEFAULT — loaded for the SYSTEM account (SID S-1-5-18).

You may also encounter NTUSER.DAT in roaming profiles on corporate networks, where it syncs with a domain controller so settings follow the user across different PCs. In that setup, the file effectively roams with the account.

How to Open NTUSER.DAT Without Breaking It

Let me be blunt: don't double-click it. Windows will ask which app should open it, and your options are essentially "pick something manually" or stare at an error dialog. The safe way to inspect it requires Registry Editor:

1. Press Win + R, type regedit, and hit Enter.
2. Click on HKEY_USERS in the left pane.
3. Go to File → Load Hive.
4. Navigate to the NTUSER.DAT file you want to inspect. You may need to change the file-type filter to "All files."
5. Assign a temporary name to the hive — anything works, like TempHive.
6. Expand it like any registry key and browse around.
7. When you're done, select your temporary hive, then go to File → Unload Hive.

That last step matters more than people think. If you forget to unload, the hive stays locked, and Windows may throw access-denied errors or keep the file in use. Also, this method is for reading and careful editing only. I wouldn't recommend casual experimentation — stick to viewing unless you know exactly which value you're changing.

Can I Delete NTUSER.DAT? Risks and Safe Handling

What Happens if You Delete NTUSER.DAT

Short version: don't.

Deleting NTUSER.DAT wipes the registry data for that user profile. Desktop cosmetics, theme choices, app-specific settings, MRU (most recently used) lists — all gone. Worse, when Windows detects that a profile is missing its hive, it often falls back to signing the user into a temporary profile. You see the message "You've been signed in with a temporary profile," and at logoff, every change you made during that session simply vanishes.

I've watched this play out in a real environment. A user decided to "clean up" their profile folder by deleting files they didn't recognize, including NTUSER.DAT. They signed back in to find a blank desktop, lost bookmarks, and a reset Office layout. Recovery took the better part of an afternoon — and that was with backups in place. Without backups, creating a new profile and manually migrating files is often the only realistic path.

There's also a technical reason deletion is especially nasty: the file is locked while the user is signed in. Forcing a delete from another admin account or from Safe Mode can leave the profile in a state Windows can't load at all, triggering User Profile Service errors like Event 1500 or 1509 in the Event Viewer.

What to Do Instead of Deleting the File

If NTUSER.DAT is bloated or you suspect it's misbehaving, here are safer moves:

1. Export a backup first. Open regedit, right-click HKEY_CURRENT_USER, and choose Export. Save the .reg file somewhere safe. It doesn't capture every protected key in the hive, but it preserves your essential settings.
2. Uninstall apps you don't use. Per-user app data — especially from chat clients, cloud storage tools, and design software — is a major driver of hive bloat.
3. Sign out and back in. Some registry data lives in memory and only flushes to disk at logoff. A clean sign-in can shrink the file if it was temporarily inflated.
4. If the profile is beyond saving, create a new local user account, copy your documents and media files over, and reinstall your apps. The new profile starts with a fresh NTUSER.DAT.

Notice what's not on that list: downloading a "registry cleaner" or a "NTUSER.DAT repair tool." I've tested several over the years. The reputable ones do almost nothing useful, and the sketchy ones are effectively malware delivery vehicles. Windows' built-in tools cover nearly every scenario you'll realistically hit.

Is NTUSER.DAT a Virus? How to Tell if It's Malware

Normal NTUSER.DAT Behavior vs. Suspicious Activity

Let me put this plainly: NTUSER.DAT is not a virus. Every Windows profile has one, it's owned by the user account, and it's not executable — there's no code that runs on its own. The confusion creeps in because malware can write persistence entries into the same hive.

Here's what a legitimate NTUSER.DAT looks like:

• Location: inside a user profile folder or a service profile folder.
• Size: typically between 2 and 15 MB [需核实], depending on installed apps and usage history.
• Attributes: hidden, owned by that user, with no suspicious file extensions.

Red flags to take seriously:

• An NTUSER.DAT appearing somewhere random, like C:\ProgramData or a temp folder.
• An unusually large file (hundreds of MB) when you don't run heavy apps.
• Startup entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce pointing to unknown executables.

Those Run keys are a favorite persistence mechanism for malware. MITRE ATT&CK catalogs the technique as T1547.001 (Registry Run Keys / Startup Folder), and it's one of the first places I check when a user reports odd behavior after login.

How to Scan and Inspect NTUSER.DAT Safely

If you're worried, run through these steps in order:

1. Run a full Windows Defender scan. The hive contents get scanned as part of normal operation.
2. Upload the file to VirusTotal. A few detections out of 70+ engines is usually noise; a large consensus is worth investigating.
3. Open Task Manager → Startup apps. Review anything unfamiliar. No publisher and an odd executable path? That's a lead.
4. Use Microsoft Autoruns from Sysinternals. It's the gold standard for auditing autostart entries, including HKCU Run keys, scheduled tasks, and services. Disable anything you didn't intentionally install.

In my experience, the vast majority of "is NTUSER.DAT a virus?" scares turn out to be false positives from antivirus heuristics. Run the scan, review your startup entries, and move on with your day.

Why Is NTUSER.DAT So Big? Causes and How to Shrink It Safely

Common Causes of a Large NTUSER.DAT File

A normal NTUSER.DAT sits in the 2–15 MB range. When it balloons past 50 MB [需核实], users start noticing — usually because backup software complains or profile loading slows to a crawl.

