Where Regedit Stores User Profile SID Mappings

In the Windows operating system, user accounts are identified internally by unique Security Identifiers (SIDs) rather than usernames. Windows maps these SIDs to their corresponding user profile folders on the local disk using a specific branch within the Windows Registry. This article covers the exact Registry key where SID-to-profile mappings are stored, how the structure works, and the critical values you will find inside each entry.

The Registry Path for ProfileList

The Registry stores the mapping between user SIDs and profile paths in the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

To access this location: 1. Press Win + R, type regedit, and press Enter. 2. Navigate down the tree to the ProfileList key under HKEY_LOCAL_MACHINE.

Structure of the ProfileList Key

Inside the ProfileList folder, you will see multiple subkeys named after specific SIDs:

• Well-Known System SIDs: Short identifiers such as S-1-5-18 (Local System), S-1-5-19 (Local Service), and S-1-5-20 (Network Service) point to built-in system service profiles.
• Standard User SIDs: Longer identifiers, typically starting with S-1-5-21-..., represent local and domain user accounts created on the machine.

Key Values Inside Each SID Subkey

When you select a specific SID subkey, several values appear in the right-hand pane:

• ProfileImagePath: A REG_EXPAND_SZ string that contains the absolute directory path to the user’s profile folder (for example, C:\Users\JohnDoe). This is the primary value linking the SID directly to the physical storage location on the drive.
• Sid: A binary value (REG_BINARY) containing the raw binary representation of the Security Identifier.
• State: A DWORD value indicating the current status of the profile (such as whether it is loaded, temporary, or mandatory).
• Flags: A DWORD containing internal configuration flags for the profile management subsystem.

Handling Corrupted Profiles (.bak)

If Windows encounters an error loading a user profile, it may append a .bak extension to that user’s SID key (for example, S-1-5-21-...bak) and create a temporary fallback key. System administrators frequently inspect the ProfileList path to fix temporary profile loops by removing or renaming these duplicate .bak subkeys.