File: <SYSTEMROOT>\System32\config\SYSTEM

Registry key:

Starting from Windows 10 1809:


Introduced in Windows 10’s Fall Creators update - version 1709, the Background Activity Moderator (BAM) is a mostly undocumented feature that controls the programs executed in the background. The Desktop Activity Moderator (DAM) is a feature for devices supporting the “Connected Standby” mode (i.e. when a device is turned on, but its display will be turned off). As a result, the BAM registry keys will contain data on any devices, while DAM registry keys will only contain data on mobile devices.

Information of interest

The BAM registry key contains multiple subkeys under bam\State\UserSettings, with one subkey per user, identified with the user SID. While the key is in the SYSTEM registry hive, program executions can thus still be tied to a specific user using this SID.

Each user-specific key contains a list of executed programs, with one value per program. The value name is the program full path and the value data is the timestamp of last execution.

If a file is deleted, the eventual associated entry in the BAM is deleted as well after the system reboot. Additionally, BAM entries older than 7 days are deleted upon system boot. The BAM thus provides limited information on historic execution of programs.

No entries are created in the BAM keys for executables on removable media and / or on network shares.


View on GitHub