What is the SSDPSRV folder in C:/users?

Don't panic, Osito—your computer has definitely not been hacked. That mysterious SSDPSRV folder is completely safe and was actually created natively by Windows itself.

You are running a Windows 11 Insider Preview build (rs_prerelease). In these experimental testing environments, Microsoft frequently provisions specialized, isolated background system profiles to test out automated service frameworks. The letters SSDPSRV stand directly for Simple Service Discovery Protocol Service. This is the core background engine Windows uses to scan your local network for plug-and-play smart devices like network printers, media servers, and digital casting screens.

Because Microsoft is currently testing a more secure, sandboxed isolation model for network discovery in your specific build, it automatically generated this virtual "barren user account" profile to run the service with minimal system privileges. Those bizarre 2016 timestamps you see are just the default placeholder hardcoded creation dates inside Windows' master base-image file template (NTUSER.DAT). It's completely normal, it's not hoarding your data, and your system is perfectly secure!

Hello Osito,

I have the same Folder under users. It is completely empty and suggest leaving it intact as it may be by design for some future plan that MS has. These are experimental builds so nothing to worry about.

Regards,

Johnny

Hello OSITO AVALOS,

Thanks for reaching out. SSDPSRV is a genuine Windows component, not something a malicious actor would name a folder after. It's the SSDP Discovery service, which handles finding UPnP devices on your network like printers, media servers, and casting screens, and it runs under a built-in local service account rather than a real person. Old 2016-era timestamps are also usually just inherited from the default profile template Windows copies from, so they don't reflect your PC's actual age.

I'd gently hold off on calling it "definitely safe" with full certainty though, mainly because you're on a prerelease Insider build where unusual artifacts can show up, and a service profile appearing as a visible folder under C:\Users isn't something that's clearly documented either way. So rather than guess, it's worth confirming a couple of things:

• What's inside it — just empty profile scaffolding (Desktop, Documents, AppData), or actual files/executables?
• Does it show as a matching account under Settings > Accounts, or in lusrmgr.msc / netplwiz?
• Have you run a full Microsoft Defender scan (including an offline scan), and did it flag anything?

If the scan comes back clean and it's just empty profile structure, then this is very likely benign and nothing to worry about. If you're seeing unexpected files in there, that'd be the part worth digging into before drawing any conclusion.