В папке каждого пользователя Windows 11, Windows 10 и предыдущих версий системы присутствует скрытый файл NTUSER.DAT размером в несколько мегабайт: некоторые пользователи задаются вопросом о его назначении и возможности удаления.
В этой инструкции подробно о том, что представляет собой файл NTUSER.DAT, о причинах, по которым удалять его нежелательно, а также о том, что делать, если файл всё-таки был удален.
NTUSER.DAT — файл с данными профиля пользователя
Зайдя под какой-либо учетной записью в Windows, вы можете найти связанные с этим конкретным пользователем данные в разделе реестра HKEY_CURRENT_USER, однако, если зайти под другой учетной записью, изменяются и данные, находящиеся в этом разделе.
NTUSER.DAT — тот файл, который хранит эти и другие данные профилей пользователя для каждого из них: при выходе из учетной записи данные сохраняются в этот файл, при входе — загружаются из него.
Найти файл NTUSER.DAT можно в папке
C:\Users (Пользователи)\Имя_пользователя
— он присутствует в папке каждого пользователя, для его отображения потребуется включить показ скрытых файлов.
Можно ли удалить этот файл
Удалять файл NTUSER.DAT, во всяком случае для тех учетных записей, которыми вы пользуетесь и для системных учетных записей не следует: это приведёт к её неработоспособности и невозможности входа в систему.
Для неактивных/ненужных учетных записей удаление этого файла возможно: всё что вам потребуется — это права администратора на компьютере. Однако разумнее будет удаление соответствующего пользователя Windows.
Что делать, если удалил файл NTUSER.DAT
Если файл NTUSER.DAT был удален и вход в систему более невозможен, есть несколько возможных вариантов решения:
- Использовать точки восстановления системы с загрузочной флешки или из среды восстановления, подробнее: Точки восстановления Windows 11 (всё то же самое и для Windows 10).
- Если вход под какой-либо другой учетной записью администратора возможен, можно зайти под ним. Кроме файла NTUSER.DAT в папке пользователя, где он был удален могут присутствовать и файлы NTUSER.DAT.LOG, содержащие предыдущие копии этого файла — они могут быть полезными для восстановления: просто переименуйте последний из этих файлов в NTUSER.DAT.
- Если как-либо попасть в Windows не получается, можно использовать загрузочную флешку WinPE — на ней присутствуют, в том числе, инструменты для сброса паролей Windows (описаны в последней части этой инструкции), которые позволяют включить скрытые системные учетные записи: включите учетную запись Администратор (обычно она без пароля), перезагрузите компьютер в обычном режиме, зайдите под этой учетной записью: теперь вы сможете выполнять действия с папками и файлами, создать нового пользователя Windows.
Надеюсь, для кого-то из читателей информация будет полезной. Если у вас остались вопросы, касающиеся этого файла, вы можете задать их в комментариях ниже, я постараюсь помочь решить возникшие проблемы.
A reader wrote into us this week and asked about the ‘ntuser.dat’ file on their Windows 10 computer. Specifically, ‘What is ntuser.dat and why does it keep appearing on my computer? I deleted it twice and it keeps reappearing. Why?’ This is something we have seen mentioned before in comments and emails so it’s a good subject for a tutorial.
You can find ntuser.dat in C:\Users\Username. It’s a relatively small file that sits there innocuously. Mine is 6MB in size. It is not a virus. It is not malware. It is not anything to worry about. The file is actually vital to your computer and you should not delete it.
What is ntuser.dat?
The ntuser.dat file is where your Windows user profile is loaded from. It contains the HKEY_CURRENT_USER registry hive which has all your files, preferences and settings contained within it. If you delete the file, many of those settings will return to their defaults. Any configuration changes or customizations that are maintained in the registry will also return to defaults.
The purpose of ntuser.dat is why it will reappear if you delete it. The file is necessary to keep all your registry settings. Every user on the computer will have their own copy that will maintain their individual settings. If you go to C:\Users and check all username folders within you will see each has an ntuser.dat file.
The filename is a legacy from WindowsNT that introduced it to help maintain user settings within a multi-user environment. The format is largely the same now. You cannot open or read ntuser.dat though.
How does ntuser.dat work?
As the file suffix suggests, ntuser.dat is a data file that contains not only the registry hive but logs containing previous versions of that hive. When you make changes to your computer and the hive is updated, the previous version is logged and is how Windows Restore can help return your computer back to a previous configuration. Those logs will refer to other copies of ntuser.dat you may see in the folder.
