why ntuser.dat file time stamp is not updated for over a y..

Jack · External Since: Jul 03, 2007 Posts: 22

Hello,
I am trying to find out under what circuimstances ntuser.dat
registry file will not be time stamped, even when user login into Windows
daily and performs regular tasks such as running programs.
I have checked on my 3 computers running Win XP and soon after I start
Windows, few minutes later, ntuser.dat will update time stamp to the current
date.
However, over last few years I had few situations, when the persons using
Windows XP had their usernt.dat file time stamp not updated for 500 or more
days!
How is that possible?
Jack

"Pegasus · External Since: Oct 14, 2005 Posts: 1845

"Jack" <replyto@it> wrote in message
news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
> Hello,
> I am trying to find out under what circuimstances ntuser.dat
> registry file will not be time stamped, even when user login into Windows
> daily and performs regular tasks such as running programs.
> I have checked on my 3 computers running Win XP and soon after I start
> Windows, few minutes later, ntuser.dat will update time stamp to the
> current date.
> However, over last few years I had few situations, when the persons using
> Windows XP had their usernt.dat file time stamp not updated for 500 or
> more days!
> How is that possible?
> Jack
>

You're probably looking in the wrong profile folder.

Jack · External Since: Jul 03, 2007 Posts: 22

No.
It is not me who is looking, but my code.
And my code is looking at ntuser.dat located in the current user profile.
"C:\Documents and Settings\<current user name>\ntuser.dat"
<Current User Name> is determined by API call.
It works 99.5% of the time but .remaining 05% is the reason I would like to
find the answer.
Jack

"Pegasus (MVP)" <I.can DeleteThis @fly.com> wrote in message
news:OkFOkFavHHA.1204@TK2MSFTNGP03.phx.gbl...
>
> "Jack" <replyto@it> wrote in message
> news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
>> Hello,
>> I am trying to find out under what circuimstances ntuser.dat
>> registry file will not be time stamped, even when user login into Windows
>> daily and performs regular tasks such as running programs.
>> I have checked on my 3 computers running Win XP and soon after I start
>> Windows, few minutes later, ntuser.dat will update time stamp to the
>> current date.
>> However, over last few years I had few situations, when the persons using
>> Windows XP had their usernt.dat file time stamp not updated for 500 or
>> more days!
>> How is that possible?
>> Jack
>>
>
> You're probably looking in the wrong profile folder.
>

"Pegasus · External Since: Oct 14, 2005 Posts: 1845

You should have a look here to make sure you're looking at
the right profile folder:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist\
\REGISTRY\USER\S-1-5-21-4233798886-620521722-3728218106-1004

"Jack" <replyto@it> wrote in message
news:uJBSzCbvHHA.1164@TK2MSFTNGP02.phx.gbl...
> No.
> It is not me who is looking, but my code.
> And my code is looking at ntuser.dat located in the current user profile.
> "C:\Documents and Settings\<current user name>\ntuser.dat"
> <Current User Name> is determined by API call.
> It works 99.5% of the time but .remaining 05% is the reason I would like
> to find the answer.
> Jack
>
> "Pegasus (MVP)" <I.can.RemoveThis@fly.com> wrote in message
> news:OkFOkFavHHA.1204@TK2MSFTNGP03.phx.gbl...
>>
>> "Jack" <replyto@it> wrote in message
>> news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
>>> Hello,
>>> I am trying to find out under what circuimstances ntuser.dat
>>> registry file will not be time stamped, even when user login into
>>> Windows daily and performs regular tasks such as running programs.
>>> I have checked on my 3 computers running Win XP and soon after I start
>>> Windows, few minutes later, ntuser.dat will update time stamp to the
>>> current date.
>>> However, over last few years I had few situations, when the persons
>>> using Windows XP had their usernt.dat file time stamp not updated for
>>> 500 or more days!
>>> How is that possible?
>>> Jack
>>>
>>
>> You're probably looking in the wrong profile folder.
>>
>
>

Jack · External Since: Jul 03, 2007 Posts: 22

The API call I use is:
GetUserName()
http://msdn2.microsoft.com/en-us/library/ms724432.aspx

