ProfSvc Service Failed the Sign-in Fix (Windows 11, 10)

Windows is telling you The ProfSvc service failed the sign-in or The User Profile Service service failed the sign-in. User profile cannot be loaded. Same problem, two wordings.

The fix, in one line: boot into Safe Mode, open Registry Editor, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, find the key whose name ends in .bak, delete the matching key without .bak if one exists, rename the .bak key to drop the suffix, set RefCount and State to 0, restart.

Your files are safe. They are sitting in C:\Users\YourName and this error has not touched them.

There is one problem with that summary, and it is the reason most guides on this error are useless: you usually cannot sign in at all, so you cannot open Registry Editor. The first real step is getting somewhere you can work from. That is where this page starts.

The Saturday Jake Could Not Open His Own Till

Jake runs a small mobile phone shop. The counter PC does everything — billing, stock, the warranty register, the spreadsheet of who has paid a deposit on which handset.

On the busiest Saturday of the month he typed his password, and Windows said:

The ProfSvc service failed the sign-in.
The service did not respond to the start or control request in a timely fashion.

He typed the password again, more carefully. Same message. He restarted. Same message.

By eleven he had lost two sales because he could not check stock, and had written three deposit receipts by hand on the back of a warranty pad. He phoned Ethan.

"Right," Ethan said. "First thing: your files are fine. Nothing has been deleted. Windows is refusing to open the door, not burning down the house."

"You're sure? Because the message says the profile cannot be loaded."

"Loaded, not lost. Think of your user profile as a filing cabinet with a jammed drawer. The paperwork inside is completely fine. The runner is bent. We're going to unbend the runner."

Jake was quiet for a second. "So why is it telling me it failed to sign in? That sounds like the password."

"It isn't the password. If the password were wrong you'd get a different message entirely. Windows accepted who you are, then fell over trying to hand you your desk."

What ProfSvc Actually Is, and What the Error Is Telling You

ProfSvc is the short internal name of a Windows service. Its friendly name, the one you see in the Services list, is User Profile Service. They are the same thing, which is why you will see the error worded two different ways depending on your Windows version and where the message came from.

A service, if the word is new to you, is a program that runs in the background with no window, started by Windows rather than by you. Your printer spooler is a service. Windows Update is a service. There are around two hundred of them running right now on a healthy PC, and you never see any of them until one breaks.

What this particular service does

Every time you sign in, ProfSvc has to do four things in a few hundred milliseconds:

1. Look up your account in the registry to find where your profile folder lives.
2. Load your registry hive — a single file called NTUSER.DAT that sits in your profile folder and holds every per-user setting you have ever changed. Wallpaper, mapped drives, Explorer preferences, which apps start with you, the lot.
3. Mount that hive as HKEY_CURRENT_USER, so applications can read it.
4. Set up your folder redirections — Desktop, Documents, Pictures — and hand control to Explorer.

If any of those four fail, the service reports failure, and Windows makes a deliberate choice: refuse the sign-in rather than let you onto a half-built desktop. That choice is correct, even though it is infuriating. A partially loaded profile is how people lose data without noticing.

The two wordings, and why they matter

That second row is the one worth reading twice. The service did not respond is not the same statement as the profile is corrupt. It says the service ran out of time. On a machine with a healthy SSD that essentially never happens, so when it does, ask what is making the disk slow — and be suspicious of a mechanical drive that has started clicking or taking a long time to appear in the BIOS.

The 60-Second Checks, Before You Touch Anything

Do these first. They cost two minutes between them and they resolve a genuine minority of cases — Ethan's rough count from the shop-repair side is about one in six — without any registry work at all.

1. A real shutdown, not the fake one

This is first for a reason. By default Windows does not truly shut down when you click Shut down. It saves the kernel and driver state to a file and reloads it next time, which is why your PC boots in eight seconds. The feature is called Fast Startup, and one of its side effects is that a stuck profile state can survive a shutdown.

To force a genuine cold boot from the sign-in screen: click the power icon in the bottom-right corner, hold Shift, and click Shut down. Wait ten seconds. Power on.