When you make a change that will be reflected in the registry, it isn’t written immediately. It is held in a temporary file called a regtrans-ms file. This is a log file that tracks all changes you make within a single session that will require a registry change. Only once you sign out or shut down your computer will the regtrans-ms file write your changes to the registry.
The idea is to maintain the integrity of the registry by keeping modification to a minimum. Rather than writing to it all the time, a temporary file is created, checked, validated and then written to the registry once as you shut down your computer. That delay you see when you set your computer to shut down or when you log out? Among other things, that is the regtrans-ms file being written into the registry and copied into ntuser.dat.
What happens if I delete the ntuser.dat file?
As mentioned, the ntuser.dat is an important file for Windows as it contains all your user configurations and HKEY_CURRENT_USER settings. Deleting the file won’t cause Windows to crash but can cause any configurations or system settings that are usually recorded within the registry to disappear.
Not all system settings or changes need to be recorded within the registry so if you delete it, you may see some changes remain while others reset.
You cannot delete the current ntuser.dat that is in use by your account. If you see multiple ntuser.dat files, you can delete those if you wish. Multiple ntuser.dat files within C:\Users\Username indicates that your computer has crashed and couldn’t write to the registry like it should during a normal shutdown. Rather than write a potentially corrupted file, Windows will ignore it create a new file instead. During a crash, the regtrans-ms file would not have been written to ntuser.dat so will be discarded.
Any system changes that are normally recorded in the registry made during the crashed session will not have been saved so you will have to do those again. In this situation, the older ntuser.dat files are now obsolete and are superseded by the latest version of the file. This is what will cause multiple ntuser.dat files to appear.
Multiple ntuser.dat files are safe to delete as long as you do not delete the latest one. In most situations, you should be able to delete the file in use as it will be locked by Windows.
Seeing the ntuser.dat in your Username folder is normal and has been a feature of Windows for the longest time. The file is safe, it is not malware or anything bad. It is a necessary part of Windows and can safely be left alone. If you want to delete older versions you can, but at only a few megabytes, there really is no need. It’s entirely up to you though.
How To Connect your Android Phone to a VPN
Read Next
Saw a fascinating question on TenForums this morning, as I was making my “morning run” though the new threads there. It appeared in a thread named “ntuser.dat” and read “Why do I have so many ntuser.dat files?” Being one to look for evidence any time Windows quirks or behaviors are described, I immediately fired up voidtools’ (Search) Everything to look for that string in my file system. Right now, it turns up 60 objects, of which many are logs or pending registry transmissions (files of type .regtrans-ms). But there is also one file named ntuser.dat and eight more files named NTUSER.DAT. Obviously, there’s something interesting and useful going on with all these copies. And, as it turns out understanding NTUser.dat in Windows 10 hinges on understanding user profiles and typical accounts on a Win10 systems.
Of the 60 items with “ntuser.dat” in their names, these nine items shown take that name precisely on my production PC. What gives?
Why Bother Understanding NTUser.dat in Windows 10?
As it happens, each and every user profile created on a particular running instance of Windows 10 has its own NTUser.dat file. This file contains personal files and preference settings particular to each such user. As you can tell from looking at those files on my production PC (depicted in the preceding screenshot), this includes default and “behind-the-scenes” accounts as well as user accounts. That’s why we see a system account (…System32\Config\systemprofile), various service accounts (… NetworkService and …LocalService), and dot-NET accounts (dot-NET v4.5 Classic and dot-NET v.5), plus Administrator, Default and DefaultAppPool accounts. The only real user account is C:\Users\etitt. It reflects my Microsoft Account, which starts with the 5 characters “etitt”.
As it also turns out, messing with files with this name is NOT a good idea. Deleting an NTUser.dat file destroys the associated account’s preferences and settings and may even corrupt the associated user profile. Each such file has one or more backups, which appears as a file named NTUser.dat.log. If an error occurs in the master copy of NTuser.dat, Windows can use one or more log files to correct it. NTUser.ini files describe roaming profiles used in networked environments. You can rename this file NTUser.man. But that changes the user profile from a user-controlled profile to a locked-down profile that users can alter only temporarily (changes are not saved when the user logs out).
