DFIRHub

Windows registry artifactWindows 10 Timeline Status

Windows 10 Activity Timeline status, 0 = Disabled, 1 = Enabled

  • System Info
  • 2 keys
  • SOFTWARE

Registry keys

2 keys that RECmd reads for this artifact

  • SOFTWAREEnableActivityFeed
    Policies\Microsoft\Windows\System

    Windows 10 Activity Timeline status, 0 = Disabled, 1 = Enabled

  • SOFTWAREvalue
    Microsoft\PolicyManager\default\Privacy\EnableActivityFeed

    Windows 10 Activity Timeline status, 0 = Disabled, 1 = Enabled

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)