I have a general question about PDQ Inventory and the ntuser.dat file. I notice that after running an inventory on a machine, that the ntuser.dat file for each user account on that machine has a date stamp change at the same time. Looking at the Windows Event Log I see entries like the following:
The access history in hive ??\C:\Users\user.name\NTUSER.DAT was cleared updating 6 keys and creating 3 modified pages <<
I note in the PDQ forum that comments were made stating that Inventory does not scan for the ntuser.dat file(s), so I was wondering if what I am seeing is the expected behavior or not. Should the ntuser.dat files for each user be showing a new date/time stamp corresponding with the inventory?
Thanks; Nick Seman
Please sign in to leave a comment.