Holding Shift bypasses Fast Startup and gives you a full, honest boot. If you have already tried "restarting" several times, you may genuinely not have restarted yet.

2. Wait longer than feels reasonable

Where the message mentions a timeout, occasionally the service does complete — just slowly. Sign in and then leave it alone for a full three minutes without touching the keyboard. On a machine with a failing drive this sometimes gets you in, and getting in once is enough to copy your files out before you start repairing anything.

3. Unplug everything except keyboard and mouse

External drives, card readers, phones and docking stations all get enumerated during sign-in. A USB drive that is failing, or that Windows has assigned a letter your profile expects to be free, can hang the process. Pull them all out and try once.

This also covers a specific and annoying case: if your Documents folder was ever redirected to an external drive that is not currently attached, the profile load waits for it.

4. Is there another account on this PC?

Look at the bottom-left of the sign-in screen. If a second user is listed, try it. This matters enormously, because it decides which of the two repair routes you take:

• A second administrator account signs in → your job is easy. Everything below happens from a normal desktop.
• Only one account, and it is broken → you need the offline registry edit. Not harder, but different.

If you are not sure which accounts exist, our guide to listing the user accounts on a Windows PC covers how to check — useful later, from the working account.

5. Is the disk full?

You cannot check this from the sign-in screen, but hold the thought. A completely full system drive stops profiles loading, because the service needs to write temporary files during the load. If everyone on the machine is locked out, this jumps to the top of the suspect list. We cover how to check drive space once you are back in.

6. Is it only happening after an update?

If the error appeared immediately after a Windows update or a feature upgrade, a System Restore from the recovery environment is worth trying before the registry work — it is less fiddly and it rolls the registry back wholesale. It is only available if System Protection was turned on beforehand, which on many machines it is not. Two minutes to check.

Step One: Getting Somewhere You Can Actually Work

Here is the thing almost every article about this error gets wrong.

They open with "press Win+R and type regedit". You cannot press Win+R. You are looking at a sign-in screen that will not let you past. The instruction assumes the one thing you do not have.

Route A — Safe Mode, if you have a second admin account

These steps are the same on Windows 11 and Windows 10. The menus look slightly different — Windows 11's recovery screens are flatter and use more white space — but the wording and the order are identical.

1. At the sign-in screen, click the power icon, bottom-right.
2. Hold Shift and click Restart. Keep holding Shift until the blue screen appears.
3. Choose Troubleshoot.
4. Choose Advanced options.
5. Choose Startup Settings.
6. Click Restart. The machine reboots to a numbered list.
7. Press 4 for Safe Mode, or 5 for Safe Mode with Networking. On some keyboards you need F4 / F5.

Sign in with the working account. If that account is not an administrator, the registry edit will fail later, and you will need to change that account's permissions from somewhere — a circular problem, which again pushes you towards the offline route.

Our standalone guide to booting Windows into Safe Mode covers the alternative ways in, including from inside a working session.

If you cannot even reach the sign-in screen

Force the recovery environment: power the PC on, and as soon as the manufacturer logo appears, hold the power button until it switches off. Do that three times. On the fourth boot Windows decides something is badly wrong and opens Automatic Repair, from which you can reach Advanced options and everything above.

It feels like vandalism. It is a documented, supported mechanism, and it is the only way in on many machines. Our guide to booting into Advanced Startup lists the other entry points.

On recent Windows 11 builds you may instead land in Quick Machine Recovery, which tries to repair the machine automatically before handing you the menu. Let it finish. It will not fix a ProfileList problem, but it costs you nothing and it rules other things out.

Route B — the offline registry edit, when yours is the only account

This is the route nobody documents, and it is the one most people actually need. It works because the registry is just a set of files on your disk. If you cannot start Windows to edit them from the inside, you start a different tiny Windows — the recovery environment — and edit them from the outside.

1. Reach Troubleshoot → Advanced options using either method above.
2. Choose Command Prompt. If you are asked for an account and password here, choose your account and enter its password — this prompt is checking your identity, not loading your profile, so it works even though sign-in does not.
3. Find your Windows drive. In the recovery environment it is often not C:. Type dir C:\Windows and press Enter. If you get a listing, C is right. If not, try dir D:\Windows, then E, and so on. Whatever letter shows your Windows folder is the letter you use for the rest of this section.
4. Type regedit and press Enter. Registry Editor opens, exactly as it does inside Windows.

Now you have Registry Editor — but it is showing the recovery environment's registry, not your PC's. You have to attach yours:

1. Click HKEY_LOCAL_MACHINE once so it is highlighted. This matters: the next menu item is greyed out unless HKEY_LOCAL_MACHINE or HKEY_USERS is selected.
2. File → Load Hive.
3. Navigate to C:\Windows\System32\config (using your letter from step 3) and open the file called SOFTWARE — no extension, it looks like a file with no type.
4. When asked for a key name, type OFFLINE and click OK.

Your PC's software registry is now mounted under HKEY_LOCAL_MACHINE\OFFLINE. The ProfileList key you want is at:

HKEY_LOCAL_MACHINE\OFFLINE\Microsoft\Windows NT\CurrentVersion\ProfileList

Make the changes described in the next section, then — and this part is not optional — come back here:

1. Click the OFFLINE key itself (the top of the branch you loaded).
2. File → Unload Hive. Confirm.
3. Close Registry Editor, type exit, and choose Continue to boot Windows.

What if the Command Prompt asks for a BitLocker recovery key?

Then your drive is encrypted, and you cannot go any further without the 48-digit recovery key. It is almost certainly stored in the Microsoft account that set the PC up — sign in at account.microsoft.com/devices/recoverykey on your phone. Business machines usually have it in Azure AD or on a domain controller; ask whoever manages the PCs.

This catches people out on new machines. Windows 11 24H2 turns device encryption on by default during setup, silently, on hardware that supports it. Many owners do not know their drive is encrypted until a moment exactly like this one.

Step Two: The ProfileList Repair (This Is the Real Fix)

Everything so far has been about getting to this point. Now the actual repair — and I want to explain it rather than just list it, because understanding what the .bak key is turns this from a magic incantation into an obvious three-minute job.

Finding your profile in ProfileList

Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

(If you came via the offline route, insert \OFFLINE after HKEY_LOCAL_MACHINE and drop SOFTWARE, because the SOFTWARE hive is what you mounted.)

In the left pane you will see several keys with names like this:

S-1-5-18
S-1-5-19
S-1-5-20
S-1-5-21-3623811015-3361044348-30300820-1013
S-1-5-21-3623811015-3361044348-30300820-1013.bak

Those long strings are SIDs — Security Identifiers. Windows does not really track you by your username; it tracks you by a unique number issued when the account was created. That is why renaming your account does not break anything, and it is also why a new account can never inherit the old one's permissions: a new account gets a new SID, and to Windows it is a different person entirely. Hold that thought, it becomes important later.

The three short ones at the top (S-1-5-18, -19, -20) are system accounts. Leave them alone.

Click each long S-1-5-21-... key in turn and look in the right pane for ProfileImagePath. Its value is a folder path such as C:\Users\Jake. That is how you identify which key is yours. Do not guess from the numbers.

What the .bak suffix actually means

Here is the part that makes everything else make sense.

When the User Profile Service fails to load your profile, it does not delete anything. It does something rather considerate: it renames your registry key by adding .bak on the end, sets your profile aside, and tries to build a fresh temporary one so you can at least get to a desktop.

So the .bak key is not the corruption. The .bak key is your real profile, put in a drawer for safekeeping. The fix is to take it back out of the drawer.

That reframing matters, because half the guides online tell you to "delete the .bak key", which is precisely the wrong instruction and would disconnect you from your own profile permanently.

Case 1: two keys, one with .bak and one without

The most common situation. You have both S-1-5-21-...-1013 and S-1-5-21-...-1013.bak, and both have a ProfileImagePath pointing at your folder — or the non-.bak one points at something like C:\Users\TEMP.

The plain key is the useless temporary one. The .bak key is yours.

