I was searching for some info on sdhl.dat and found this:
Was searching for infos on (sdhl.dat) and found this


I have a .dat file on my PC and every time I try to delete it, it comes back after restarting the PC. After some search I found this "anonymous registration". Should I be worried about it? Can this be a virus? I have already checked it on VirusTotal and Malwarebytes and it was safe but I still have my concerns over this .dat file. The only thing I found was that the game Valorant creates some .dat files on some users.

1 Answer 1


NT AUTHORITY\ANONYMOUS LOGON is a special pseudo user account in Windows. It is defined by Microsoft as a "special identity":

Anonymous Logon

Any user who accesses the system through an anonymous logon has the Anonymous Logon identity. This identity allows anonymous access to resources, such as a web page that is published on corporate servers. The Anonymous Logon group is not a member of the Everyone group by default.

This allows access to the file by any network or web user that has the permission to use the computer or web-app without specifying a password. It's most commonly found in web-apps, if you're using your computer as web-server via IIS.

In short, this is a harmless file permission, that commonly would never have any effect (unless the file is part of a web-app or is shared over a network in which anonymous access is allowed).

  • Thank u alot for helping !!! just another question if u have time. i got this sdhl.dat file and i dont know what it is or from where it comes is there a way to check it ?
    – Daniel
    Aug 8 at 11:06
  • There is no reference to such a file on the internet and it doesn't exist on my computer. Perhaps the folder in which it's found would give an indication of the process that created it.
    – harrymc
    Aug 8 at 11:09
  • the thing is it doesnt go to a folder it gets "created" on the desktop
    – Daniel
    Aug 8 at 11:19
  • 1
    You could delete the file and use Process Monitor to find out which process is creating it. If this is happening during boot, you need boot logging - see this answer.
    – harrymc
    Aug 8 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.