Writing the NTUser.dat happens during login; essentially, it’s a copy of the Windows Registry’s HKEY_CURRENT_USER hive. The contents of the user profile changes constantly over time: it reflects changes that occur while Windows is running. Windows size and position, for example, changes each time you open, move, or resize an application window. And that’s just the tip of a very large iceberg of data that goes into keeping constant track of user activity.
How NTUser.dat Changes
Though user settings, preferences, and so forth change at runtime, NTUser.dat stays static. Rather, those changes go into a raft of .regtrans-ms files that Windows 10 creates. Windows 10 processes these files whenever a user logs out, or the system shuts down or restarts. This controls and manages Registry writes, much like a “database commit” operation. (Note: database commit is a complex and interesting concept with many wrinkles, with much thought and effort required for proper implementation. For now, this means “changes either happen completely, or they don’t happen at all”. That keeps databases — including the Registry, in this case — consistent at all times.)
Thus, even when an uncontrolled shutdown or a BSOD occurs, NTUser.dat remains OK. User settings and preferences changes from the preceding session are lost. But user profiles remain intact and consistent.
I completely agree with long-time TenForums VIP and Guru member Bree (identified in the “ntuser.dat” thread mentioned at the outset of this blog post). Here’s his take on messing with or deleting files named NTUser.dat: “Best leave them alone then.” Well said, and advice worth following!
-
Что это?
-
Почему файл может быть не один?
-
Стоит ли удалять?
При изучении операционной системы Windows, пользователи часто сталкиваются с файлами неизвестного разрешения. К ним можно отнести ntuser.dat. Что это за файл, какое у него назначение и нужно ли удалять его, рассмотрим подробно в статье.
Что это?
Каждому профилю, с помощью которого пользователь находится в ОС Windows, присущий отдельный файл ntuser.dat. Он содержит в себе информацию о персональных и системных данных для профиля юзера.
Cам по себе ntuser.dat – это файл реестра. Чтобы добраться до него, откройте редактор реестра (Win+R, команда regedit) и нажмите на ветку:
HKEY_CURRENT_USER
Ее значения расположены в ntuser.dat.
Расположен файл на диске (С:) (системный) в разделе “Пользователи/Имя_пользователя”. По умолчанию он скрыт. Чтобы увидеть его, откройте показ скрытых папок и дисков (читайте об этом в статье: отображение скрытых папок в Windows 10).
Совет! Ознакомьтесь с другими расширениями .bin и .sys.
Почему файл может быть не один?
Файлов с именем ntuser.dat будет ровно столько, сколько профилей подключено в Windows.
Встречаются и другие вариации, с похожими именами. Например:
- Ntuser.dat.log – содержит настройки по восстановлению ntuser.dat (находится в этой же директории). В случае ошибок с конечным файлом, Windows проведет восстановительные работы с помощью параметра с расширением .log.
- Ntuser.dat{xxxx}.regtrans-ms и ntuser.dat{xxxx}.blf – это файлы журнала (информация об отчетности выполненной задачи), которые появляются при создании копии образа системы (backup).
- Ntuser.dat{xxxx}.iobit и .iodefrag.bak – параметры программы Advanced System Care. Первый отвечает за откат к сохраненной точки восстановления программы. Второй – резервная копия данных.
Если эти файлы занимают много места, их можно удалить без вреда персональным настройкам учетной записи.
Стоит ли удалять?
Его удалять нельзя. Удаление вызовет сбои в работе профиля и испортит персональные настройки. Работать с поврежденной учетной записью станет не комфортно. Если по личным причинам вы хотите его удалить:
- Войдите в другой профиль с привилегиями администратора.
- Перейдите в директорию Системный раздел/Пользователи/Имя_Пользователя и удалите файл.
Совет! Если переименовать ntuser.dat в .man (как изменить расширение читайте здесь) то создастся профиль юзера, в котором невозможно изменить персональные настройки. Сделанные при использовании профиля изменения сбрасываются до момента, когда файл был переименован в .man. Эта функция может сработать как дополнительная защита от вредоносного ПО.
Если у вас возникли вопросы по поводу системного файла, оставляйте их в комментариях или используйте специальную форму.
Windows was created in a time when there were not a lot of users. Thus, Microsoft has not tweaked Windows in such a way that multiple users could use one computer. For this to happen, they had to provide personalization options to the user.
Now, you can do anything from happening separate profiles on the same computer to customization the Start Menu. The option to create different user profiles allows you to share a computer with someone without your work or user settings overlapping with theirs. In a way, you have two computers in one and Ntuser.dat is what makes this possible.
