What Causes Changes to the NTUSER.DAT file?
I came into work today and noticed that my computer was on. I checked the other users files and on 2 plus the Administrator file the NTUSER.DAT file was dated Sunday at 4:13 pm. Does this mean someone was in my computer at that time? Why would those particular users files be updated but not my own and a couple of others that are in there?I am wondering if someone was nosing around in my computer over the weekend.Help!1 person needs an answerI do too
August 9th, 2010 5:04pm

There are a number of ntuser.dat files which contain the registry entries of the individual users of the computer. The Current User registry information is located in \Documents and Settings\username\ntuser.dat.The 5 main registry hives are located in \WINDOWS\system32\config. It is this version of the registry that is loaded when the computer is booted.
Free Windows Admin Tool Kit Click here and download it now
August 9th, 2010 8:39pm

It is the username file I am interested in. Can this change without someone actually being on the PC? Or does this mean that somebody had to be using my computer at that time?
August 9th, 2010 9:25pm

If you think about it, it had to be switched on. It’s unlikely, but the system date/ time could be wrong, or, depending upon internet access, it could have been intentionally changed then corrected. Additionally, the computer may have a ‘Wake on’ setting but I assume you would know about that.Have a look at all the ntuser.dat files. First of all in Folder Options > View, make sure you have a check in Display the full path and Show Hidden files. There should be no ticks in Hide extensions and Hide protected OS files. Then navigate to the \Users folder and type ntuser.dat into the Search box.Event viewer is another good place to look for dates, times and events, especially those under Windows Logs, e.g. Security and System.Also, as it’s a work computer, you need to investigate who had/has access to your computer, particularly on a Sunday. Depending upon your relationship with your boss and other employees, you may consider talking to him/her about it.Good luck with your detective work.
Free Windows Admin Tool Kit Click here and download it now
August 9th, 2010 9:58pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics