Regedit Last
The key this user last had open in Registry Editor, plus any keys saved as favourites.
Use it to see which key a user last had open in Registry Editor, a lead to what they looked at or changed.
- NTUSER.DAT
- File and Folder Access
What It Is
Registry Editor remembers the key it had selected when it last closed, and any keys the user saved as favourites. This points to what a user last looked at in the Registry, and perhaps changed, which can lead straight to a persistence key or a security setting they tampered with. It holds only one last key. It lives in the user's own NTUSER.DAT.
What It Proves
Someone using this account ran Registry Editor and had that key selected when it last closed. It points to what they looked at, and maybe changed.
What It Does Not Prove
It suggests an edit but does not prove one, and it holds only one key. The time is roughly when Registry Editor closed, which can be long after the key was viewed.
Where It Lives
Regedit LastKey lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Registry Editor last closed on alice's own Run key, where the OneDriveUpdate value sits. That suggests someone viewed or set it, so find when odupd |
| Registry Editor last closed at about 12 Oct 2026 10:07 UTC, a minute after updsvc64 |
| alice's Registry Editor kept the Defender policy key as a favourite. Its Real-Time Protection subkey last changed 12 Oct 2026 10:04 UTC, so check event 5007 in the Microsoft-Windows-Windows Defender/Operational log. |
How to Read It
LastKey holds the full path of the key that was selected when Registry Editor last closed. The Regedit key's last write time is roughly when it closed, which can be long after the key was viewed. Find regedit.exe runs in UserAssist, BAM or Prefetch, then look for keys written around then. Saved favourites are kept in their own subkey, where each value name is the label and its data is the key path.
- When Windows Writes It
- Registry Editor writes LastKey when it closes, and the favourites when the user adds or removes one.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (applets)
Hunt It
What a user had open in Registry Editor is kept in this per-user key, so parse the hive, or read it live with Velociraptor. A process creation record dates each run of regedit.exe.
Shows what was changed with Registry Editor, but only in keys Defender records. It does not read LastKey.
// Registry writes made through Registry Editor, for the keys Defender recordsDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Regedit LastKey shows.
- UserAssistShows when Registry Editor was started from the shell, and how often.
- BAMGives the last time regedit.exe ran for this user.
- Prefetch for REGEDIT.EXENot in the RegistryDates the recent runs of Registry Editor, however it was started.
Sources
The facts on this page come from these public pages, which say more on each point.