Where Is the Windows UserAssist Registry Key?
Windows UserAssist key under Explorer with ROT13 program execution history.
Last updated
Windows tracks GUI program launches in UserAssist keys, storing run counts, last-run timestamps and focus time per executable. Names encode in ROT13, which fools nobody but slows skimmers.
Forensics timelines lean on it for user-executed programs specifically. Parse the offline hive since live values stay locked and numerous.
Where Windows stores this, by platform
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Per-GUID subkeys hold Count values with ROT13-encoded program names, run counts and timestamps. Export the hive offline for parsing; viewers decode ROT13 automatically. Clearing it wipes the evidence trail, which investigators notice.
Frequently asked questions
Why are UserAssist names gibberish?
They encode in ROT13 by legacy design. Forensics tools decode them automatically into real paths.
What does UserAssist prove?
That a user launched a GUI program, how often, and when last. Console-only executions never appear here.
Notice an outdated path? Let us know.