This is a recommended method by Microsoft to obtain the current user name.
Jack

"Pegasus (MVP)" <I.can.RemoveThis@fly.com> wrote in message
news:OORKcGbvHHA.536@TK2MSFTNGP06.phx.gbl...
> You should have a look here to make sure you're looking at
> the right profile folder:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist\
> \REGISTRY\USER\S-1-5-21-4233798886-620521722-3728218106-1004
>
> "Jack" <replyto@it> wrote in message
> news:uJBSzCbvHHA.1164@TK2MSFTNGP02.phx.gbl...
>> No.
>> It is not me who is looking, but my code.
>> And my code is looking at ntuser.dat located in the current user profile.
>> "C:\Documents and Settings\<current user name>\ntuser.dat"
>> <Current User Name> is determined by API call.
>> It works 99.5% of the time but .remaining 05% is the reason I would like
>> to find the answer.
>> Jack
>>
>> "Pegasus (MVP)" <I.can.RemoveThis@fly.com> wrote in message
>> news:OkFOkFavHHA.1204@TK2MSFTNGP03.phx.gbl...
>>>
>>> "Jack" <replyto@it> wrote in message
>>> news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
>>>> Hello,
>>>> I am trying to find out under what circuimstances ntuser.dat
>>>> registry file will not be time stamped, even when user login into
>>>> Windows daily and performs regular tasks such as running programs.
>>>> I have checked on my 3 computers running Win XP and soon after I start
>>>> Windows, few minutes later, ntuser.dat will update time stamp to the
>>>> current date.
>>>> However, over last few years I had few situations, when the persons
>>>> using Windows XP had their usernt.dat file time stamp not updated for
>>>> 500 or more days!
>>>> How is that possible?
>>>> Jack
>>>>
>>>
>>> You're probably looking in the wrong profile folder.
>>>
>>
>>
>
>

Jack · External Since: Jul 03, 2007 Posts: 22

Also, by the exchanging emails with the user I confirmed that the user name
is correct.
There must be something else causing that.
Jack

"Pegasus (MVP)" <I.can RemoveThis @fly.com> wrote in message
news:OORKcGbvHHA.536@TK2MSFTNGP06.phx.gbl...
> You should have a look here to make sure you're looking at
> the right profile folder:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist\
> \REGISTRY\USER\S-1-5-21-4233798886-620521722-3728218106-1004
>
> "Jack" <replyto@it> wrote in message
> news:uJBSzCbvHHA.1164@TK2MSFTNGP02.phx.gbl...
>> No.
>> It is not me who is looking, but my code.
>> And my code is looking at ntuser.dat located in the current user profile.
>> "C:\Documents and Settings\<current user name>\ntuser.dat"
>> <Current User Name> is determined by API call.
>> It works 99.5% of the time but .remaining 05% is the reason I would like
>> to find the answer.
>> Jack
>>
>> "Pegasus (MVP)" <I.can RemoveThis @fly.com> wrote in message
>> news:OkFOkFavHHA.1204@TK2MSFTNGP03.phx.gbl...
>>>
>>> "Jack" <replyto@it> wrote in message
>>> news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
>>>> Hello,
>>>> I am trying to find out under what circuimstances ntuser.dat
>>>> registry file will not be time stamped, even when user login into
>>>> Windows daily and performs regular tasks such as running programs.
>>>> I have checked on my 3 computers running Win XP and soon after I start
>>>> Windows, few minutes later, ntuser.dat will update time stamp to the
>>>> current date.
>>>> However, over last few years I had few situations, when the persons
>>>> using Windows XP had their usernt.dat file time stamp not updated for
>>>> 500 or more days!
>>>> How is that possible?
>>>> Jack
>>>>
>>>
>>> You're probably looking in the wrong profile folder.
>>>
>>
>>
>
>

Jack · External Since: Jul 03, 2007 Posts: 22

I have tried that key.
On my computer the value is:
\Device\HarddiskVolume1\Documents and Settings\Jacek\ntuser.dat
How to translate that path to the generally accepted format?
Jack

