Didier Stevens

Tuesday 25 September 2007

Update: Disabling UserAssist Logging for Windows Vista

Filed under: Forensics — Didier Stevens @ 8:02

In my usual posting routine, most posts have a life-cycle of a couple of weeks before they get published. This allows me to think about it and conduct further testing when necessary.

Unfortunately, I didn’t do this for the UserAssist Vista post. I wanted to get this post out before my holiday, but should I have postponed it, I would have found out that toggling the privacy toggle in Windows Vista is effective immediately. It’s only when you change the setting via the registry that you have to restart Windows Explorer to make the change effective.

And another important difference is that disabling it through the start menu properties dialog will also erase all UserAssist entries!

Blog at WordPress.com.