User
Programs a user started from the desktop, Start menu or Explorer, with run counts.
Use it to show which programs a user started from the desktop or Explorer, how many times, and when they last did.
- NTUSER.DAT
- Program Execution
What It Is
UserAssist is a set of values Windows keeps for each user to count the programs they start through the desktop, the Start menu or File Explorer. Windows Explorer uses these counts for the list of frequently used programs in the Start menu. Its counts answer a plain question, whether this person ran this program from the screen in front of them, how often, and when last. It lives in that user's own hive, NTUSER.DAT, so what it shows belongs to one user, not to the whole machine.
What It Proves
It shows that this user started the program through the Windows shell, how many times they started it, and the date and time they last did, in UTC. Because the count sits in the user's own hive, it ties the activity to that user.
What It Does Not Prove
It counts only programs started through the shell, so anything run from a command line, a script or a service does not appear. It keeps a run count and the last run time, not a list of every run, and a major Windows feature update can reset the counts. The value names are stored with their letters rotated by thirteen places (ROT13), so they have to be decoded before they read as paths.
Where It Lives
UserAssist lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you. UserAssist stores each name in ROT13, which swaps every letter for the one 13 places along the alphabet, so pzq.rkr is cmd.exe once decoded.
| Registry Value | What It Tells You |
|---|---|
| alice opened cmd |
| alice started psexec |
| alice started WinSCP from the USB stick that was drive E once, at 15 Oct 2026 16:47 UTC. A file transfer tool run from removable media is worth following, so work out what it sent and where. |
How to Read It
The key has one subkey per type of item, named by a GUID. The GUID {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} holds programs, and {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} holds shortcuts. Inside each, every value name is a path with its letters rotated by thirteen places, so decode it with ROT13 first. Some folders in the path appear as a GUID of their own, a Known Folder ID, so {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7} stands for System32. The value data is a fixed block of bytes. The run count is a four-byte number at offset 4, and the last run time is an eight-byte UTC FILETIME (a Windows timestamp) at offset 60. The block also holds a focus count and a focus time, but no public source documents exactly what those two measure, so treat them as a rough guide only.
- When Windows Writes It
- Windows writes it each time the user starts a program through the shell.
- Which Windows Versions
- Windows 7 to 11 use this layout. Windows XP and Vista use an older layout of the value data.
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (userassist)
Hunt It
UserAssist is a Registry value, so most live tools do not read it. What they show instead is the matching activity, each shell launch as it happened, in process creation records. Velociraptor reads and decodes the key itself on each endpoint, and a collected hive gives the counts too.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint. It records each shell launch, not the UserAssist counts, so the counts and focus time stay in the hive.
// Programs Explorer started: the launches UserAssist countsDeviceProcessEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what UserAssist shows.
- BAMShows the program ran and when, which UserAssist cannot for programs started outside Explorer.
- Prefetch FilesNot in the RegistryThey confirm the program ran, however it was started, and keep its last run times.
- Process Creation, Security Event 4688Not in the RegistryIt records every start with its account, where UserAssist keeps only a count and the last run. Windows writes it to the Security log only when Audit Process Creation is on.
Sources
The facts on this page come from these public pages, which say more on each point.