How do I check the appraiser is enabled?

Get-ScheduledTask -TaskPath '\Microsoft\Windows\Application Experience\' -TaskName 'Microsoft Compatibility Appraiser' from elevated PowerShell. Look at State (Ready or Running) and LastRunTime (within the expected cadence).

How do I check telemetry GPO?

reg query 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection' /v AllowTelemetry. Value 0 disables the appraiser by side effect in many builds.

Why is Amcache empty on a fresh image?

Freshly imaged hosts have near-empty Amcache because the appraiser hasn't run yet. Wait 24h on a workstation, several days on a server, and the hive will populate.

Why is my Server's Amcache so small?

Servers run the appraiser less often. 2-5 days on Server with Desktop Experience, weekly+ on Server Core. Plus servers have far less interactive activity, so fewer ad-hoc binaries to inventory. A Server hive of 5-10 MB after a year is normal.

Could an attacker have wiped it?

Possibly, but rare. Most attackers don't touch Amcache. If you suspect tampering, enumerate Volume Shadow Copies and diff each shadow's hive against the live one. Entries in shadows but missing from live are tampering evidence.

Why is my Amcache.hve empty or sparse?

Three common causes. (1) The Compatibility Appraiser scheduled task is disabled, by GPO (AllowTelemetry=0), by build configuration, or by manual disablement. The hive exists, the appraiser just stopped writing to it. (2) The host is freshly installed within the last 24 hours and the appraiser hasn't run yet. (3) You are looking at a Server (especially Server Core) where the appraiser runs every several days or weeks, not daily. Tampering is the rare fourth option. Check the scheduled task's LastRunTime, the AllowTelemetry value, and the hive's KeyLastWriteTimestamp distribution to tell which case you're in.

Why is my Amcache.hve empty?

Three common causes, in rough order of likelihood:

1. The Compatibility Appraiser is disabled#

The most common cause on production servers and hardened endpoints. The hive file exists. The scheduled task that writes to it is off. No new entries arrive.

Check:

# Is the task enabled?
Get-ScheduledTask `
  -TaskPath '\Microsoft\Windows\Application Experience\' `
  -TaskName 'Microsoft Compatibility Appraiser' |
  Select State, LastRunTime, LastTaskResult
 
# Telemetry policy
reg query 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection' /v AllowTelemetry

Signs it's disabled:

Task State = Disabled.
LastRunTime matches the host's install date.
AllowTelemetry = 0, especially on Servers.

When the appraiser is disabled, Amcache is not a useful artefact for events after the disablement. Pivot to Sysmon, EDR, the Security event log via EVTX, and the MFT.

2. The host is freshly installed#

A freshly imaged Windows host has a near-empty Amcache because the appraiser hasn't run yet.

Workstations: first pass usually completes within ~24h of first boot, sometimes during OOBE.
Servers: first pass may take 2-5 days.

Check the earliest KeyLastWriteTimestamp against the host's install date. If they match and the host is brand new, the hive will populate as the appraiser runs.

3. You're on a Server (especially Server Core)#

Cadences are much slower than workstations:

Host	Appraiser cadence
Workstation (Win 10/11)	~24 hours
Server with Desktop Experience	2-5 days
Server Core	Weekly or longer
Hardened Server / DC	Even less

A Server hive of 5-10 MB after a year is normal, not suspicious. Server Amcache is genuinely sparser because:

Servers run a stable set of services, not many ad-hoc binaries.
Few interactive users means few \Users\ paths to inventory.
Driver and device records are stable.

See Amcache on Windows Server for the full server reference.

Less common causes#

Backup or shadow restore#

If the host was restored from a backup or VSS snapshot recently, Amcache reflects the state at snapshot time, not the present. Compare filesystem timestamps on the hive against the host's reported uptime.

Attacker tampering#

Rare. If you suspect deliberate cleanup:

vssadmin list shadows to enumerate Volume Shadow Copies.
Parse each shadow's Amcache.hve.
Diff against the live hive.

Entries in shadows but absent from live mean deliberate cleanup. See Can Amcache be cleared by attackers? for the full workflow.

Hive corruption#

Very rare. A partially corrupted hive parses with truncated output. AmcacheParser emits warnings about cell inconsistencies. Read the parse log.

Diagnosis flow#

Check the scheduled task State and LastRunTime.
Disabled? Root cause = appraiser disabled. Pivot.
Enabled but LastRunTime is stale? Check Microsoft-Windows-TaskScheduler/Operational event log for failure history.
Task running normally? Check host install date.
Recently installed? Wait and recollect.
Established host, hive still small? Check AllowTelemetry and the Server vs Workstation cadence.
Nothing else fits? Enumerate VSS and diff for tampering.