Important Notice: On February 29th, this community was put into read-only mode. All existing posts will remain but customers are unable to add new posts or comment on existing. Please feel to join our Community Discord for any questions and discussions.

NTUSER.dat time stamp changing during Inventory Scan

I have a general question about PDQ Inventory and the ntuser.dat file. I notice that after running an inventory on a machine, that the ntuser.dat file for each user account on that machine has a date stamp change at the same time. Looking at the Windows Event Log I see entries like the following:

The access history in hive ??\C:\Users\user.name\NTUSER.DAT was cleared updating 6 keys and creating 3 modified pages <<

I note in the PDQ forum that comments were made stating that Inventory does not scan for the ntuser.dat file(s), so I was wondering if what I am seeing is the expected behavior or not. Should the ntuser.dat files for each user be showing a new date/time stamp corresponding with the inventory?

Thanks; Nick Seman

1

Comments

0 comments