Used to track activity of applications running in background.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}

ControlSet001\Services\bam\State\UesrSettings
  • {SID} represents security identifier of the user