ntuser.dat in C:\ProgramData?

Question

ntuser.dat file is in my ProgramData folder. I can't say if it is caused by apps or not - ntuser.dat is located in any user folder (like SYSTEM, regular user), and I have no idea what is it doing there, was it created by Windows Update or apps, since I did not download or install any app for over 6 months.

If I turn off 'Hide protected system files', I can see there are some REGTRANS-MS and BLF files. And also some files with LOG1 and LOG2 extensions, also named as ntuser.dat.LOG1 or ntuser.dat.LOG2. The ones with REGTRANS-MS and BLF file extensions are named a bit weird - they have some long GUID in brackets after ntuser.dat file name.

Compared to normal user directory, these files have very small file size. For example, the one ntuser.dat file in my user directory has a size of 9.5MB (sometimes more or less file size), and the one in ProgramData has a size of 8KB.

I cannot delete those. They are shown with UAC symbol. Even if I try to, it says it's open in System, which is basically ntoskrnl.exe. Same goes for ntuser.dat files in the user directory.

Another 2 weird things is how one ntuser.dat file is visible no problem, it's just ntuser.dat, without anything else (in ProgramData folder), whereas the other one requires protected system files to be visible, along with hidden files to show. The ntuser.dat file in ProgramData doesn't even have a transparent darker icon, whereas other 'parts' of it (like BLF files) do. And also there is ntuser.ini file in my user directory, but not in ProgramData.

The file is still in the ProgramData folder, and it has been there for 10 days already.

So my question is: what is ntuser.dat "doing" in the ProgramData folder, and what could cause it to be there? Windows Update maybe? Apps? I have no idea, I see this for the first time.

Answer 1

Hey there, I know what ntuser.dat does, and you do not describe it properly: it's used to store all user-related settings. If you delete it, you won't be able to sign in to the user again, I literally deleted it on a virtual machine with a specific tool. Although, only in user directory. There is NTUser.dat in C:\ProgramData, and ProgramData isn't the user folder. I ask for 'Why is it there? What might cause it to be there?', but not 'What if I delete it?' or 'What is it?'.

Answer 2

Hi. I’m a blue flaming horse. I am a Windows user like you. I am happy to do my best to assist you with the issue you are facing with windows. Let’s get started. The NTUSER.dat file is a file to help user accounts run properly. If it’s deleted, it will log you out and if you try to log back in, it says Preparing windows nonstop and your pretty much screwed.

Answer 3

I did open the virtual machine, although, there is no ntuser.dat in C:\ProgramData, even if I show hidden files and folders and disable hide protected system files, it's still not being shown. If I use CMD to delete that file with the help of 'del "C:\ProgramData\ntuser.dat /f /q", it just says The system cannot find the file specified.

Answer 4

Is your computer experiencing an actual problem caused by that file?

Answer 5

Try deleting it on a virtual machine and see what it does. If it screws windows up, don’t delete it