ntuser.dat in \public

[stuck]

Win 7 Starter Ed on an Acer Aspire One D270 netbook...

If I browse to:
computer\c;\users\public
I can see a list of all the public folders (logical!)
BUT I also see a NTUSER.DAT file. The date modified says 23 June, i.e. not current, it appears to be a few days old.

Isn't that a registry hive? If so, why is it in \Public? Or, at the very least, why isn't it hidden?

I do NOT have show hidden files ticked nor have I unticked the option to hide system files.

Any suggestions? I've wondered about taking a copy of the file and putting that somewhere else and then deleting the original to see what happens but I don't want to get locked out of my new toy.

Ken

[HansV]

Strange - you're correct that a 'real' registry file should not be visible if "Hide protected operatung system files" is ticked. And there is no NTUSER.DAT in C:\Users\Public on my PC with Windows 7.

Unless you have reason to suspect that there is something wrong, I'd leave it alone though. Why take a risk?

[stuck]

At the moment the only things I think are wrong is the fact the file is there and that it's visible, especially now that you've said there isn't an equivalent in your Win 7 PC, even though your PC will not be Starter Ed.

I'll leave it for now. I'm going to make sure all file sharing is turned off before I set off on my travels anyway. Don't want any unwanted visitors if I connect to open networks in hotels etc.

Thanks,

Ken

[HansV]

No, I don't have the Starter Edition. On my work PC, I have the other extreme: Windows 7 Enterprise.

[StuartR]

I think that there is very little risk in deleting this file. If it really is a registry hive that is in use then it will be locked and you won't be able to delete it.

[stuck]

As ever, now that I've made a post about a problem, something occurs to me.

I wonder if this file has come from my main desktop PC? I copied stuff from there to the netbook's \Public folder. My main PC is XPMCE. It too doesn't have hidden files set to visible in normal use but I did change that temporarily recently. I wanted to make sure I copied over all the hidden Picasa.ini files, so that I didn't have to relabel anything on the netbook. Maybe I didn't rehide files straight away and so I somehow picked up a copy of NTUSER.DAT during another copy?

Think I'll go and Google to find out where NTUSER.DAT normally lives on an XPMCE box.

Ken

[HansV]

OK, that makes it likely that the file came from your XP box. As Stuart wrote, if it is a 'real' registry file you won't be able to delete it, so you can give it a try.

[Bigaldoc]

... Think I'll go and Google to find out where NTUSER.DAT normally lives on an XPMCE box.

You've probably already Googled the answer, Ken. But like Hans I have no file(s) like that on my Win 7 Pro.

I do have a bunch of 'em on XP MCE, in EACH user profile of Documents and Settings. There's TWO in each profile, user.dat AND user.dat.log.

[stuck]

Yes, done a search. Interestingly one of the hits:
http://www.ehow.com/about_6697490_ntuser-dat-file_.html
says, "The NTUSER.DAT file is in your user folder. In Windows 7 and Windows Vista, user folders are at C:\Users\USER_NAME." yet you and Hans both say your Win 7 setups don't have such a file where user_name = Public

I'm typing this on my work PC (lunch time here) while trying to look at the netbook on the desk next to me at the same time.

Ken

[stuck]

When I select the \Public folder and then show hidden files AND system files I can see five more files beginning NTUSER.DAT. The file names end:
.LOG1
.LOG2
[long complicated mix of numbers & text]TM.BIF
[same long numbers & text.TMContainer[sting of zeros]1.regtrans-ms
[as above]2.regtrans-ms

Unlike the visible NTUSER.DAT, which has only A as an attribute, these five all have attributes of HSA. The time stamps on all 5 are identical to identical to the visible NTUSER.DAT. That suggests my visible NTUSER is part of that set.

The question then becomes, why doesn't it have the same HS attributes?

Ken

[HansV]

None of those files is "native" to Windows 7, so they must all be from WP. Why one of them lost the hidden/system attributes is hard to say.
Try deleting (or moving) them all.

[stuck]

None of those files is "native" to Windows 7

I hate to doubt you but are you sure? If I look in Users\[myusername] and reveal the hidden & system files then all 6 NTUSER files are there as well. The only difference is that the same long alphanumeric number in three of the file names is different to the string in the equivalent files in \Public. The \[myusername folder] also has a file called ntuser.ini

All of these files in \[myusername] have HS attributes, with the NTUSER.DAT additionally having an 'I' (what's that mean?)

I'm now wondering if the visible NTUSER.DAT file in \Public does belong there but should have attributes of HS?

Ken

[stuck]

Hmm, something from MS Answers: NTUSER.dat became visible
I have installed Ccleaner and I have used it to scan the netbook's registry but as yet that's all I've done. I've NOT actually let it 'fix' any issues it has identified. I did use Ccleaner's uninstall option to remove some things (e.g. Fooz Kids).

Ken

[HansV]

Well, I just checked my home PC, with Windows 7 Home Premium.
The C:\Users\Public folder there contains 9 files whose names begin with NTUSER.DAT. NTUSER.DAT itself does *not* have HS attributes, the other 8 do have HS.
Most of the files have a last modified date of 29-Jan-2010, the day that I got this computer; NTUSER.DAT itself was last modified on 09-Feb-2011.

So now I'm inclined to revert to my original recommendation: leave alone, even though I have no idea what these files are for and why NTUSER.DAT isn't hidden.

BTW, the "I" attribute means "Not content indexed".

[stuck]

...leave alone

Sounds like a plan. I'll do that.

Still seems odd to me that a reg. file should be visible and in a public folder too.

Ken

[HansV]

The ways of Windows are wondrous. We are just its humble servants, it is not for us to doubt them.