Why is my Amcache.hve empty?

Three common causes, in rough order of likelihood:

1. The Compatibility Appraiser is disabled#

This is the most common cause on production servers and hardened endpoints. The hive file exists, but the scheduled task that writes to it is disabled, so no new entries are being added.

How to check:

# Is the task enabled?
Get-ScheduledTask `
  -TaskPath '\Microsoft\Windows\Application Experience\' `
  -TaskName 'Microsoft Compatibility Appraiser' |
  Select-Object State, LastRunTime, LastTaskResult
 
# Is telemetry disabled by GPO?
reg query 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection' /v AllowTelemetry

Signs the appraiser is disabled:

• Task State = Disabled.
• LastRunTime matches the host's install date or a long-ago date.
• AllowTelemetry = 0 (especially on Servers).

If the appraiser is intentionally disabled, Amcache is not a useful artefact for events after the disablement. Pivot to Sysmon, EDR, Security event log, MFT.

2. The host is freshly installed#

A freshly-imaged Windows host has a near-empty Amcache because the appraiser hasn't run yet.

Workstations: the first appraiser pass typically completes within 24 hours of first boot, sometimes during the initial out-of-box experience.

Servers: first appraiser pass may take 2-5 days.

Check the hive's smallest KeyLastWriteTimestamp against the host's install date. If they match and the host is brand new, the hive will populate as the appraiser runs.

3. You're collecting from a Server (especially Server Core)#

Server cadences are much slower than workstations:

A Server hive of 5-10 MB after a year of operation is normal, not suspicious. Server Amcache is genuinely sparser because:

• Servers run a stable set of services, not many ad-hoc binaries.
• Few interactive users mean few \Users\ paths to inventory.
• Driver and device records are stable.

See Amcache on Windows Server for the full server reference.

Less common causes#

Volume Shadow Copy or backup retention#

If the host has been restored from a backup or VSS snapshot recently, Amcache reflects the state at the time of the snapshot, not the present. Check filesystem timestamps on the hive file itself against the host's reported uptime.

Attacker tampering#

Rare. If you suspect deliberate cleanup:

1. Enumerate Volume Shadow Copies — vssadmin list shadows.
2. Parse each shadow's Amcache.hve.
3. Diff against the live hive.

Entries in shadows but absent from live = evidence of deliberate cleanup. See Can Amcache be cleared by attackers?.

Hive corruption#

Very rare. A partially-corrupted hive can parse with truncated output. AmcacheParser typically emits warnings about cell inconsistencies if this is happening. Check the parse log for warnings.

Diagnosis flowchart#

1. Check the scheduled task State and LastRunTime.
2. If disabled → root cause = appraiser disabled. Pivot to other artefacts.
3. If enabled but LastRunTime is stale → check task history in Event Viewer (Microsoft-Windows-TaskScheduler/Operational) for failures.
4. If task is running normally → check host install date.
5. If host is recently installed → wait and recollect.
6. If host is established and hive is still small → check AllowTelemetry and Server vs Workstation cadence.
7. If none apply and the hive should have rich data → enumerate VSS, diff for tampering.

Related#

• Compatibility Appraiser glossary
• How often is Amcache updated?
• Amcache on Windows Server
• Can Amcache be cleared?