The usual contributors:

• Web browsers storing user-scope settings, extension data, and cached preferences.
• Chat and collaboration apps like Slack, Teams, and Zoom writing session history and UI state.
• Microsoft Office MRU lists, add-in settings, and file-recovery metadata.
• Explorer search history — the WordWheelQuery and typed-path entries accumulate over time.
• Display and shell state, though much of that actually lives in a different file, UsrClass.dat.

That last point trips up a lot of people. When you see forum advice claiming "ShellBags are why your NTUSER.DAT is huge," it's mostly wrong for modern Windows. Local ShellBags are stored in USRCLASS.DAT, not NTUSER.DAT [需核实]. A large NTUSER.DAT is almost always app data, not folder history.

Safe Cleanup and Maintenance Options

Here's a quick risk-level table for the common approaches:

NTUSER.DAT Companion Files: LOG1, LOG2, BAK, and USRCLASS.DAT

What Are NTUSER.DAT.LOG1 and NTUSER.DAT.LOG2?

These two files sit right next to NTUSER.DAT and often get mistaken for junk. They're actually transaction logs that Windows uses to make registry writes durable. If the system crashes mid-write, Windows replays the log on next boot to bring the hive back to a consistent state.

Deleting them is a genuinely bad idea. Without those logs, a "dirty" hive — one holding uncommitted changes — may become unrecoverable. Windows will often rebuild or reset the profile rather than risk loading a corrupt hive, which drops you right back into the temporary-profile problem from earlier.

What About NTUSER.DAT.BAK and USRCLASS.DAT?

The .BAK file is a backup copy of the hive, created during specific profile operations like registry rollbacks or certain Windows updates. It's not always present, and its absence isn't a problem.

USRCLASS.DAT deserves its own spotlight because it's a separate per-user hive that's frequently confused with NTUSER.DAT:

How to Fix Corrupted NTUSER.DAT and Temporary Profile Errors

Signs That NTUSER.DAT Is Corrupted

How do you know you're dealing with corruption rather than a slow profile? Look for the classic patterns:

• A "We can't sign into your account" message at login.
• The infamous "You've been signed in with a temporary profile" notification.
• Settings that reset every time you log off — wallpaper reverts, apps forget their configuration, pinned taskbar items vanish.
• Event Viewer entries from the User Profile Service, especially Event ID 1500 (profile cannot load) or Event ID 1509 (profile cannot save).

If you're seeing these, the hive may be damaged, unreadable, or locked by a failed session. It's stressful, but it's rarely fatal — there are supported paths forward.

Supported Repair Steps

Before touching anything, back up the entire profile folder. That means NTUSER.DAT, its logs, your documents, your app data — everything. Copy the whole thing to an external drive or a network location. You can't overstate the value of that safety net.

Then, work through these options in order:

1. Try System Restore. If a restore point exists from before the corruption appeared, rolling back often brings back a healthy hive.
2. Use "Previous Versions." Right-click the profile folder (or NTUSER.DAT itself), choose Properties, and check the Previous Versions tab. Shadow copies may hold a pre-corruption version.
3. Load a backup in regedit. Use the Load Hive method described earlier, but point it at a backup copy of NTUSER.DAT or the .BAK file. Export whatever keys you need — favorites, app settings, anything that matters — then create a fresh profile and import those .reg files.
4. Create a new local profile. This is the reliable-but-unglamorous fallback. Create a new user account, log in once to generate a fresh hive, log out, then copy your documents and media into the new profile. It's not elegant, but it works.

And please, avoid the "NTUSER.DAT repair tool" results that dominate search pages. I've investigated more than one of those utilities, and they're either repackaged registry cleaners or straight-up malware. The built-in Windows recovery options are the supported path, full stop.

Frequently Asked Questions

Where is NTUSER.DAT located? The standard path is C:\Users\<username>\NTUSER.DAT. Enable "Hidden items" in File Explorer to see it. Service accounts keep their own copies under C:\Windows\ServiceProfiles\<ServiceName>\NTUSER.DAT.

Is it safe to delete NTUSER.DAT? No. NTUSER.DAT is a critical registry hive for your user profile. Deleting it removes your personal Windows settings and can force Windows to sign you into a temporary profile. Back it up, uninstall unwanted apps, or migrate to a new profile instead.

Is NTUSER.DAT important and is it a virus? It's an essential system hive, and it isn't a virus by itself. Genuine copies live only in user and service profile folders. If you notice suspicious startup entries or an NTUSER.DAT in an odd location, run a Defender scan and review your Run keys.

How do I open NTUSER.DAT? Don't double-click it. Use Registry Editor: select HKEY_USERS, go to File → Load Hive, choose the NTUSER.DAT file, assign a temporary name, and browse. Remember to unload the hive when you're done.

Final Thoughts

So, what is NTUSER.DAT, really? It's the quiet workhorse that carries your personal Windows identity. It isn't malware, it isn't junk, and it isn't a file you should delete or "clean" with third-party tools. Treat it with respect: back up your profile before any registry work, uninstall apps the proper way, and lean on Windows' built-in repair options when things break.

If you're troubleshooting a specific profile error right now, start by locating the file, checking its size, running a malware scan, and reviewing the Event Viewer messages. And if you're still stuck, drop a comment with the exact error text and your Windows version — I'll point you toward the fix that's most likely to help.