ConsentStore (Camera, Microphone and Location)

Apps that used the camera, microphone or location, with the times of their last use.

Use it to find which programs used the camera, microphone or location, and when each last started and stopped.

NTUSER.DAT
Program Execution

What It Is

Windows keeps a per-app record, the ConsentStore, of which programs have used the camera, the microphone or the device's location, with the time each last started and stopped. It shows whether a program used one of these. That is a strong signal when the program has no reason to, such as a remote access tool that turned on the camera. Desktop programs are listed by full path under NonPackaged. It lives in the user's own NTUSER.DAT.

What It Proves

That app used the capability, last from LastUsedTimeStart to LastUsedTimeStop, in UTC. Desktop programs are listed by full path under NonPackaged, so a remote access tool that used the camera shows up.

What It Does Not Prove

Only the last use per app is kept. A stop time of 0 means the app was still using it when the hive was last written.

Where It Lives

ConsentStore (Camera, Microphone and Location) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\<capability>\<app>

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in ConsentStore (Camera, Microphone and Location), each with what it tells you
Registry Value	What It Tells You
`webcam\NonPackaged\C:#Users#alice#AppData#Roaming#odupd.exe` `SubkeyLast write 13 Oct 2026 21:04 UTC`	odupd.exe, the file in alice's Run key, used the webcam, and its subkey last changed 13 Oct 2026 21:04 UTC. OneDrive needs no camera, so check SRUM for its bytes sent.
`LastUsedTimeStart` `REG_QWORD0x01dd5b5491a6ef80`	odupd.exe last turned the camera on at 13 Oct 2026 20:51 UTC. Check whether alice was at the laptop then, from her logons and activity.
`LastUsedTimeStop` `REG_QWORD0x01dd5b5669b88b80`	It released the camera at 13 Oct 2026 21:04 UTC, after 13 minutes. Look for uploads by odupd.exe in that window, in SRUM or network logs.
`microphone\MSTeams_8wekyb3d8bbwe\Value` `REG_SZAllow`	Teams is allowed the microphone, as a meeting app should be. Its own subkey keeps last use times, so compare them with odupd.exe to tell normal use apart.

How to Read It

Open the webcam, microphone or location subkey, where Store apps are subkeys by package name and desktop programs sit under NonPackaged. NonPackaged subkey names are full paths with # in place of each backslash, such as C:#Program Files#Zoom#bin#Zoom.exe. LastUsedTimeStart and LastUsedTimeStop are FILETIMEs in UTC, and the gap between them is how long the capability was in use. The SOFTWARE hive has the same layout and can hold entries the user hive lacks, so check both.

When Windows Writes It: Each time an app starts or stops using the camera, microphone or location.
Which Windows Versions: Windows 10 1903 to Windows 11
Tools That Parse It: Registry Explorer, RECmd

Hunt It

Which app used the camera, microphone or location sits in this per-user key, not in an event, so parse the hive, or read it live with Velociraptor. SRUM can corroborate a suspect program's network use.

Sees Related ActivityDeviceProcessEvents

Defender does not record camera or microphone use. Starts of the same program give run times to set beside LastUsedTimeStart.

KQLDefender XDR, Advanced hunting

// When did the program that used the camera run? Its NonPackaged path, decodedDeviceProcessEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where FileName =~ "odupd.exe" and FolderPath startswith @"C:\Users\alice\AppData\Roaming"| project Timestamp, AccountName, FolderPath, ProcessCommandLine, SHA1

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what ConsentStore (Camera, Microphone and Location) shows.

Run and RunOnce KeysShows whether the program that used the camera also starts at every logon.
BAMConfirms the program ran in that user's session, with its last run time.
SRUM Application UsageNot in the RegistryShows how many bytes the program sent, to see whether what it captured left.

Sources

The facts on this page come from these public pages, which say more on each point.