"Pegasus (MVP)" <I.can RemoveThis @fly.com> wrote in message
news:OORKcGbvHHA.536@TK2MSFTNGP06.phx.gbl...
> You should have a look here to make sure you're looking at
> the right profile folder:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist\
> \REGISTRY\USER\S-1-5-21-4233798886-620521722-3728218106-1004
>
> "Jack" <replyto@it> wrote in message
> news:uJBSzCbvHHA.1164@TK2MSFTNGP02.phx.gbl...
>> No.
>> It is not me who is looking, but my code.
>> And my code is looking at ntuser.dat located in the current user profile.
>> "C:\Documents and Settings\<current user name>\ntuser.dat"
>> <Current User Name> is determined by API call.
>> It works 99.5% of the time but .remaining 05% is the reason I would like
>> to find the answer.
>> Jack
>>
>> "Pegasus (MVP)" <I.can RemoveThis @fly.com> wrote in message
>> news:OkFOkFavHHA.1204@TK2MSFTNGP03.phx.gbl...
>>>
>>> "Jack" <replyto@it> wrote in message
>>> news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
>>>> Hello,
>>>> I am trying to find out under what circuimstances ntuser.dat
>>>> registry file will not be time stamped, even when user login into
>>>> Windows daily and performs regular tasks such as running programs.
>>>> I have checked on my 3 computers running Win XP and soon after I start
>>>> Windows, few minutes later, ntuser.dat will update time stamp to the
>>>> current date.
>>>> However, over last few years I had few situations, when the persons
>>>> using Windows XP had their usernt.dat file time stamp not updated for
>>>> 500 or more days!
>>>> How is that possible?
>>>> Jack
>>>>
>>>
>>> You're probably looking in the wrong profile folder.
>>>
>>
>>
>
>

Olof Lagerkvist · External Since: Jul 04, 2007 Posts: 12

Jack wrote:

> The API call I use is:
> GetUserName()
> http://msdn2.microsoft.com/en-us/library/ms724432.aspx
>
> This is a recommended method by Microsoft to obtain the current user name.

That is the recommended way to get the current user name but NOT the
recommended way to get the current user profile path. Please note that
there is no guarantee that the the current user path is C:\Documents and
Settings\<current user name>, if for example the ntuser.dat in the user
profile is damaged in some way and cannot be loaded when the user logs
on the user will get a new profile with a new path. Same goes if there
is already another directory present with the name C:\Documents and
Settings\<current user name> when the user logs on for the first time.

Either do like "Pegasus" said, look at the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist registry
key for loaded hive files or use the GetUserProfileDirectory() API.

--
Olof Lagerkvist
ICQ: 724451
Web: http://here.is/olof

Jack · External Since: Jul 03, 2007 Posts: 22

Olof,
Thank you for the insight. I see I have not explained all
properly.
I do not use a hardcoded path.
What I do is:
In Windows registry I look up the path to 'Desktop'
HKEY_CURRENT_USER/"Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
Folders"
From that key I extract path, then I add the current user name (returned
from API) and that is the way I create path to the ntuser.dat file.
What can be wrong with that approach?
Thanks,
Jack

"Olof Lagerkvist" <sorry.RemoveThis@no.mail> wrote in message
news:u6$%23y8bvHHA.1104@TK2MSFTNGP06.phx.gbl...
> Jack wrote:
>
>> The API call I use is:
>> GetUserName()
>> http://msdn2.microsoft.com/en-us/library/ms724432.aspx
>>
>> This is a recommended method by Microsoft to obtain the current user
>> name.
>
>
> That is the recommended way to get the current user name but NOT the
> recommended way to get the current user profile path. Please note that
> there is no guarantee that the the current user path is C:\Documents and
> Settings\<current user name>, if for example the ntuser.dat in the user
> profile is damaged in some way and cannot be loaded when the user logs on
> the user will get a new profile with a new path. Same goes if there is
> already another directory present with the name C:\Documents and
> Settings\<current user name> when the user logs on for the first time.
>
> Either do like "Pegasus" said, look at the
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist registry key
> for loaded hive files or use the GetUserProfileDirectory() API.
>
> --
> Olof Lagerkvist
> ICQ: 724451
> Web: http://here.is/olof

"Pegasus · External Since: Oct 14, 2005 Posts: 1845

To remove any doubt about the location of this file, do this while
the user is logged on:
- Unhide it (this will work).
- Try to rename it to "ntuser.dat" (this won't work while the user is logged
on).

