Program Compatibility Assistant Store

Full paths of programs this user ran that the Program Compatibility Assistant noted.

Use it to prove a user ran a program from a given path, even from a USB stick that has long been removed.

NTUSER.DAT
Program Execution

What It Is

The Program Compatibility Assistant is the Windows service that watches for programs with compatibility problems. As it works it records the full path of programs a user ran, which for an investigator proves a program ran from that path, even from a USB stick that has since gone. From Windows 11 22H2 it also keeps text logs that hold run times. The key lives in the user's own NTUSER.DAT.

What It Proves

A program at that path ran in this user's session and Windows tracked it for compatibility. The entry stays after the file is deleted or the USB stick is gone.

What It Does Not Prove

The key's last write time dates only the newest change. RegRipper reads a FILETIME at offset 0x2C of each value, but what it marks is undocumented. Not every program is tracked, and Windows 11 22H2 and later also keep text logs in C:\Windows\appcompat\pca, which hold run times.

Where It Lives

Program Compatibility Assistant Store lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Program Compatibility Assistant Store, each with what it tells you
Registry Value	What It Tells You
`C:\Users\alice\Downloads\psexec.exe` `REG_BINARY53 41 43 50 01 00 00 00 ...`	PsExec from alice's Downloads ran in her session, and this record outlives the file. BAM dates its last run to 12 Oct 2026 09:58 UTC.
`E:\tools\procdump64.exe` `REG_BINARY53 41 43 50 01 00 00 00 ...`	procdump64.exe ran from the USB stick that was drive E in alice's session, and the record outlives the stick. Check EDR for memory access to lsass.exe by it, a sign of credential theft.
`Store` `SubkeyLast write 15 Oct 2026 16:50 UTC`	The list last changed at 15 Oct 2026 16:50 UTC, when ProcDump likely first ran. That points at procdump64.exe, but the time cannot name the entry.

How to Read It

Each value name is the full path of a program the user ran. The binary data is undocumented, so test what RegRipper's FILETIME from offset 0x2C marks before you rely on it. Look for paths in Downloads, Temp and removable drives, and for tools such as PsExec. On Windows 11 22H2 and later, read the text logs in C:\Windows\appcompat\pca for run times.

When Windows Writes It: When the Program Compatibility Assistant service records a program the user starts.
Which Windows Versions: Windows 8 to 11 keep it, while Windows 7 used a Persisted key. The text logs appear from Windows 11 22H2.
Tools That Parse It: Registry Explorer, RECmd, RegRipper (appcompatflags)

Hunt It

What the assistant recorded sits in this key, not in an event, so parse the hive, or read it live with Velociraptor, and read the text logs for times. Process creation records show a path really running.

Sees Related ActivityDeviceProcessEvents

Gives run times you can rely on, inside retention. Defender does not read the key.

KQLDefender XDR, Advanced hunting

// Did a program from the PCA store run, and when? PsExec from Downloads, for exampleDeviceProcessEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where FileName =~ "psexec.exe" and FolderPath startswith @"C:\Users\alice\Downloads"| project Timestamp, AccountName, ProcessCommandLine, SHA1

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Program Compatibility Assistant Store shows.

BAMGives the last run time, and the user, for the same program path.
AmcacheGives the program's SHA-1, to check it after the file or the stick has gone.
PcaAppLaunchDic.txt in C:\Windows\appcompat\pcaNot in the RegistryHolds run times for the programs the assistant tracked, on Windows 11 22H2 and later.

Sources

The facts on this page come from these public pages, which say more on each point.