Format of NTUSER.DAT ...

Richard Sharpe rsharpe at
Tue Oct 29 08:42:01 GMT 2002


By inspection with od -ha etc, I can see much of the format of NTUSER.DAT.

The early part has, in UNICODE, <CR><LF> (sic) delimited lines, it seems.

Anyway, a little way through has the line $$$PROTO.HIV and then a little 
further on are the SIDS, in the format:

  LEN of this desc       2 bytes
  Permissions            4 bytes
  SID in binary format - remaining bytes
So, I figure I can write a small utility to print this out.

Richard Sharpe, rsharpe at, rsharpe at, 
sharpe at,

More information about the samba-technical mailing list