1. Right-click the key without .bak → Delete. (If you would rather not delete anything, rename it to .old instead. Same effect, reversible.)
2. Right-click the key with .bak → Rename → remove the .bak from the end so it matches the name you just removed.
3. Now fix the two values inside it — see below.

Case 2: only a .bak key

Simpler. Nothing to delete.

1. Right-click it → Rename → remove .bak.
2. Fix the two values below.

Case 3: no .bak key anywhere

This happens, and it is where most guides abandon you. Check three things in your key, in order:

• ProfileImagePath — does it point at the right folder? If it says C:\Users\TEMP or C:\Users\Jake.PC-NAME when your files are in C:\Users\Jake, correct it by hand. Double-click, type the right path, OK.
• State — if it is anything other than 0, set it to 0.
• RefCount — if it is anything other than 0, set it to 0.

If all three are already correct, your problem is not ProfileList and you should move on to the other causes section. Do not keep editing things hopefully. That is how a fixable machine becomes an unfixable one.

RefCount and State, explained rather than recited

Every guide says "set RefCount and State to 0" and none say why. Here is why.

To change either one: double-click it in the right pane, make sure Base is set to Hexadecimal or Decimal (0 is 0 in both, so it does not matter here), type 0, click OK.

If either value does not exist: right-click in the empty part of the right pane → New → DWORD (32-bit) Value → name it exactly RefCount or State → leave the data as 0. The spelling and capitalisation matter.

Restart and test

Close Registry Editor. If you used the offline route, unload the hive first. Restart normally — not into Safe Mode — and sign in.

If it works, you will notice the first sign-in takes longer than usual, sometimes thirty seconds or more, because the service is rebuilding the parts of the profile it had given up on. That is normal. The second sign-in is instant.

Once you are in, our guide to exiting Safe Mode properly is worth a glance if the machine keeps booting back into it — that happens when a previous fix left the safe boot flag set in System Configuration.

If Registry Editor refuses to let you rename or delete

You will see Error while renaming key or Cannot delete: Error while deleting key. This is a permissions problem on the key itself, and it is common on machines that have been through a domain or a badly behaved cleanup tool.

Right-click the ProfileList key → Permissions → Advanced → change the Owner to Administrators, tick Replace owner on subcontainers and objects, apply, then give Administrators Full Control. Our dedicated walkthrough of registry permission errors goes through this screen by screen, because it is genuinely fiddly and the dialog has not been redesigned since Windows Vista.

Step Three: When the Rename Does Not Work — a New Profile

If the ProfileList repair did not take — you renamed correctly, set both values, restarted, and got the same message — the profile hive itself is damaged, not just its registry entry.

Before giving up on it entirely, one thing is worth ten minutes: run a system file check. From the recovery environment's Command Prompt, or from a working admin account:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

sfc checks Windows' own files against a known-good manifest and replaces anything that does not match. DISM repairs the manifest itself, which is why you run it second when sfc reports it could not fix everything. Our guide to repairing corrupted Windows system files explains what each is actually doing and how to read the log.

Neither will repair NTUSER.DAT — that is a user file, not a system file — but if ProfSvc itself is damaged, this is what fixes it.

Creating the new account

From a working administrator account (a second existing one, or one you create from the recovery environment):

1. Settings → Accounts → Other users → Add account.
2. Choose I don't have this person's sign-in information, then Add a user without a Microsoft account. Make it a local account for now — fewer moving parts while you are repairing. You can attach a Microsoft account afterwards.
3. Give it a simple name with no spaces or accents. Not your old name. If you reuse the old name Windows creates C:\Users\Jake.PC-NAME, which works but confuses you forever afterwards.
4. Click the new account → Change account type → Administrator.
5. Sign in to it once and let it finish setting up. Nothing exists until you do — the profile folder is built on first sign-in.

Full walkthrough with screenshots in our guide to creating a user account in Windows, and changing account permissions if the account type option is greyed out.

What to copy, and what to leave

Signed in as the new administrator, open C:\Users\OldName. Windows may warn that you do not have permission and offer to grant it — accept.

