User Assist

Key 🔑: NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Assist.

List of progs and applets that can be quicly started from the Start menu for usability, the most often used items. Shows a focus count for each entry. It means, how many time was the window switched to (that doesn’t include the time when the program is first run). Shows the last time that the program was executed, focus time, run count.

At the start of each entry between {} is the code for a location within file system. Registry Explorer will substitute these automatically, since these GUIDs are predefined.

This what a full filled User Assist key looks like. {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} is for programs that were lauched using their image files directly. {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} is for those, started with a shortcut.

The structure is quite simple:

• At 0x04 offset starts the number of executions (4 bytes).
• At 0xC offset starts the focus time (4 bytes)
• At 0x3C offset starts the Last Execution time (8 bytes), which is a Win64-bit little-endian value (for Decode 🛠).

⚠️ 🔎 I could not find this key on my Win10 VM.

⚠️ When the program was started via lnk file, the focus count will be 0.

References