Screensaver Executable

The program run as the screensaver, which fires after the idle timeout.

Use it to check that the screensaver is a real .scr, not a program set to run each time the machine sits idle.

NTUSER.DAT
Persistence

What It Is

A screen saver is a program with a .scr extension that Windows starts after the mouse and keyboard have been idle for a set time. It protects the screen or hides its contents. The SCRNSAVE.EXE value under Control Panel\Desktop in the user's hive names that program, ScreenSaveActive says whether a screen saver is selected, and ScreenSaveTimeOut sets the idle wait in seconds. These values are set from the Screen Saver settings and can be overridden by Group Policy.

What It Proves

The SCRNSAVE.EXE value, with ScreenSaveActive set to 1, names the program Windows runs when the machine is idle for the timeout. Pointing it at an executable gives timed execution.

What It Does Not Prove

It fires only after the idle timeout and only while the screensaver is active, so it is slow and conditional. A genuine .scr is normal, but an .exe or an odd path is the signal.

Where It Lives

Screensaver Executable lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Control Panel\Desktop

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Screensaver Executable, each with what it tells you
Registry Value	What It Tells You
`SCRNSAVE.EXE` `REG_SZC:\Windows\System32\scrnsave.scr`	The screensaver is the built-in blank scrnsave.scr in System32, a normal setting. An .exe here, or a .scr outside System32, is the flag.
`ScreenSaveActive` `REG_SZ1`	The screensaver is enabled, so the named program runs after the idle timeout. Enabled with a System32 .scr is the expected pairing.
`ScreenSaveTimeOut` `REG_SZ900`	It fires after 900 seconds idle, a routine timeout. The program it runs, not the timeout, decides whether this one matters.

How to Read It

Read SCRNSAVE.EXE, ScreenSaveActive and ScreenSaveTimeOut under Control Panel Desktop. ScreenSaveActive 1 with a timeout means the named program runs when idle. A SCRNSAVE.EXE outside System32, or a non .scr file, is the red flag.

When Windows Writes It: When the screensaver program or its settings are changed.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows the setting, not that it ran. An executable rather than a .scr is the thing to flag.

KQLDefender XDR, Advanced hunting

// The screensaver program being setDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryValueName =~ "SCRNSAVE.EXE"| project Timestamp, ActionType, RegistryKey, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Screensaver Executable shows.

AmcacheGives the SHA-1 of the program set as the screensaver.
Screensaver Process Starts, Security Event 4688Not in the RegistryShows the program running when the machine went idle.

Sources

The facts on this page come from these public pages, which say more on each point.