AppData is hidden by default, which is why people miss all of that. Either turn on showing hidden files, or just type the path into the File Explorer address bar — hidden folders open fine if you name them directly.

Rescuing Your Files When Nothing Will Sign In

If you take one thing from this page other than the registry fix, take this: get your data off before you try anything drastic. Not after. Before.

Every repair carries a small risk. A backup taken while things are merely broken costs you twenty minutes. A backup you wish you had taken costs you the deposit spreadsheet.

Route 1: from a second admin account (easiest)

Sign in with the working account, plug in a USB drive, open C:\Users\BrokenName, copy what you need. Accept the permission prompt when Explorer offers to grant you access.

If you get Access is denied and no offer: right-click the folder → Properties → Security → Advanced → change Owner to your account, tick Replace owner on subcontainers and objects, apply, wait, then try again. On a large profile this takes several minutes and looks like it has hung. It has not.

Route 2: from the recovery environment Command Prompt

No sign-in required at all. Plug in a USB drive before you open the Command Prompt so it gets a letter.

diskpart
list volume
exit

That prints every drive with its letter and size, so you can tell your Windows drive from your USB stick — the sizes give it away. Then, substituting your letters:

xcopy C:\Users\Jake\Documents E:\Rescue\Documents /E /H /C /I /Y
xcopy C:\Users\Jake\Desktop   E:\Rescue\Desktop   /E /H /C /I /Y
xcopy C:\Users\Jake\Pictures  E:\Rescue\Pictures  /E /H /C /I /Y

The switches, since nobody explains them: /E includes subfolders even empty ones, /H includes hidden and system files (without it you silently miss things), /C keeps going past errors instead of stopping on the first unreadable file, /I assumes the destination is a folder, /Y stops it asking about every overwrite.

/C is the important one on a failing drive. Without it, one bad file ends the whole copy.

Route 3: take the drive out

The nuclear option, and the one Jake's shop does for customers. Remove the drive, put it in a USB enclosure or dock, plug it into a working PC, and copy the files off as if it were a memory stick.

Two conditions. First, the drive must not be BitLocker encrypted, or you must have the recovery key — and as noted above, modern Windows 11 machines are encrypted by default. Second, on the working PC you will need to take ownership of the user folder before Windows lets you read it, because the permissions refer to a SID that machine has never heard of.

A basic SATA-to-USB or NVMe-to-USB enclosure costs less than a takeaway and every phone shop should own one. Jake now keeps two behind the counter, which is a genuinely good business decision for anyone who repairs computers even occasionally.

When a Profile Is Genuinely Unrecoverable

Most guides never get here, because admitting a limit does not feel like helpful writing. It is the most helpful thing on this page. Knowing when to stop saves you a weekend.

First, an important distinction that gets blurred constantly:

An unrecoverable profile almost never means unrecoverable data. The folder is still on the disk. You copy it out and carry on in a new account. What you lose is an afternoon of reconfiguring, not your business records.

Genuinely unrecoverable: the four cases

1. The disk is physically failing. If NTUSER.DAT sits on bad sectors, no rename repairs it. Symptoms: sign-in taking minutes rather than seconds, Explorer freezing, clicking or grinding noises, other files reporting read errors. Stop repairing and start copying. Every extra hour of powered-on time on a dying drive costs you files. Copy the data, replace the drive, reinstall. If the data matters more than the money, power it off and speak to a data recovery firm before you do anything else — repeated read attempts on a failing platter make professional recovery harder and more expensive.

2. BitLocker with no recovery key. If the drive is encrypted and neither you nor anyone else has the 48-digit key, the data is mathematically unreachable. Not difficult — unreachable. This is encryption working correctly. There is no tool, no service and no trick, and anything advertising one is a scam. Check account.microsoft.com/devices/recoverykey and any work or school account before you accept this, because the key is more often stored than people realise.

3. The profile folder is gone. Someone deleted C:\Users\Jake, or a cleanup tool did. The registry key can be rebuilt; the contents cannot. File recovery software on the raw disk is your only option, and it works far better if you stop writing to that disk immediately.

