Temporary Profile at Login: Repairing a Corrupted Windows Profile

The user logs on, the desktop is blank, the wallpaper is default and a notification says they have been signed in with a temporary profile. Their files are still on the disk, but Windows could not load their profile and built a throwaway one instead. Anything saved now will be gone at the next logoff.

This happens after an unclean shutdown, a failed update, a disk error or an antivirus product locking NTUSER.DAT at logon. The repair is straightforward if you follow the order below and do not let the user keep working in the temporary profile.

First, stop the bleeding

Tell the user not to save anything to the desktop or documents until you are done. Confirm the real profile folder still exists under `C:\Users`. If it is there and has a recent modified date, the data is safe and this is a registry fix. If the folder is missing or nearly empty, stop and check backups before going further.

Check `C:\Users` for the user's folder and a folder named TEMP. The TEMP folder is the temporary profile.
Open Event Viewer, Windows Logs > Application, and look for Event ID 1511 or 1515 from User Profile Service. They tell you why the profile failed to load.
Run `chkdsk C: /scan` from an elevated prompt. A profile that fails after a crash sometimes has disk damage behind it.

chkdsk C: /scan
Get-WinEvent -LogName Application -MaxEvents 200 | Where-Object { $_.Id -in 1511,1515,1508 } | Format-List TimeCreated, Message

Repair the profile registry entry

Windows keeps a list of profiles under the ProfileList key in the registry. When a profile fails to load, Windows renames that user's key with a .bak suffix and creates a new key that points at the temporary profile. Fixing it means removing the bad key and dropping the .bak from the good one.

Log on as a different local administrator to do this. You cannot cleanly edit a profile that is currently loaded.

Open `regedit` and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`.
Find the SID key for the user. There will be two: one ending in .bak and one without. Click each and check the ProfileImagePath value. The .bak one points at the real folder.
Delete the key without .bak, which points at C:\Users\TEMP.
Rename the .bak key to remove the suffix.
Inside that key, set RefCount to 0 and State to 0.
Reboot and have the user log on. Do not skip the reboot; a plain logoff sometimes reloads the temp profile.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s | findstr /i "ProfileImagePath"

When the registry fix does not hold

If the user gets the temporary profile again after the reboot, the profile itself is damaged, usually NTUSER.DAT. Check permissions on the profile folder first. The user must have Full Control on their own folder and on NTUSER.DAT. Antivirus quarantine and overzealous cleanup tools break this more often than actual corruption.

If permissions are fine and the profile still fails, rebuild it. Rename the old folder, let Windows create a fresh one, then copy the data back. Do not copy NTUSER.DAT or the AppData\Local\Microsoft\Windows folder from the old profile; that is where the damage lives.

Log on as an administrator and rename `C:\Users\jsmith` to `C:\Users\jsmith.old`.
Delete the user's key under ProfileList so Windows builds a new one.
Reboot and log on as the user. A clean profile is created.
Copy Desktop, Documents, Downloads, Pictures and Favorites from the .old folder. Use `robocopy` with `/E /COPY:DAT /R:1 /W:1` so a locked file does not stall the copy.
Re-add Outlook profiles, browser sign-ins and printer connections. Signatures live in `AppData\Roaming\Microsoft\Signatures` and copy safely.
Keep the .old folder for two weeks, then delete it.

robocopy C:\Users\jsmith.old\Documents C:\Users\jsmith\Documents /E /COPY:DAT /R:1 /W:1

Keep it from happening again

Most repeat cases come from the same three sources: hard power-offs, roaming or redirected profiles on a slow link, and security tools scanning NTUSER.DAT at logon. Fix the source and you fix the ticket.

If the user's data is redirected to a file server or synced with OneDrive Known Folder Move, a rebuilt profile is cheap because the data comes back on its own. That is a strong reason to turn Known Folder Move on for every Microsoft 365 user.

Add exclusions for `NTUSER.DAT` and `UsrClass.dat` in your endpoint protection product.
Teach users to shut down through the Start menu, and use a UPS on desktops where the power is unreliable.
Enable OneDrive Known Folder Move so Desktop and Documents survive a profile rebuild without a copy step.
Keep local profiles small. Large profiles take longer to load and are more likely to fail on an unclean shutdown.

Frequently asked questions

Did the user lose their files?

Almost never. The original profile folder is still on disk. Only files saved while in the temporary profile are at risk, which is why the first step is telling the user to stop saving.

Can I just delete the TEMP folder?

Only after you have fixed the registry entry or rebuilt the profile, and after copying anything the user saved there. Deleting it while the temp profile is in use does not help.

Why does it keep coming back on one PC?

Check the disk with chkdsk and look at the SMART data. A drive that is starting to fail corrupts NTUSER.DAT on every unclean shutdown.

Takeaway

A temporary profile is a registry pointer problem first and a corrupted profile second. Fix the ProfileList key, reboot and test. If it comes back, rebuild the profile and copy the data over, leaving NTUSER.DAT behind. Then remove the cause, whether that is a bad drive, a scanning exclusion or a user who holds the power button.