Records activity of desktop applications focused on applications directly interacted with on the desktop.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}
  • {SID} represents security identifier of the user