4. EFS-encrypted files after a new profile. This is the one that catches technical people. If you ever ticked Encrypt contents to secure data on a folder, those files are protected by a certificate stored in your old profile. A new account has a new SID and new certificates, so the files show up but will not open, permanently, unless you exported the certificate beforehand. Almost nobody did.

Things that survive the profile and things that do not

That fifth row deserves emphasis because it surprises everyone. Copying the Chrome or Edge folder into your new account brings your bookmarks but not your passwords. Windows encrypts them with keys derived from your account credentials — a feature called DPAPI — and a new account cannot decrypt them by design. If you were signed in to Chrome or Edge with sync on, they come straight back the moment you sign in again. If you were not, they are gone, and this is the moment most people finally start using a password manager. If a lost password is what brought you here in the first place, our guide to resetting a forgotten Windows password covers the account side, and it is equally frank about what cannot be done.

Other Causes, When ProfileList Is Not the Problem

The registry repair covers most cases. Here is what to check when it does not, roughly in order of how often each one turns out to be it.

The service itself is not running

Obvious once stated, easy to miss. In Safe Mode or from the working account, press Win+R, type services.msc, press Enter.

(The Run box is the small dialog that lets you launch things by name. .msc stands for Microsoft Management Console — these are the administrative panels Windows keeps out of Settings.)

Find User Profile Service. It must be Running with startup type Automatic. If it is Disabled or Manual, double-click it, set Automatic, click Start.

If it refuses to start, the underlying registry entry may be damaged. Check that HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc exists and that its Start value is 2 (which means automatic). If the whole key is missing, you are into repair-install territory.

The Default profile is damaged (everyone is locked out)

Every new profile Windows builds is stamped out of a template at C:\Users\Default. If that template is damaged or missing its NTUSER.DAT, no new profile can ever be created, so every fresh sign-in fails and even creating a new account does not help.

Check the folder exists (it is hidden) and contains NTUSER.DAT. If it does not, you can copy the Default folder from another PC running the same Windows version and build. Awkward, but it works, and it is far quicker than reinstalling.

The tell for this case: a brand-new account also fails to sign in. That single test separates "one bad profile" from "bad template" in thirty seconds, and it is worth doing early.

Security software holding the profile hive open

Some endpoint protection products scan NTUSER.DAT as it is written at sign-out, and on a slow machine that is exactly the window in which the file gets left locked or half-written. Historically this has been a real cause with several well-known suites.

Test it by doing a clean boot — starting Windows with all non-Microsoft services disabled. If sign-in works after a clean boot, something you installed is the cause, and you re-enable services in halves until you find it. Tedious, reliable, no guessing.

The service did not respond, specifically: timeouts

If your error is the timeout wording, the service is not broken — it is slow. Real causes, in order:

• A failing or nearly-full disk. The overwhelming favourite. Check free space and drive health first.
• A network profile. On a work machine with a roaming profile, the service waits for a file server. If you are off the corporate network or the VPN is down, it times out. Signing in with a local account instead usually works immediately.
• An enormous profile. A profile that has grown to tens of gigabytes — usually someone keeping years of video on the Desktop — genuinely takes longer than the service allows.

There is a registry value that raises the thirty-second limit: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout, a DWORD in milliseconds. Setting it to 60000 gives services a minute instead of thirty seconds.

Ethan's honest opinion: do this only as a diagnostic. If raising the timeout fixes sign-in, you have learned something valuable — your disk is slow enough to be a problem — and you should act on that rather than leave the timeout raised and forget. A machine that needs sixty seconds to load a profile is a machine about to need a new drive. That is also, incidentally, the single upgrade that transforms an old PC, which our guide to speeding up Windows 11 and 10 goes into properly.

System date and time wrong, on a Microsoft account

A small one that wastes a lot of time. If the CMOS battery has died and the clock has reset to 2010, authentication against a Microsoft account fails, and the resulting error is not always clear about why. Check the clock in the BIOS. A CR2032 battery costs almost nothing and takes two minutes to change.

