Windows XP Default User Profile Configuration Files

When a new user logged into Windows XP for the first time, the operating system generated their desktop and personal environment by copying a template known as the Default User profile. This process was governed by specific files, primarily the NTUSER.DAT registry hive, physical file system directories, and underlying setup information (.inf) files that dictated wallpaper, visual styles, desktop icons, and system preferences.

The Default User Profile Directory

Windows XP stored the template for all new accounts in a hidden system folder located at:

C:\Documents and Settings\Default User

During the initial login of a newly created account, the User Profile Service copied the contents of this folder into a new directory named after the user.

NTUSER.DAT

The most critical configuration file managing default desktop settings was NTUSER.DAT, located directly inside the Default User directory.

  • Function: It represents the registry hive that mounts as HKEY_CURRENT_USER (HKCU) when a user logs in.
  • Settings Controlled: Desktop wallpaper, visual themes, screen savers, window colors, mouse pointer schemes, Start menu layout, and user-specific application defaults.
  • Customization: Administrators customized this file by loading the hive into the Registry Editor (regedit.exe) under HKEY_USERS, modifying the keys, and unloading the hive, or by configuring an account, logging out, and copying its NTUSER.DAT over the default version.

The Desktop Directory and Desktop.ini

Physical items that appeared on a new user’s screen were managed by the file system:

  • ..\Default User\Desktop Folder: Any shortcuts, files, or folders placed inside this directory were copied directly to the new user’s personal desktop.
  • desktop.ini: A hidden, system-attributed file within the desktop and other shell folders that specified folder properties, custom icons, and localized resource names.
  • All Users Desktop: While not part of profile creation, files located in C:\Documents and Settings\All Users\Desktop were merged with the user's personal desktop view, displaying shortcuts across all profiles on the machine.

HIVEDEF.INF

During the initial installation of Windows XP, the default profile hive was generated using HIVEDEF.INF, located in the C:\Windows\inf directory.

  • Function: This setup configuration file defined the baseline registry entries that Windows XP wrote to NTUSER.DAT during the operating system setup phase.
  • Settings Controlled: Default visual settings, Control Panel parameters, accessibility defaults, and Windows Explorer interface preferences prior to any user logging in or administrative customization.

Sysprep and Setup Automation Files

In enterprise deployments, new profile settings were often deployed using automation files:

  • sysprep.inf: Used alongside the System Preparation tool, utilizing the UpdateDefaultProfile=1 parameter to copy the currently configured local administrator profile directly into the Default User directory before machine imaging.
  • unattend.txt: Used during unattended OS installations to set default themes, display resolutions, and run custom scripts that altered profile templates before accounts were provisioned.