The Windows UserAssist
Key

UserAssist is a registry log of the graphical programs you've launched — how many times, and when you last ran them. Windows stores it obfuscated with ROT13, a trivial letter-shift cipher. The most important thing about it: the record survives uninstalling the program. This page explains what it is, where it lives, and how to decode yours.

What is UserAssist?

UserAssist is a Windows feature that quietly tracks the GUI programs and shortcuts you launch [anything you double-click or start from the Start menu or desktop — as opposed to commands typed into a console]. Its original purpose was mundane: help Windows surface your most-used apps in Start and search. But as a side effect it keeps a running per-user history of program execution.

For each program it records a run count, a last-execution timestamp, and a focus time [roughly how long the app sat in the foreground while you used it]. Because it's tied to the Windows Explorer shell, it captures desktop and Start-menu launches — but not programs started from the Run box or a terminal.

Where it lives

The data sits in the current-user registry hive [HKCU — your own account's settings, readable without administrator rights], split across two GUID-named subkeys:

How to decode yours

Open PowerShell and paste the block below. It reads both UserAssist GUID subkeys, un-scrambles the ROT13 value names, and prints the readable list of programs your account has launched [a read-only lookup — it changes nothing on your system]:

# UserAssist decoder — reveals the GUI programs you've launched (read-only, no admin)
$base = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist";
function Rot13($s){ -join ($s.ToCharArray() | ForEach-Object { $c=[int]$_; if($c -ge 65 -and $c -le 90){[char]((($c-65+13)%26)+65)} elseif($c -ge 97 -and $c -le 122){[char]((($c-97+13)%26)+97)} else{$_} }) };
Get-ChildItem $base | ForEach-Object { $k = Join-Path $_.PSPath "Count"; if(Test-Path $k){ (Get-Item $k).GetValueNames() | Where-Object { $_ } | ForEach-Object { Rot13 $_ } } } | Sort-Object -Unique

Decoded entries look like UEME_RUNPATH:C:\...\program.exe. The UEME_RUNPATH prefix marks a program that was executed; you may also see session and shortcut entries. On some systems tracking is disabled or the key is sparse — an empty result simply means little or nothing was logged for your account.

Why it matters

UserAssist is a quiet, honest witness. Uninstalling a program removes its files — but not this log. The ROT13 record of "you ran X, this many times, last on this date" lingers in the registry after the application itself is long gone. That's exactly why it's a staple of forensic examinations.

How to reduce your exposure

This is standard, legitimate privacy hygiene [tidying up traces on your own machine — not evading anything]:

• Turn off launch tracking: Settings → Privacy & security → General → disable "Let Windows improve Start and search results by tracking app launches." New launches stop being recorded.
• Clear existing entries: the values under each Count subkey can be cleared to remove the historical log for your account.
• Know it's per-user: each Windows account keeps its own UserAssist history, so clearing one profile doesn't touch another.
• Remember it's one artifact of many: Prefetch, BAM, and SRUM record execution too — real privacy means understanding the whole set, not just one key.