Blue screens alongside the sign-in failures

If the machine is also crashing to a blue screen, treat that as the primary problem — a profile failure is a symptom of the same underlying fault, usually failing storage or bad memory. Our guide to blue screen errors covers reading the stop code, which tells you which of those it is.

Stopping It Happening Again

Four things, in order of how much difference they make.

1. Create a second administrator account, today

This is the highest-value thing on the page and it takes ninety seconds. A spare local admin account that you never use turns this entire crisis into a fifteen-minute inconvenience: you sign in with it, fix the registry, done. No recovery environment, no offline hives, no drive letters.

Call it something unmemorable, give it a real password, write the password down somewhere physical, and never sign in to it again. Every PC in a shop, office or household should have one.

2. Turn on System Protection

Restore points are off by default on a surprising number of machines. When they exist, a registry problem like this one is often a five-minute rollback from the recovery environment rather than a manual edit. Turn it on and give it 5–10% of the drive.

3. Stop killing the power at shutdown

The profile hive is written during sign-out. Cutting power mid-write is the most common way people cause this error themselves. If shutdown regularly takes long enough to tempt you, find out why rather than working around it — it is usually one badly behaved application refusing to close.

4. Keep your data out of the profile, or copied out of it

Anything you cannot lose should exist in two places. A cheap external drive and a scheduled copy is enough; a cloud sync folder counts too, as long as you understand it is a sync and not a backup — delete a file locally and it deletes in the cloud too.

Our walkthrough of creating a full system image is the belt-and-braces version, and worth doing once on a machine that runs a business.

One note if you are still on Windows 10

Windows 10 reached end of support on 14 October 2025. Everything on this page still works on it — the ProfileList key has not changed in fifteen years — but a machine that has started throwing profile errors on an unsupported OS is worth thinking about properly. If the cause turns out to be a failing drive, the question of whether to replace the drive or the machine is a real one, and Windows 11 eligibility is part of that maths.

Questions People Actually Ask About This Error

What does the ProfSvc service failed the sign-in error mean?

ProfSvc is the internal name of the Windows User Profile Service — the service that loads your settings, desktop and personal registry hive when you sign in. The error means it tried and could not finish, so Windows refuses the sign-in rather than give you a half-built desktop. Nearly always a damaged entry in the ProfileList registry key, not a damaged Windows installation.

What is ProfSvc in Windows 11 and Windows 10?

The service name for the User Profile Service. You see ProfSvc in error messages and User Profile Service in the Services console — same thing. It runs inside a shared svchost process, starts automatically, and loads and unloads user profiles. If it is stopped or set to Manual, nobody can sign in to that PC.

How do I fix the User Profile Service failed the sign-in error?

Boot into Safe Mode or the recovery environment, back up the registry, then in Registry Editor go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. Find the key ending in .bak that points at your user folder. Delete the matching key without .bak if one exists, rename the .bak key to drop the suffix, set RefCount and State to 0, restart.

Why does Safe Mode also fail to sign me in?

Because Safe Mode loads the same user profile. It reduces drivers and services; it does not give you a different profile. If the profile is what is broken, Safe Mode fails identically. You need a second administrator account, or the offline registry edit from the recovery environment, which needs no sign-in at all.

How do I get to Safe Mode when I cannot sign in to Windows 11?

At the sign-in screen click the power icon bottom-right, hold Shift, click Restart. Then Troubleshoot → Advanced options → Startup Settings → Restart, and press 4 for Safe Mode or 5 for Safe Mode with Networking. If you cannot reach the sign-in screen, power the machine off during boot three times in a row and Windows opens the recovery environment itself.

What is the .bak key in ProfileList and why is it there?

When the service cannot load your profile it renames your registry entry by adding .bak and builds a temporary profile in its place. The .bak key is therefore not corruption — it is your real profile set aside. Renaming it back reconnects your account to your existing files and settings. Guides that tell you to delete it have it exactly backwards.

Will I lose my files if I fix the ProfSvc error?

No. Your documents, pictures and downloads sit in C:\Users under your account name and this error does not touch them. The failure is in loading the profile, not storing it. Even if you end up creating a new account, the old folder stays on disk and you copy your files across.

