What controls how often the appraiser runs?

The scheduled task at \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser, with triggers combining idle-time detection, time-based triggers with random delay, and power-state awareness. The exact cadence varies by build.

Why is the appraiser slower on Servers?

Microsoft tunes the appraiser to run less aggressively on Server SKUs to minimise resource impact on production workloads. Server Core is the most conservative configuration.

Can I force the appraiser to run?

Yes — Start-ScheduledTask -TaskPath '\Microsoft\Windows\Application Experience\' -TaskName 'Microsoft Compatibility Appraiser' from an elevated PowerShell. Useful for testing or for accelerating Amcache during a triage.

What does this mean for first-seen timestamps?

KeyLastWriteTimestamp on a workstation is accurate to within ~24 hours of the file's actual arrival on disk. On Servers, within ~5 days. For sub-hour first-seen precision, use Sysmon File Create events or MFT $STANDARD_INFORMATION.CreationTime.

What if Amcache doesn't update at all?

Check the scheduled task — it may be disabled by GPO or by build configuration. HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry = 0 also disables it. Hardened Servers and high-security environments routinely disable the appraiser.

How often is Amcache.hve updated?

The Microsoft Compatibility Appraiser scheduled task updates Amcache.hve roughly once per day on Windows 10 and 11 workstations, every 2 to 5 days on Windows Server with Desktop Experience, and weekly or longer on Server Core. The cadence is a combination of idle-time triggers and time-based triggers with random delay; the appraiser is also power-aware and skips runs on battery. Practically: a binary dropped on a workstation may not appear in Amcache for up to 24 hours; on a server, up to several days.

How often is Amcache updated?

The Compatibility Appraiser updates Amcache.hve roughly daily on Windows 10/11 workstations, every 2 to 5 days on Windows Server with Desktop Experience, and weekly or longer on Server Core. The cadence comes from the scheduled task at \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser, which combines idle-time triggers and time-based triggers with random delay and is power-aware.

For DFIR, this means Amcache lags real time:

Host type	Typical lag from file-on-disk to Amcache entry
Windows 10/11 workstation	Up to ~24 hours
Windows Server with Desktop Experience	2–5 days
Windows Server Core	Up to a week or more
Laptop in Modern Standby	Up to 36–48 hours
Battery-bound device	Variable (appraiser skips on battery)

A binary dropped on a host may not appear in Amcache for that window. For sub-hour first-seen precision, use Sysmon File Create events (Event ID 11) or MFT $STANDARD_INFORMATION.CreationTime instead. Amcache excels at "present at some point" — not "present at this exact second."

Forcing the appraiser to run#

If you need fresh Amcache fast (during a triage), kick the task:

# Elevated PowerShell
Start-ScheduledTask `
  -TaskPath '\Microsoft\Windows\Application Experience\' `
  -TaskName 'Microsoft Compatibility Appraiser'
 
# Wait 30-60s, then check LastRunTime
Get-ScheduledTaskInfo `
  -TaskPath '\Microsoft\Windows\Application Experience\' `
  -TaskName 'Microsoft Compatibility Appraiser'

After completion, recollect Amcache.hve and its transaction logs.

When the appraiser is disabled#

Signs the appraiser is not running:

The scheduled task is disabled or has a stale LastRunTime.
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry = 0 (Group Policy disables CEIP / telemetry).
Amcache.hve's KeyLastWriteTimestamp distribution stops at some date with no newer entries.

On a host where the appraiser is disabled, Amcache is frozen. It is not a useful artefact for events after the disablement time. Use Sysmon, EDR, and Security event log instead.

For the broader appraiser reference, see the Compatibility Appraiser glossary. For build-specific cadence details, see Amcache on Windows Server.

How often is Amcache updated?

Forcing the appraiser to run#

When the appraiser is disabled#

Related posts