"Jack" <replyto@it> wrote in message
news:%23qq6geevHHA.4516@TK2MSFTNGP06.phx.gbl...
>I have tried that key.
> On my computer the value is:
> \Device\HarddiskVolume1\Documents and Settings\Jacek\ntuser.dat
> How to translate that path to the generally accepted format?
> Jack
>
> "Pegasus (MVP)" <I.can.DeleteThis@fly.com> wrote in message
> news:OORKcGbvHHA.536@TK2MSFTNGP06.phx.gbl...
>> You should have a look here to make sure you're looking at
>> the right profile folder:
>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist\
>> \REGISTRY\USER\S-1-5-21-4233798886-620521722-3728218106-1004
>>
>> "Jack" <replyto@it> wrote in message
>> news:uJBSzCbvHHA.1164@TK2MSFTNGP02.phx.gbl...
>>> No.
>>> It is not me who is looking, but my code.
>>> And my code is looking at ntuser.dat located in the current user
>>> profile.
>>> "C:\Documents and Settings\<current user name>\ntuser.dat"
>>> <Current User Name> is determined by API call.
>>> It works 99.5% of the time but .remaining 05% is the reason I would like
>>> to find the answer.
>>> Jack
>>>
>>> "Pegasus (MVP)" <I.can.DeleteThis@fly.com> wrote in message
>>> news:OkFOkFavHHA.1204@TK2MSFTNGP03.phx.gbl...
>>>>
>>>> "Jack" <replyto@it> wrote in message
>>>> news:%23lBw4$ZvHHA.3444@TK2MSFTNGP04.phx.gbl...
>>>>> Hello,
>>>>> I am trying to find out under what circuimstances
>>>>> ntuser.dat registry file will not be time stamped, even when user
>>>>> login into Windows daily and performs regular tasks such as running
>>>>> programs.
>>>>> I have checked on my 3 computers running Win XP and soon after I start
>>>>> Windows, few minutes later, ntuser.dat will update time stamp to the
>>>>> current date.
>>>>> However, over last few years I had few situations, when the persons
>>>>> using Windows XP had their usernt.dat file time stamp not updated for
>>>>> 500 or more days!
>>>>> How is that possible?
>>>>> Jack
>>>>>
>>>>
>>>> You're probably looking in the wrong profile folder.
>>>>
>>>
>>>
>>
>>
>
>

Olof Lagerkvist · External Since: Jul 04, 2007 Posts: 12

Jack wrote:
> Olof,
> Thank you for the insight. I see I have not explained all
> properly.
> I do not use a hardcoded path.
> What I do is:
> In Windows registry I look up the path to 'Desktop'
> HKEY_CURRENT_USER/"Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
> Folders"
> From that key I extract path, then I add the current user name (returned
> from API) and that is the way I create path to the ntuser.dat file.
> What can be wrong with that approach?

Still the same problem. You are using the user name returned by
GetUserName() and may not necessarily be part of the path to the user's
profile.

Think about this situation:

You have a user 'user1' and log on that user. A profile 'C:\Documents
and Settings\user1' is created and the ntuser.dat is then 'C:\Documents
and Settings\user1\ntuser.dat'. Your technique will find the ntuser.dat
successfully because you get the path 'C:\Documents and
Settings\user1\Desktop' from the registry and the user name 'user1' from
GetUserName(), you extract 'C:\Documents and Settings' and then add
'\user1\ntuser.dat' and that will work.

Now, example 1:
Someone renames the user account 'user1' to 'user2'. The profile is
still 'C:\Documents and Settings\user1' but the GetUserName() function
will return 'user2' and your approach will no longer work.

