Feature
How often this user switched to, launched or right-clicked each program on the taskbar.
Use it to show how often a user switched to or launched each windowed program, even after it was uninstalled.
- NTUSER.DAT
- Program Execution
What It Is
FeatureUsage is a set of counters Explorer keeps for each user of how they use the taskbar, such as how often they switched to a program, launched a pinned one or opened its Jump List. The counts show which programs a user really used, and they stay even after a program is uninstalled. The counters carry no times beyond a rough first-logon marker. It lives in the user's own NTUSER.DAT.
What It Proves
The user ran that windowed program and switched to it that many times, in AppSwitched, or launched it from a pinned taskbar icon, in AppLaunch. The counts stay after the program is uninstalled.
What It Does Not Prove
The counts carry no times. The one time value, KeyCreationTime, marks roughly the first interactive logon. Command line tools and programs that never show a window do not appear.
Where It Lives
FeatureUsage (Taskbar Use) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| alice brought WinSCP, run from the USB stick, to the front 9 times. FeatureUsage keeps no times, so UserAssist dates its start, 15 Oct 2026 16:47 UTC. |
| alice switched to PowerShell 6 times, and the GUID stands for System32. No commands are kept here, so her PSReadLine history file may hold them. |
| alice started File Explorer 42 times from its pinned icon, which is ordinary. Counts like this are the baseline that odd programs stand out from. |
| alice opened the Remote Desktop Jump List 3 times, which lists recent connections. Saved connections may have been used, so check Terminal Server Client. |
How to Read It
AppSwitched counts switches to a program from the taskbar, and AppLaunch counts starts from pinned icons. ShowJumpView counts right-clicks that opened a Jump List, and TrayButtonClicked counts clicks on Start, search and the clock. Value names are paths or app IDs, and a folder GUID stands in for a path such as Program Files, as in UserAssist.
- When Windows Writes It
- As the user switches programs on the taskbar, starts pinned programs and opens Jump Lists.
- Which Windows Versions
- Windows 10 1903 to Windows 11
- Tools That Parse It
- Registry Explorer, RECmd
Hunt It
These per-user counts are not written to any event log, so parse the hive, or read it live with Velociraptor. Process creation records show the same programs running, with times this key does not keep.
FeatureUsage has counts but no times. Process starts give the times, inside retention.
// When did a program from FeatureUsage run? WinSCP, for exampleDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what FeatureUsage (Taskbar Use) shows.
- UserAssistGives a last run time for the same shell launches, which these counts lack.
- Jump ListsNot in the RegistryLists what each program opened recently, with the times these counts lack.
- Prefetch FilesNot in the RegistryDates when each program ran, which these counts do not.
Sources
The facts on this page come from these public pages, which say more on each point.