What controls the cadence?

The scheduled task at \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser. Triggers are idle-time, time-based with random delay, and power-state-aware. Cadence varies by build.

Why is the appraiser slower on Servers?

Microsoft tunes it down on Server SKUs to minimise impact on production workloads. Server Core gets the most conservative configuration.

Can I force it to run?

Yes. Start-ScheduledTask -TaskPath '\Microsoft\Windows\Application Experience\' -TaskName 'Microsoft Compatibility Appraiser' from elevated PowerShell. Useful during triage when you need fresh inventory data quickly.

What about first-seen accuracy?

KeyLastWriteTimestamp on a workstation is accurate to within ~24h of the file's actual arrival on disk. On Servers, within several days. For sub-hour precision, fall back to Sysmon 11 (File Create) or MFT $STANDARD_INFORMATION.CreationTime.

What if Amcache doesn't update at all?

Check the scheduled task state and LastRunTime. AllowTelemetry=0 via GPO at HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection also disables it. Hardened servers routinely turn the appraiser off.

How often is Amcache.hve updated?

The Microsoft Compatibility Appraiser updates Amcache.hve roughly once a day on Windows 10/11 workstations, every 2-5 days on Server with Desktop Experience, and weekly or longer on Server Core. The trigger combines idle-time detection, time-based triggers with random delay, and power-state awareness (the appraiser skips on battery). For DFIR this means a freshly-dropped binary may not appear in Amcache for up to 24 hours on a workstation, up to several days on a server. For finer first-seen precision, use Sysmon File Create or MFT timestamps.

How often is Amcache updated?

Roughly daily on Windows 10/11 workstations. Every 2-5 days on Server with Desktop Experience. Weeks on Server Core. That is the answer most DFIR people need to hear up front, because Amcache lags reality and timelines built on it have to account for that lag.

The cadence comes from the scheduled task at \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser. Triggers combine idle detection with a time trigger that has random delay, and the appraiser skips runs on battery. Modern Standby laptops can sit at 36-48 hour intervals because the idle trigger fires less often when the device is in connected standby.

Host type	Typical lag from on-disk to Amcache entry
Windows 10/11 workstation	Up to ~24 hours
Server with Desktop Experience	2-5 days
Server Core	Up to a week or more
Laptop in Modern Standby	Up to 36-48 hours
Battery-bound device	Variable (appraiser skips on battery)

For sub-hour first-seen precision, use Sysmon 11 (File Create), Security 4688 process creation, or MFT $STANDARD_INFORMATION.CreationTime. Amcache is excellent at "present at some point". It is bad at "present at this exact second".

Forcing it to run#

If you need a fresh hive during triage:

Start-ScheduledTask `
  -TaskPath '\Microsoft\Windows\Application Experience\' `
  -TaskName 'Microsoft Compatibility Appraiser'
 
Get-ScheduledTaskInfo `
  -TaskPath '\Microsoft\Windows\Application Experience\' `
  -TaskName 'Microsoft Compatibility Appraiser'

Wait 30-60 seconds, then recollect the hive and its .LOG1 / .LOG2.

When the appraiser isn't running at all#

A few common signs:

Task is Disabled or its LastRunTime matches the host's install date.
HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry = 0 by GPO.
KeyLastWriteTimestamp distribution stops cold at some past date.

On a host where the appraiser is disabled, Amcache is frozen. It is not a useful artefact for anything after the disablement. Pivot to Sysmon, EDR, EVTX, and the registry hives instead.

For the broader appraiser reference, see the Compatibility Appraiser glossary. For Server specifics, see Amcache on Windows Server.

How often is Amcache updated?

Forcing it to run#

When the appraiser isn't running at all#

Related posts