BAM (Background Activity Moderator)

Full path and last run time of programs, per user SID, on Windows 10 1709 and later.

Use it to show when each program last ran in each user's session, with its full path.

SYSTEM
Program Execution

What It Is

BAM, the Background Activity Moderator, is a Windows component whose key sits among the services in the SYSTEM hive. It keeps, for each user, a value for each program that ran in their session, with the last time each one ran. Each user has a subkey named by their security identifier (SID), the number Windows uses for an account. An investigator reads it for a full program path and a last run time tied to one user.

What It Proves

A program at that path ran in the session of the user whose SID holds the value. The time stored in the data is the last time it ran, in UTC.

What It Does Not Prove

Only the last run is kept, and entries drop off after about a week. Programs run from removable media or network shares may not appear, and the times can be a few minutes out.

Where It Lives

BAM (Background Activity Moderator) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Services\bam\State\UserSettings\<SID>

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in BAM (Background Activity Moderator), each with what it tells you
Registry Value	What It Tells You
`\Device\HarddiskVolume3\Users\alice\Downloads\psexec.exe` `REG_BINARY80 28 B7 31 30 5A DD 01 00 00 ...`	psexec.exe in alice's Downloads last ran in her session at 12 Oct 2026 09:58 UTC. That proves it ran, which ShimCache and Amcache alone cannot.
`\Device\HarddiskVolume3\Windows\System32\mstsc.exe` `REG_BINARY00 54 92 AF 29 5C DD 01 00 00 ...`	The Remote Desktop client last ran in alice's session at 14 Oct 2026 22:16 UTC. Terminal Server Client and RunMRU show which host she connected to.
`\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` `REG_BINARY80 FE 6F 2C 27 5C DD 01 00 00 ...`	PowerShell last ran in alice's session at 14 Oct 2026 21:58 UTC, 18 minutes before her RDP session. BAM keeps only the last run, so event 4688 in the Security log can show each one, where Audit Process Creation is on.

How to Read It

Open the subkey for each user SID, then turn the SID into a user name with ProfileList. Each value name is a device path, such as \Device\HarddiskVolume3\Windows\System32\cmd.exe, where HarddiskVolume3 is the volume Windows mounts as a drive letter. The first eight bytes of the data are the last run time as a UTC FILETIME.

When Windows Writes It: Windows writes it each time a program runs in a user session, and removes older entries.
Which Windows Versions: Windows 10 1709 to Windows 11 keep it. Before Windows 10 1809 the path has no State key.
Tools That Parse It: Registry Explorer, RECmd, RegRipper (bam)

Hunt It

BAM is a Registry value, so the live tools that do not read the Registry show the same runs from process creation records instead, which hold every run with its account. Velociraptor reads the key itself on each endpoint, and maps each SID to a user name.

Sees Related ActivityDeviceProcessEvents

Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. It records every start with the account and full path, so it covers what BAM shows and more, though it does not read the BAM key.

KQLDefender XDR, Advanced hunting

// Last start of each program per account: the fact BAM keepsDeviceProcessEvents| where Timestamp > ago(7d)| where DeviceName startswith "ws-042"| summarize LastRun = max(Timestamp), Runs = count() by AccountName, FileName, FolderPath| order by LastRun desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what BAM (Background Activity Moderator) shows.

UserAssistIt keeps this user's shell launches with a count, long after BAM drops the entry.
Prefetch FilesNot in the RegistryThey record runs BAM may miss, such as from a USB stick, and keep them for longer than a week.
Process Creation, Security Event 4688Not in the RegistryIt shows each run, where BAM keeps only the last one. Windows writes it to the Security log only when Audit Process Creation is on.

Sources

The facts on this page come from these public pages, which say more on each point.