userassist registry key proves what a user launched

your computer remembers every icon you ever double-clicked

you know that feeling when you double click a program and it just... opens, no drama, no record, right? wrong. windows has been quietly keeping a diary of every gui program you've launched since xp, and it's sitting in your registry right now with a timestamp and a run counter attached. it's called userassist and it's one of the first places any forensic investigator looks when they need to prove what a person actually did on a machine.

what userassist actually is

userassist is a registry key that tracks programs launched through the windows shell, meaning explorer, the start menu, desktop shortcuts, anything you clicked with a mouse. it does not track stuff launched from the command line or scripts, which is exactly why it's so valuable. if something shows up here, it means a human sat at the keyboard and clicked it.

for each entry windows stores the run count, the last executed time, and sometimes focus time. it's basically a highlight reel of "things this user opened on purpose."

the command and what it's pulling

reg query "HKCU\...\Explorer\UserAssist\{CEBFF5CD-...}\Count"

breaking this down piece by piece:

HKCU means this lives under the currently logged in user's hive, so every user profile on a machine has its own separate userassist history. no shared logs, no mixing users together.

Explorer\UserAssist is the branch microsoft built specifically for this feature. under it you'll find a couple of GUID subkeys, each one representing a different category of tracked activity, like shell items versus shortcuts.

{CEBFF5CD-...} is one of those GUIDs. this specific one is famous in dfir circles because it's the bucket that catches most straightforward exe launches.

\Count is the actual subkey holding the value names and their binary data. the value name is the encoded program path, and the binary data holds the run count and last run timestamp packed together.

the rot13 "protection" that protects nothing

microsoft encoded the value names using rot13, which just rotates every letter 13 places in the alphabet. so a path like C:\Users\Name\Downloads\tool.exe shows up looking scrambled and vaguely alien. this was never meant to be real security, it was a lazy attempt to stop average users from casually skimming their own usage history in regedit.

rot13 is symmetric, meaning you apply the same operation to decode it that was used to encode it. there's no key, no secret, nothing to crack. any decent forensic tool decodes it automatically, and you can even do it by hand with a piece of paper and the alphabet if you're bored enough. the "obfuscation" buys zero seconds against anyone who knows what they're looking at.

why this matters for defenders

this is where the mindset flips from "cool trivia" to "actually useful." if you're investigating your own machine after suspicious activity, or auditing what ran on a shared family computer, or doing incident response on a system you're responsible for, userassist tells you what was clicked, how many times, and when, tied to a specific user profile. it's some of the strongest evidence available that a specific interactive action happened, as opposed to a scheduled task or script running quietly in the background.

attackers know this too. some try to clear userassist entries or disable the tracking to cover their tracks. if you ever find this key missing entries you'd expect, or the whole branch looks freshly wiped, that gap is itself a signal worth investigating.

the takeaway

userassist is a built in feature of windows that quietly logs every gui launched program on your own machine, protected by an encoding scheme that stops nobody. as the owner of your own systems, you can and should check this key yourself during any suspicious activity review, especially on shared or public facing machines. pull it with the reg query command, decode the rot13, and you've got a timeline of exactly what ran, how often, and when. don't wait for an incident to learn where this lives, poke around your own registry now so you know what normal looks like before you ever need to know what abnormal looks like.