Where are the Windows configuration and log files?
In most cases, there is no need to open the Tailscale configuration or log files, but in the event that is required, the Windows client uses data in 3 locations:
- User account AppData
- System account AppData
- Local system registry
User Account AppData
The user account AppData directory is typically located in C:\Users\(your username)\AppData\Local\Tailscale
. Normally, the AppData directory is hidden in Windows Explorer, so it may be difficult to find. One way is to hold the Windows logo key and press “R”. Type in %LOCALAPPDATA%\Tailscale
and click OK.


In this directory, there are several files and one directory:
prefs.conf
contains the settings for this computer. Do not copy this file between computers as it contains the private keys identifying this computer to others on the Tailscale network.tailscale-ipn.log.conf
contains the identifiers used by our log collection server to recognize your computer when it uploads its logs.tailscale-ipn.log1.txt
andtailscale-ipn.log2.txt
contain temporary log messages that are not yet uploaded or saved elsewhere and thus are usually empty.
System Service ProgramData
The Tailscale service data directory is typically located in C:\ProgramData\Tailscale
. Occasionally, the ProgramData
directory will be in a different location; if it is not in C:\ProgramData
, look for the %ProgramData%
environment
variable.
Normally, you will not have access to the Tailscale
directory under ProgramData
because it contains private keys. If
you need to access these files you will first have to grant yourself permission (which is only possible if you have an
administrator account). If you navigate to the directory in Windows Explorer, it will present a prompt that will grant
you permission. Or, if you wish to inspect the contents without granting yourself permission, you can access it using
PowerShell as an Administrator:
- Right click on the start menu and choose Windows PowerShell (Admin)
- Click Yes to confirm running as administrator
- Type
cd $Env:ProgramData\Tailscale
- Type
dir
In this directory, there are several files and one directory:
server-state.conf
contains the settings for the “Unattended mode” feature and the key that identifies this computer to the login server.tailscale-ipn.log.conf
contains the identifiers used by our log collection server to recognize your computer when it uploads its logs.tailscale-ipn.log1.txt
andtailscale-ipn.log2.txt
contain temporary log messages that are not yet uploaded or saved elsewhere and thus are usually empty.- The
Logs
directory contains the logs from the Windows Service process.
Local system registry
Registry values are kept in HKEY_LOCAL_MACHINE\Software\Tailscale IPN

By default there are 3 values:
- The (Default) value contains the install location of the Tailscale client
- The SearchList value contains the DNS search list when logged into a domain using the Tailscale DNS feature.
- The seed value is not currently used.
Optionally, several values can be created, all of which are String type:
- The
LoginURL
value contains the URL of the login server. The default value ishttps://login.tailscale.com
. - The
LogTarget
value contains the URL of the log server. The default value ishttps://log.tailscale.io
.
Preference policies can be set to always
, never
and user-decides
. If set to always
or never
, the options are
set by the administrator and not visible in the system tray menu. If unset or set to user-decides
then the option is
visible in the system tray menu.
AllowIncomingConnections
controls the Allow Incoming Connections menu optionUnattendedMode
controls the Unattended Mode menu option
Visibility policies can be set to “hide” or “show”. If set to “hide” then the menu item is not visible. If set to “show” or unset, then the menu item is visible.
AdminConsole
controls the Admin Console menu itemNetworkDevices
controls the Network Devices submenuTestMenu
controls if the test/debug menu items are visible when opening the tray menu while holding shift or ctrl.UpdateMenu
controls the Update Tailscale menu item
Duration policies control a duration or timeout. The time can be set using units of hours and minutes. Examples:
168h
: 1 week24h
: 1 day1h5m
: 1 hour, 5 minutes30m
: half hour- Smaller time units are available but unlikely to be useful. Non-negative values accepted by the Go time.ParseDuration function are supported.
Current duration policies:
KeyExpirationNotice
controls how long before key expiry a notice should be displayed. The default is 24 hours.