Example 2:
Someone changes the location for the user's desktop from 'C:\Documents
and Settings\user1\Desktop' because he wants to share the desktop of
another user's profile and set it to 'C:\Documents and
Settings\anotheruser\Desktop'. Your method will find the wrong directory
in this case too.

Example 3:
Someone adds the computer to the domain 'domainname' and makes a domain
logon with a domain account that also has the name 'user1'. A new user
profile is created for this domain account 'C:\Documents and
Settings\user1.domainname'. GetUserName() will return just 'user1'...

etc...

--
Olof Lagerkvist
ICQ: 724451
Web: http://here.is/olof

Jack · External Since: Jul 03, 2007 Posts: 22

Olof,
What is your opinion about using:
SHGetFolderPath() with CSIDL_PROFILE?
I appreciate your comments,
Jack

"Olof Lagerkvist" <sorry DeleteThis @no.mail> wrote in message
news:uR1XkYjvHHA.4332@TK2MSFTNGP06.phx.gbl...
> Jack wrote:
>> Olof,
>> Thank you for the insight. I see I have not explained all
>> properly.
>> I do not use a hardcoded path.
>> What I do is:
>> In Windows registry I look up the path to 'Desktop'
>> HKEY_CURRENT_USER/"Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
>> Folders"
>> From that key I extract path, then I add the current user name (returned
>> from API) and that is the way I create path to the ntuser.dat file.
>> What can be wrong with that approach?
>
>
> Still the same problem. You are using the user name returned by
> GetUserName() and may not necessarily be part of the path to the user's
> profile.
>
> Think about this situation:
>
> You have a user 'user1' and log on that user. A profile 'C:\Documents and
> Settings\user1' is created and the ntuser.dat is then 'C:\Documents and
> Settings\user1\ntuser.dat'. Your technique will find the ntuser.dat
> successfully because you get the path 'C:\Documents and
> Settings\user1\Desktop' from the registry and the user name 'user1' from
> GetUserName(), you extract 'C:\Documents and Settings' and then add
> '\user1\ntuser.dat' and that will work.
>
> Now, example 1:
> Someone renames the user account 'user1' to 'user2'. The profile is still
> 'C:\Documents and Settings\user1' but the GetUserName() function will
> return 'user2' and your approach will no longer work.
>
> Example 2:
> Someone changes the location for the user's desktop from 'C:\Documents and
> Settings\user1\Desktop' because he wants to share the desktop of another
> user's profile and set it to 'C:\Documents and
> Settings\anotheruser\Desktop'. Your method will find the wrong directory
> in this case too.
>
> Example 3:
> Someone adds the computer to the domain 'domainname' and makes a domain
> logon with a domain account that also has the name 'user1'. A new user
> profile is created for this domain account 'C:\Documents and
> Settings\user1.domainname'. GetUserName() will return just 'user1'...
>
> etc...
>
> --
> Olof Lagerkvist
> ICQ: 724451
> Web: http://here.is/olof

Olof Lagerkvist · External Since: Jul 04, 2007 Posts: 12

Jack wrote:

> Olof,
> What is your opinion about using:
> SHGetFolderPath() with CSIDL_PROFILE?
> I appreciate your comments,

That should work (as long as you specify the SHGFP_TYPE_CURRENT flag),
or you can use GetUserProfileDirectory().

Either of them should return the same, currently correct, user profile path.

--
Olof Lagerkvist
ICQ: 724451
Web: http://here.is/olof

Jack · External Since: Jul 03, 2007 Posts: 22

Thank you.
Jack
"Olof Lagerkvist" <sorry RemoveThis @no.mail> wrote in message
news:Odm5i78vHHA.4544@TK2MSFTNGP05.phx.gbl...
> Jack wrote:
>
>> Olof,
>> What is your opinion about using:
>> SHGetFolderPath() with CSIDL_PROFILE?
>> I appreciate your comments,
>
>
> That should work (as long as you specify the SHGFP_TYPE_CURRENT flag), or
> you can use GetUserProfileDirectory().
>
> Either of them should return the same, currently correct, user profile
> path.
>
> --
> Olof Lagerkvist
> ICQ: 724451
> Web: http://here.is/olof