UserAssist

Location & availability

NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Record layouts differ across Windows versions. Encoded names need decoding by a supported parser.

Fields to examine

• Decoded application identifier or path.
• Last-run information and counters available in that format.
• The user profile and registry source containing the entry.

What it can establish

• Support shell-associated application activity in a particular profile.

What it cannot prove

• Cover every service, script, scheduled task or command-line launch.
• Translate focus time or a counter directly into a cheating session duration.

Use it in a screenshare

1. Identify the actual profile shown in the screenshare and preserve its NTUSER.DAT hive.
2. Parse the UserAssist values rather than treating encoded names as suspicious strings. Retain the timestamp format and tool version.
3. Match the decoded path with file identity and corroborate the relevant run time using an independent execution source.

Worked example

A GUI utility appears in UserAssist and Prefetch around the same period. Together they support a shell-associated launch. A missing command-line helper in UserAssist does not contradict a process event showing that helper ran.

Cross-check the finding

• Prefetch →Support execution of an associated executable within the retained history.
• BAM →Support recent executable activity associated with a Windows user SID.
• Security event 4688 →Support process creation recorded by the audited host.

Sources

• UserAssist — parser implementation ↗