Windows Application Log · Event 1511
Event 1511: You have been signed in with a temporary profile
Windows could not load your normal profile, so it made a throwaway one instead. Everything looks reset — your desktop, your documents, your settings — but nothing has been deleted. The real profile is still on disk and the temporary one is discarded when you sign out.
Also written as Event ID 1511 user profilelogged on with a temporary profiletemp profile event log
- How oftenUncommon
- Vendor calls itWarning
- LogApplication
- SourceMicrosoft-Windows-User Profiles Service
What it means for you
On a personal computer
Your files are not gone. Windows could not open your profile and gave you a blank one for this session. Do not save anything important until it is fixed, sign out, and restart the machine — a temporary profile very often clears on its own after a reboot.
For an analyst
The cause is almost always in the registry rather than on disk: the ProfileList entry for the SID has a .bak suffix, or a RefCount and State that never got cleared. Check HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList before touching the profile folder. On session hosts, a run of these usually traces back to forced hive unloads recorded as Event 1530.
The fields that decide it
Everything else in the log line is context.
- User SID
- Whose profile failed to load. This is the key you look up under ProfileList in the registry — the profile problem lives there far more often than in the folder.
- Error code
- Why the load failed. The value is a Windows error number and it narrows the cause considerably.
-
0x0000006F or ERROR_ALREADY_EXISTSA previous session's profile was never released. Common after Event 1530 forced unloads. -
The system cannot find the file specifiedThe ProfileImagePath in the registry points somewhere that no longer exists. -
Access is deniedPermissions on the profile folder or the registry hive are wrong, often after a restore from backup. - Profile path
- Where Windows expected to find the profile. Compare it with what is actually on disk under C:\Users.
- Detail
- The free-text reason. 'The process cannot access the file because it is being used by another process' points at a hive still loaded from a prior session.
Common questions
Are my files deleted if I get a temporary profile?
No. Your real profile folder is still under C:\Users and untouched. Windows simply could not open it and created a blank one for this session. The important thing is not to save new work while signed in temporarily, because the temporary profile is deleted at sign-out.
How do I fix being logged on with a temporary profile?
Restart first — a large share of cases are a profile that was still loaded from a previous session, and a reboot clears it. If it persists, look in the registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList for the user's SID. An entry ending in .bak means Windows renamed the good profile and made a new one; renaming it back, after backing up, is the standard fix.
Why does the same user keep getting a temporary profile?
Because the underlying profile is never being released cleanly. Look for Event 1530 at that user's sign-out, which names the process holding registry keys open. Until that process is fixed or updated, each sign-out risks leaving the profile in a state Windows will not load.
What is the difference between Event 1511 and Event 1515?
1511 means Windows could not find or load the profile and fell back to a temporary one for this session. 1515 means Windows has restored a previously backed-up profile because the last logoff did not complete properly. Both point at the same underlying problem — a profile that is not being unloaded cleanly — but 1515 is Windows recovering while 1511 is Windows giving up.
Read next
- Usually comes before Event 1530: Registry unloaded while a program was still using it Forced registry unloads at sign-out, the most common route to a profile that will not load next time.
- Read alongside Event 4624: An account was successfully logged on The successful logon in the Security log — the user did sign in, which is why this is a profile fault rather than an authentication one.
- Related Event 7011: A service stopped responding to Windows A service timeout, which on a slow machine can also delay profile loading past its limit.
- Related Event 1000: An application crashed Application crashes, which are common in a temporary profile because programs find none of their settings.
Vendor documentation
Last reviewed 6 September 2026