What should RefCount and State be set to?

Both 0. RefCount counts how many sessions have the profile loaded, and a stale non-zero value convinces Windows it is still in use. State is a bitmask of status flags, and any non-zero value marks the profile temporary, mandatory or in error. Zero on both means idle and healthy. If either value is missing, create it as a DWORD (32-bit).

Can I fix ProfSvc without using Safe Mode?

Yes, if a second administrator account still signs in normally — then you make the registry change from an ordinary desktop. If no second account exists you cannot skip the recovery step, because the edit has to happen somewhere, and the only places available are Safe Mode with another account or an offline hive edit from the recovery environment.

How do I copy my files out of a broken user profile?

Three routes. Sign in with a second admin account and copy from C:\Users\YourName, taking ownership if access is denied. Or open Command Prompt from the recovery environment and use xcopy to a USB drive. Or remove the drive and read it in another PC via a USB enclosure — which only works if BitLocker is off or you have the recovery key. Then set up a proper backup to an external drive so it never matters again.

Why do I keep getting a temporary profile instead?

A temporary profile is what the service creates when it gives up on your real one: blank desktop, none of your files, a warning that changes will be lost. It means the .bak rename has already happened, so the registry repair above is the fix. Do not work in a temporary profile for long — everything you save there really is deleted at sign-out.

When is a Windows user profile genuinely unrecoverable?

When NTUSER.DAT is physically damaged on a failing disk, when the profile folder has been deleted, or when the drive is BitLocker encrypted and nobody has the recovery key. In the first two cases your files usually survive and only settings are lost. In the BitLocker case with no key, nothing is recoverable by any method — that is encryption working, not a limitation to route around.

Does a new profile bring my saved browser passwords across?

No, and it surprises everyone. Chrome and Edge encrypt saved passwords with Windows DPAPI keys tied to the old account. Copying the browser folder into a new account gives you bookmarks and history but not passwords. If they were synced to a Google or Microsoft account, sign in again and they return. If they were local only, they are gone.

Is the fix different on Windows 10 and Windows 11?

The registry repair is identical on both, and on Windows 8.1 and 7 too — the ProfileList key has not moved in over fifteen years. What differs is reaching Safe Mode, since Windows 11 rearranged some recovery menus, and that Windows 11 24H2 enables device encryption by default, which changes what you can do if you need to pull the drive out.

What if every account on the PC fails to sign in?

That points away from one corrupt profile and towards something system-wide. Check free space on C, a full disk stops profiles loading. Check the ProfSvc service is set to Automatic. Check C:\Users\Default still exists with an NTUSER.DAT inside, because a damaged Default profile breaks every new sign-in. Then run sfc and DISM from the recovery command prompt.

What does the service did not respond mean specifically?

That wording is a timeout, not corruption — the service had thirty seconds to report ready and did not manage it. On a healthy machine that essentially never happens, so suspect a dying drive, a security product scanning the profile hive at sign-in, or a roaming profile server that cannot be reached. Raising ServicesPipeTimeout hides the symptom; it does not fix the cause.

How Jake's Saturday Ended

Case 1. Two keys, one with .bak. The plain one pointed at C:\Users\TEMP, which told him everything. Delete, rename, both values to zero, restart. Fifteen minutes, most of it spent finding the power icon while holding Shift.

He had one account on that PC, so Safe Mode would not have helped him at all — he went in through the recovery environment and loaded the SOFTWARE hive by hand. He said afterwards it was the first time he had felt like he was actually operating the computer rather than negotiating with it.

The deposit spreadsheet was exactly where he left it. The three handwritten receipts got typed up on Sunday.

And there is now a second administrator account on that machine called svc-local, with its password on a card in the till drawer, which he has never once used and which will one day save him another Saturday.

Related Guides

Originally published February 2016. Rewritten and re-tested in 2026 on Windows 11 24H2 and Windows 10 22H2. The original version told you to fix this from Safe Mode, which does not work when yours is the only account on the PC — the offline registry edit from the recovery environment has been added, along with the BitLocker warning that now applies to most new machines.