Where can I find data stored by a Windows Service running as “Local System Account”?

The data you are looking should not, by default, be located in “C:\Documents and Settings\Default User”. That is the location of the default user profile, which is the template for new user profiles. Its only function is to be copied to a new folder for use as a user profile when a user logs onto the computer for the first time.

If the service is following Microsoft’s guidelines, it will be storing data in
the application data folder (%APPDATA%) or the local application data folder (%LOCALAPPDATA% on Windows Vista and later). It should not use the My Documents or Documents folders, but you might want to check there as well.

On a typical installation of Windows XP or Windows Server 2003, check the following locations for application data for programs running as Local System (NT AUTHORITY\SYSTEM):

  • C:\Windows\system32\config\systemprofile\Application Data\Vendor\Program
  • C:\Windows\system32\config\systemprofile\Local Settings\Application Data\Vendor\Program
  • C:\Windows\system32\config\systemprofile\My Documents

On a typical installation of Windows Vista and later versions, check the following locations for application data for programs running as Local System (NT AUTHORITY\SYSTEM):

  • C:\Windows\system32\config\systemprofile\AppData\Roaming\Vendor\Program
  • C:\Windows\system32\config\systemprofile\AppData\Local\Vendor\Program
  • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Vendor\Program
  • C:\Windows\system32\config\systemprofile\Documents

Of course, substitute the appropriate vendor name and program name for Vendor and Program.

[Edit – for bricelam]
For 32 bit processes running on 64 bit windows, it would be in SysWOW64.

  • C:\Windows\SysWOW64\config\systemprofile\AppData

Related Posts:

  1. What exactly are DLL files, and how do they work?
  2. The application was unable to start correctly (0xc000007b)
  3. ‘npm’ is not recognized as internal or external command, operable program or batch file
  4. Difference between xcopy and robocopy
  5. The filename, directory name, or volume label syntax is incorrect inside batch
  6. Bat file to run a .exe at the command prompt
  7. How can I open Java .class files in a human-readable way?
  8. Opening a remote machine’s Windows C drive
  9. Why does CreateProcess give error 193 (%1 is not a valid Win32 app)
  10. Taskkill /f doesn’t kill a process
  11. Bluescreen on windows 10 after using android emulator
  12. XCOPY: Overwrite all without prompt in BATCH
  13. How to install and run the Nmap program through Cygwin in Windows?
  14. How to compile C program on command line using MinGW?
  15. All links in my site start with localhost?
  16. WordPress database setup Windows 2016 IIS
  17. How do you find what process is holding a file open in Windows?
  18. How do I tell Git for Windows where to find my private RSA key?
  19. How to send ctrl+alt+del using Remote Desktop?
  20. What’s the command-line utility in Windows to do a reverse DNS look-up?
  21. Useful Command-line Commands on Windows
  22. How do you add a Windows environment variable without rebooting?
  23. hosts file ignored, how to troubleshoot?
  24. How to refresh hosts file without rebooting
  25. How to sleep in a batch file?
  26. Resolve host name from IP address
  27. Run a .bat file in a scheduled task without a window
  28. Command line to list users in a Windows Active Directory group?
  29. What is Active Directory Domain Services and how does it work?
  30. Is there a global, persistent CMD history?
  31. How do I diff two text files in Windows Powershell?
  32. In Windows, using the command line, how do you check if a remote port is open?
  33. Does Windows have a built-in ZIP command for the command line?
  34. Can you run Docker natively on the new Windows 10 (Ubuntu) bash userspace?
  35. How does CTRL-ALT-DEL to log in make Windows more secure?
  36. How to check if a port is blocked on a Windows machine?
  37. How do I force sync the time on Windows Workstation or Server?
  38. How do I create a symbolic link in Windows?
  39. Best practice: Should I always install a fresh OS for new employees?
  40. How can I tell what version of IIS is installed?
  41. How can I connect to a Windows server using a Command Line Interface? (CLI)
  42. Windows server last reboot time
  43. Windows Active Directory naming best practices?
  44. Why hasn’t rsync caught on in the Windows world? [closed]
  45. Boot and Install Windows from a USB thumb drive
  46. How to fix PuTTY showing garbled characters? [closed]
  47. How to delete cached temporarily credentials for a network share on a Windows machine without rebooting or logging off [duplicate]
  48. How do you free up a port being held open by dead process?
  49. What is the Windows equivalent of Unix “whoami” command?
  50. How to configure a Windows machine to allow file sharing with a DNS alias
  51. Alternatives to Splunk?
  52. Tensorflow import error: No module named ‘tensorflow’
  53. A fatal error occurred while creating a TLS client credential. The internal error state is 10013
  54. How can I install pip on Windows?
  55. What languages are Windows, Mac OS X and Linux written in?
  56. Windows Activator .bat Text
  57. “rm -rf” equivalent for Windows?
  58. VC++ fatal error LNK1168: cannot open filename.exe for writing
  59. How to stop Python closing immediately when executed in Microsoft Windows
  60. What exactly is the scope of Access Violation ‘0xc0000005’?
  61. how to empty recyclebin through command prompt?
  62. How to search all user meta from users.php in the admin
  63. WordPress usermeta scaling for thousands of users
  64. Can an admin check passwords of registered users?
  65. Remove all users from site except one using WP CLI
  66. security+best practices: root or www-data on a wordpress content folder?
  67. How to set custom upload directory per user after moving content directory
  68. How do I properly format the user_role array?
  69. get_users() ORDER BY Not Working
  70. wp_insert_post let users post to without login…broke
  71. How can I find users that didn’t set a password?
  72. WP User Query get all authors with last name starting with specific letter
  73. Get tags for current user
  74. Add value in user table when user is created
  75. How to hide WordPress users’ names externally?
  76. add_cap not working
  77. List users by meta_key and meta_value
  78. MySQL query to mass change role of users
  79. How can I make the user names of commentors clickable links to the user’s profile from the admin comment screen?
  80. List Users alphabetically with heading
  81. Keep Logged in Users out of Admin Panel
  82. How to let users choose posts order in categories?
  83. How to default/force the user’s display_name to their nickname?
  84. Enabling users to control custom loop’s query
  85. How can I get list of emails of users who commented on a post?
  86. Get multiple users with meta value in one query and populate WP_User class
  87. Check if user has comment on current post
  88. How to add an attribute to a user?
  89. Advanced Custom Fields Plugin: how would I get an image src path uploaded from User Profile?
  90. Display custom post front end filter by ACF equals current user
  91. Page template not working when logged out
  92. Front-end uploader logging user out when they attempt to upload image
  93. How to get user profile information before update?
  94. How to save dropdown slection by a user in the DB
  95. How to add karma points to users?
  96. Registered access area
  97. Error when send reset password
  98. Custom registration field to SQL database
  99. How to create a User Role and give permission to only use Web Stories plugin?
  100. Can I provide a user’s user_ID to them and can it also be searchable in a member’s directory

Leave a Comment