Where Are the Windows User Registry Hives?
Where Windows keeps NTUSER.DAT and UsrClass.dat user hives, what they map to, and how to edit them offline.
Last updated
Every Windows profile carries its registry in files: NTUSER.DAT at the profile root (maps to HKEY_CURRENT_USER) and UsrClass.dat under AppData\Local\Microsoft\Windows (feeds HKEY_CLASSES_ROOT). Log files (.LOG1/.LOG2) beside each keep transactions consistent.
Both stay locked while logged in, so live copies are useless and direct edits need regedit rather than Explorer. The files only materialize at first logon from the Default profile template, which is why a corrupt Default breaks every new account the same way.
Where Windows stores this, by platform
%USERPROFILE%\NTUSER.DAT
Hidden system files: enable protected operating system files to see them. NTUSER.DAT is HKCU; UsrClass.dat is per user classes. Back up with reg export or System Restore, never raw copy while logged in.
Frequently asked questions
How do I edit a hive from a PC that will not boot?
Boot recovery media (or another OS on the machine), load the file with reg load HKLM\TempHive <path>, edit, then reg unload. Never copy a live hive: it is locked and half written. Offline edits bypass permission errors that block live tweaks.
What is UsrClass.dat for?
UsrClass.dat maps to HKEY_CLASSES_ROOT merged view plus HKCU\Software\Classes: file associations and COM registrations per user. Corruption there breaks Open With and icons while the rest of the profile works, which localizes weird shell bugs fast.
Notice an outdated path? Let us know.