LocalServive account has large ntuser.dat file

[Guest henrik.b]

Hello

We have on several devices the problem that the Ntuser.dat of the LocalService account become very large. Sometimes up to 400 MB. When looking at the file, we noticed that it is full with following registry key.

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914461387-1320791774-3152069025-533104013-424935961-1302776414-1566832782\Children]

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914572624-1267910262-525051776-3538883882-424935961-1302776414-1566832782]

"DisplayName"="36834550-c676-4b92-80a7-4b1f2a15efd2"

"Moniker"="36834550-c676-4b92-80a7-4b1f2a15efd2"

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914572624-1267910262-525051776-3538883882-424935961-1302776414-1566832782\Children]

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-91464807-1264792384-3287424938-1252972786-424935961-1302776414-1566832782]

"DisplayName"="0573a467-3340-4b63-aa1f-f2c3f2d8ae4a"

"Moniker"="0573a467-3340-4b63-aa1f-f2c3f2d8ae4a"

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-91464807-1264792384-3287424938-1252972786-424935961-1302776414-1566832782\Children]

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914656191-1183208749-2827104168-1453155326-424935961-1302776414-1566832782]

"DisplayName"="36848bbf-552d-4686-a82f-82a8fe639d56"

"Moniker"="36848bbf-552d-4686-a82f-82a8fe639d56"

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914656191-1183208749-2827104168-1453155326-424935961-1302776414-1566832782\Children]

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914660862-1249532112-174747521-470615930-424935961-1302776414-1566832782]

"DisplayName"="36849dfe-58d0-4a7a-816f-6a0a7a070d1c"

"Moniker"="36849dfe-58d0-4a7a-816f-6a0a7a070d1c"

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914660862-1249532112-174747521-470615930-424935961-1302776414-1566832782\Children]

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914699544-1097205005-3803406500-864094546-424935961-1302776414-1566832782]

"DisplayName"="36853518-050d-4166-a460-b3e252098133"

"Moniker"="36853518-050d-4166-a460-b3e252098133"

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914699544-1097205005-3803406500-864094546-424935961-1302776414-1566832782\Children]

 

[HKEY_USERS\S-1-5-19\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-914712719-1179754562-3956332431-3088440940-424935961-1302776414-1566832782]

"DisplayName"="3685688f-a042-4651-8fd7-d0eb6cde15b8"

"Moniker"="3685688f-a042-4651-8fd7-d0eb6cde15b8"

 

 

Devices with this issue have an extremely long boot time and may have trouble restarting after the update.

 

If someone is aware of a similar problem or what may be the cause.

 

As a workaround, I now use the following of the moment.

 

HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Session Manager --> REGSZ PendingFileRenameOperations --> \??\C:\windows\ServiceProfiles\LocalService\NTUSER.DAT

 

More...