> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/persistence/registry/ntuser.dat-and-hku-sid.md).

# NTUSER.DAT & HKU\SID

The `NTUSER.DAT` file and the `HKU\SID-...\` registry key are related but serve different purposes within the context of the Windows operating system. Here's how they are connected and what differentiates them:

#### NTUSER.DAT

* **Location and Purpose**: The `NTUSER.DAT` file is located within a user's profile directory (e.g., `C:\Users\[Username]\NTUSER.DAT`). It is a registry hive file that stores the user-specific portion of the Windows registry. This includes user preferences, desktop settings, application settings, and more.
* **Access**: It's directly accessible (and modifiable) only when the user is logged in or by using specific registry or forensic tools when the user is logged out. For forensic analysis, `NTUSER.DAT` is often examined to understand a specific user's activities and configurations.

#### HKU\SID-...

* **Location and Purpose**: `HKU` (HKEY\_USERS) is a major registry hive that contains all user profiles currently loaded on the system. Each subkey under `HKU` is named after the Security Identifier (SID) of the user profiles. The `HKU\SID-...` key corresponds to the currently loaded profile of a user and represents the live state of the user's portion of the registry.
* **Access**: The `HKU\SID-...` path is accessible via the Windows Registry Editor (`regedit`) or through programming and scripting interfaces that interact with the Windows registry. It reflects the current state of a user's registry settings while they are logged on.

#### The Connection

* **Relation**: When a user logs on to a Windows system, the `NTUSER.DAT` file for their profile is loaded into the registry under their SID in the `HKEY_USERS` hive. This means that the `NTUSER.DAT` file is essentially the on-disk storage format of the user-specific registry settings, while `HKU\SID-...` represents those settings loaded into the system's active registry.
* **Differences**: The key difference is in their accessibility and representation. `NTUSER.DAT` is a file on the filesystem, while `HKU\SID-...` is a registry path accessible when the user's profile is loaded into memory. Changes made to the registry through `HKU\SID-...` are saved back to `NTUSER.DAT` when the user logs off or the profile is unloaded.

#### Practical Implications

* **Forensic Analysis**: For forensic purposes, `NTUSER.DAT` files are invaluable because they can be analyzed even if the user is not currently logged in, allowing investigators to gather information about user preferences, application use, and more.
* **System Administration**: Administrators might use the `HKU\SID-...` path to modify registry settings for users currently logged into the system or to troubleshoot issues related to user profiles.