Where Does Windows Track Program Runs?
Windows logs every GUI program launch in UserAssist registry keys, ROT13 encoded and readable with UserAssistView.
Last updated
Windows counts each graphical program launch in UserAssist registry keys, storing run counts and last execution times. The names hide behind ROT13 encoding, which stops casual browsing but not tools.
UserAssistView decodes the whole set into a readable table. Clearing the keys resets the counters, useful for privacy and for testing first run behavior of installers.
Where Windows stores this, by platform
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
GUID subkeys with Count values per program, ROT13 encoded. Delete subkeys to reset counters. UserAssistView reads and clears them without regedit.
Frequently asked questions
how do i clear program run history in windows
Delete the UserAssist subkeys in the registry with Explorer restarted, or clear them from inside UserAssistView. Counts rebuild from zero on next launches.
why are userassist names garbled
Microsoft ROT13 encodes them, a trivial obfuscation. Tools decode automatically; in regedit you can spot programs by length and timestamps.
Notice an outdated path? Let us know.