What is Ntuser.dat?
Ntuser.dat is present for every user profile. It is a registry file that contains the personalized settings for every user profile on the computer. Even if there is one profile, Ntuser.dat is present for it too. Therefore, it is very important for Windows since it is involved in the performance of different actions such as saving changes and loading files, etc. Whichever preference you set in your user profile, it is loaded again the next time you turn on the computer, thanks to Ntuser.dat.
Having separate user profiles is very beneficial in domestic and work settings. In an office setting, a single computer can have multiple user profiles so that the same computer can be used by different people working in different shifts. Similarly, at home, you can create different user profiles for yourself and your kids. In this way, their games do not overlap with your work, and your settings can be different from theirs. What allows this to happen? Ntuser.dat. It is responsible for
Why is Ntuser.dat Important?
When you are using your profile, you often make changes such as your display, resolution or printer, etc. For example, you might set a wallpaper of your pet on your screen. Now, the next time you turn on the computer, Windows should remember which wallpaper to show on the screen. Ntuser.dat helps in this.
Initially, Windows stores this information in the Registry. When you turn off the computer, this information is sent to Ntuser.dat. The next time you turn on the computer, this information will be loaded from Ntuser.dat and back to the Registry. Owing to this, you will be able to see the same settings as you had set before.
Ntuser.dat first came into being in the Windows 3.1 version. The ‘dat’ in the name represents that this extension contains data.
Back in the day, you could not make multiple user profiles. This is back when Windows was still in its earlier stages. Microsoft brought the option to create user profiles in Windows using the Ntuser.dat. This extension is present in every user profile.
How to Find the Ntuser.dat file?
As we have already mentioned, the Ntuser.dat file is present in every user profile. You can find it using one of the two ways.
Method 1: Run Window
To follow this method, press the Windows and R keys at once. When you see the Run window, type %userprofile% in the box and click OK.
- Go to the ‘C’ folder and then to Users.
- Click on your user name.
- You will see the Ntuser.dat file there.
- If you do not see this file, it means that it has been hidden by Microsoft so that you can edit or alter the file.
- You can still see this file if you enable the Show Hidden Files option.
Method 2: File Explorer
- For this method, click on My Computer or This PC icon present on your screen.
- This will open File Explorer.
- Click on the View tab and then click on the Hidden Items.
- You will find Ntuser.dat here. Right-click on it to check its properties such as its size.
When you are looking for Ntuser.dat, you might see some other files named Ntuser.dat.LOG with a number in front. These are the backup files created by Microsoft. For example, when you save a new setting or preference such as a certain screen resolution for your user profile, Microsoft would make a copy of it and save it as Ntuser.dat.LOG and a number. So, these files that you see are important for your computer.
Is it safe to Delete Ntuser.dat?
Ntuser.dat takes up to 17 megabytes of space on your computer. This is not a lot of space as compared to some other programs but you might want to free up space. Do not delete Ntuser.dat even if you want to free up space on your desktop. Ntuser.dat is important for your user profile and if you delete it, you will only be making things uncomfortable for you.
Windows needs Ntuser.dat to load your saved settings and to ensure that you see things the way that you preferred them to be. If you have set a wallpaper, you would not want to set the desktop background every time you turn on the computer. You expect Windows to do this on its own. Windows cannot make this happen without Ntuser.dat.
Windows Cannot Sign In
If you delete the Ntuser.dat files, you will see a message on your screen that Windows cannot log in to your account. It will tell you that you can solve the problem by signing out of your user profile and then signing in again. However, even if you try this solution, you will not be able to sing in. Thus, it is best if you do not delete Ntuser.dat in the first place.
You will not be saving up a lot of space by deleting Ntuser.dat as it does take up a lot of space in the first place. If you want to delete a certain user profile, you can go ahead and do that.
Also, you should not alter this file. You might edit this file and cause more problems for your computer than you are able to fix. It is best to familiarize yourself with the important extensions and files so that you do not end up deleting them in an attempt to make some space on the desktop.
Conclusion
We hope that by now, you would have understood what Ntuser.dat does and why is it so important for your computer. If you have ever had the crazy idea of deleting this imperative data file from your computer, you should decide against it. Think of Ntuser.dat as a memory of user settings and preferences that Windows keeps. Without it, you would not be able to log in to your user profile as all your personalization will be gone. Let us know if you have any queries about this file.