User activity
CapabilityAccessManager (camera, mic, location)
CapabilityAccessManager cheat sheet: ConsentStore keys, LastUsedTimeStart and Stop for webcam and microphone use per app, and the Windows 11 SQLite database.
- Location
- SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore
- Proves
- Which program used the webcam, microphone or location, from when to when
- Timestamps
- LastUsedTimeStart and LastUsedTimeStop per app as FILETIME, UTC (latest session only); Windows 11 database usage records
- Retention
- Registry keeps only the latest session per app until the app or key is removed; the Windows 11 database keeps about 30 days
- Access
- Administrator; hives locked live: reg query works live, otherwise raw NTFS (KAPE) or VSS; copy the database with its -wal
- Evidence of
- User activity
- Type
- Registry
- Windows
- 1011
- KAPE target
- CapabilityAccessManagerRegistryHivesSystemRegistryHivesUser
- Velociraptor
- Windows.Triage.Targets:CapabilityAccessManagerRegistryHivesSystemRegistryHivesUser
Tools
Compare all toolsWhat it is
Since Windows 10 version 1903, the Capability Access Manager tracks which applications use privacy-sensitive capabilities (webcam, microphone, location, contacts, and others) so Windows can show the privacy indicators and settings pages. For each app it keeps the start and stop time of the most recent use. For investigators this answers questions such as "did this remote-access tool turn on the camera?" and is also a quiet evidence-of-execution source for desktop programs.
Recent Windows 11 builds additionally keep a usage history in a SQLite database.
Location
| Windows version | Location | Content |
|---|---|---|
| 10 1903+ / 11 | SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\<capability>\ | Per-app entries, machine-wide |
| 10 1903+ / 11 | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\<capability>\ | Per-app entries for that user |
| Recent Windows 11 | C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\CapabilityAccessManager.db (+ -wal) | SQLite usage history (about 30 days) |
<capability> is for example webcam, microphone, location. Packaged (Store) apps appear as subkeys named after their package family name; classic desktop programs are under NonPackaged, with the executable path as key name and # replacing \ (for example C:#Program Files#Zoom#bin#Zoom.exe).
What it proves
- The listed program ran and accessed the capability, with the start and stop time of its latest use; the difference gives the duration.
- In the NTUSER.DAT copy, the access is tied to that user.
- The
Valueentry (Allow/Deny) shows the permission setting, not usage. - Only the last use per app is kept in the registry; history needs the Windows 11 database or older hive copies.
Key fields
| Element | Meaning |
|---|---|
<capability>\<package> or <capability>\NonPackaged\<path with #> | App that requested the capability |
LastUsedTimeStart | Start of the most recent use, FILETIME (QWORD) |
LastUsedTimeStop | End of the most recent use; 0 while the capability is still in use |
Value | Allow or Deny permission |
Windows 11 database: tables such as Users (SID ↔ internal id), Capabilities, PackageFamilyNames, FileIDs (linked to Amcache file IDs), PackagedUsageHistory and NonPackagedUsageHistory.
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
LastUsedTimeStart | App starts using the capability | FILETIME, UTC | Overwritten at each new use |
LastUsedTimeStop | App releases the capability | FILETIME, UTC | 0 if in use at acquisition or if the app crashed |
| Database usage records | Each access session | See parser output | Merge the -wal file first; roughly 30 days kept |
Retention and clearing
- Registry entries persist until the app is removed or the key is cleaned, but hold only the latest session.
- The Windows 11 database keeps about a month of history.
- A
NonPackagedentry can outlive the executable it names, which helps with deleted tools.
Collection
- KAPE target:
CapabilityAccessManager(the database), plusRegistryHivesSystemandRegistryHivesUserfor the keys. - Velociraptor (
Windows.Triage.Targets): the same three targets. - Built-in:
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged" /s
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone" /s
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): browse or batch-export the ConsentStore keys and convert QWORD FILETIMEs.
- Velociraptor:
Windows.Registry.CapabilityAccessManager(artifact exchange). - DB Browser for SQLite or community Python parsers for
CapabilityAccessManager.db.
Investigation tips
- Remote-access tools and implants (
AnyDesk.exe, unknown binaries inAppData) underwebcamormicrophoneare high-priority findings in harassment, espionage and extortion cases. - A
NonPackagedpath in a temp or download folder is also good evidence that the program ran; confirm with BAM/DAM and Amcache. - Compare start/stop times with logon sessions and SRUM network usage to show a camera session was streamed.
- Parse registry copies from shadow copies to recover earlier sessions on Windows 10.
Related artifacts
- SRUM (System Resource Usage Monitor)SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
- BAM / DAM (Background Activity Moderator)BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
- Amcache.hveAmcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
Glossary terms
- FILETIMEThe 64-bit Windows timestamp format counting 100-nanosecond intervals since 1 January 1601 UTC, used by NTFS, the registry and many artifacts.
- Evidence of executionArtifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.
- SQLite write-ahead log (-wal)The -wal sidecar file where SQLite writes recent changes before merging them into the main database; often holds the newest evidence.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.