> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/windows-quick-tips/server-file-folder-locations.md).

# Server File/Folder Locations

1. **Active Directory and Group Policy (Specific to Domain Controllers)**
   * `C:\Windows\NTDS`: Active Directory database files (NTDS.DIT).
   * `C:\Windows\SYSVOL\sysvol`: Group Policy and logon scripts.
2. **Server Roles and Features**
   * `C:\Windows\System32`: Includes binaries and configuration for server roles like DHCP, DNS, IIS, etc.
   * `C:\inetpub`: Default directory for IIS web services.
3. **Logs and Event Files**
   * `C:\Windows\System32\winevt\Logs`: Similar to workstations, contains event logs.
   * `C:\Windows\System32\LogFiles`: Logs for IIS and other Windows services.
4. **Hyper-V (if applicable)**
   * `C:\ProgramData\Microsoft\Windows\Hyper-V`: Configuration files for Hyper-V virtual machines.
   * Virtual Hard Disk files: Location can vary but often found in `C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks`.
5. **Backup and Recovery**
   * `C:\Windows\SystemStateBackup`: System State backup location.
   * `C:\Windows\Backup`: Default backup location.

### Common Directories w/ Workstations

* `C:\Windows`: Core operating system files.
* `C:\Windows\System32`: Essential system files and DLLs.
* `C:\Windows\Prefetch`: Information about application launch activities and timings.
  * **MUST BE ENABLED**
* `C:\ProgramData`: Application and system-wide data.
* `C:\Users`: User profiles and personal files.