Registry key:
HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings\<SID>\*
HKLM\SYSTEM\CurrentControlSet\Services\dam\UserSettings\<SID>\*
Starting from Windows 10 1809:
HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>\*
HKLM\SYSTEM\CurrentControlSet\Services\dam\State\UserSettings\<SID>\*
Overview
Introduced in Windows 10’s Fall Creators update - version 1709, the
Background Activity Moderator (BAM) is a mostly undocumented feature that
controls the programs executed in the background. The
Desktop Activity Moderator (DAM) is a feature for devices supporting the
“Connected Standby” mode (i.e. when a device is turned on, but its display will
be turned off). As a result, the BAM registry keys will contain data on any
devices, while DAM registry keys will only contain data on mobile devices.
Information of interest
The BAM registry key contains multiple subkeys under
bam\State\UserSettings, with one subkey per user, identified with the user
SID. While the key is in the SYSTEM registry hive, program executions can
thus still be tied to a specific user using this SID.
Each user-specific key contains a list of executed programs, with one value per program. The value name is the program full path and the value data is the timestamp of last execution.
If a file is deleted, the eventual associated entry in the BAM is deleted as
well after the system reboot. Additionally, BAM entries older than 7 days are
deleted upon system boot. The BAM thus provides limited information on
historic execution of programs.
No entries are created in the BAM keys for executables on removable media
and / or on network shares.
References
View on GitHub