Desktop Activity Moderator (DAM) Forensics Explained
What the Desktop Activity Moderator is, why its registry key is empty on most desktops, how DAM entries differ from BAM, and how to use them on laptops.
TL;DR. DAM (Desktop Activity Moderator) is the connected-standby sibling of BAM. Microsoft describes it as a kernel driver that suspends or throttles desktop processes when a device goes into connected standby, loaded only when the hardware supports it, and not present on servers. When it records, it uses the same <SID> key and value format as BAM under Services\dam. Expect it on laptops and tablets with Modern Standby, expect nothing on most desktops, and treat what's there as a second, smaller BAM.
Most BAM articles give DAM one sentence. That's fair — on the average desktop image the key is empty. On a modern laptop it isn't, and it's worth knowing what you're looking at. Context first: the BAM/DAM forensics guide.
What Microsoft says DAM does
Microsoft's compatibility documentation describes the Desktop Activity Moderator as one of the Windows 8 features for devices that support connected standby (Microsoft Learn). The key points:
- It is a kernel-mode driver "loaded and initialized at system boot if the system supports connected standby" — determined by the
AOACfield ofSYSTEM_POWER_CAPABILITIES(structure reference). - When the screen is off in connected standby, it suspends desktop processes in interactive sessions and throttles those in session 0 (services).
- It is disengaged when the screen is on.
- It "is not present on server SKUs".
Connected standby has since become Modern Standby in Microsoft's hardware documentation, which describes how desktop apps are paused while the device sleeps (Modern Standby overview, preparing software).
Where DAM records live
Same hive, same shape as BAM:
SYSTEM\ControlSet00X\Services\dam\State\UserSettings\<SID> (Windows 10 1809+, 11)
SYSTEM\ControlSet00X\Services\dam\UserSettings\<SID> (older layout)
Parser coverage varies: Eric Zimmerman's BamDam plugin lists dam\UserSettings among its key paths (see the tool comparison), and our BAM/DAM Parser reads bam and dam in both layouts across every control set. Each value is an executable path (or package family name) with a REG_BINARY whose first 8 bytes are a FILETIME — see the value format article.
BAM vs DAM side by side
| BAM | DAM | |
|---|---|---|
| Purpose | Moderate background activity | Suspend/throttle desktop apps in connected standby |
| Driver | bam.sys | dam.sys (Boutnaru) |
| Present on | Windows 10 1709+, Windows 11 | Devices supporting connected/Modern Standby; not on server SKUs |
| Key | Services\bam\State\UserSettings\<SID> | Services\dam\State\UserSettings\<SID> |
| Value format | Path → REG_BINARY, FILETIME first | Same |
| Typical content | Most locally run programs from the last ~week, per user | Usually fewer entries; often empty on desktops (ElcomSoft) |
| Research depth | Reverse-engineered (Suhanov) | Mostly documented from observation |
The last row is the important caveat. The detailed findings about BAM — timestamps updated on process start and exit, seven-day pruning at boot, removal of entries for deleted executables, no entries for removable or network paths — come from analysis of bam.sys. We haven't found equivalent published analysis of dam.sys's record-keeping. Treat those behaviours as likely for DAM, not established.
When DAM helps
A second witness. If the same executable appears under the same SID in both BAM and DAM with close timestamps, you have two independent writes pointing at the same activity. That's useful when a finding will be challenged.
A different subset. DAM concerns desktop processes around standby, so its list is not a copy of BAM's. In the fictional sample hive on this site, DAM for user alice holds only explorer.exe, while BAM holds eight programs. Don't expect one-to-one overlap.
Hardware profiling. A populated DAM key is a quick hint that the device supports Modern Standby — typically a laptop or tablet. Combined with the host name and SRUM network and energy data, it helps you describe the device in a report.
When DAM is empty
An empty or missing dam key is normal on:
- Desktops and VMs without connected standby.
- Servers ("not present on server SKUs").
- Older laptops that use traditional S3 sleep.
It is only worth questioning when the hardware clearly supports Modern Standby, BAM is populated for the same users, and DAM is empty in every control set. Even then, check the build and power configuration before calling it tampering. The anti-forensics article lists the signals that actually indicate deletion.
Reading DAM with the tool
- Drop
SYSTEM(andSOFTWAREfor user names) onto the BAM/DAM Parser. - Use the source filter: "BAM + DAM" shows both, or pick DAM only.
- The "Source" column says
damfor those rows; the detail panel shows the full key path. - Sort by user and time to line DAM rows up with BAM rows for the same account.
Everything else — flags, UTC/local toggle, CSV/JSON export — works the same for DAM rows.
Open questions worth testing
Because DAM's record-keeping hasn't been reverse-engineered publicly the way BAM's has, a few behaviours are worth checking on a reference laptop with the same Windows build as your evidence before you rely on them:
| Question | Why it matters | How to test |
|---|---|---|
| Are DAM entries pruned after a week, like BAM? | Tells you how far back an empty DAM key is meaningful | Run a known program, wait more than seven days, reboot, re-export SYSTEM |
| Does DAM skip removable and network paths? | Decides whether an absence is informative | Run the same test binary from a local disk, a USB stick and a share |
| When is the timestamp updated? | Start, exit, standby entry or exit | Run a program across a standby cycle and compare with Sysmon event 1 times |
| Which programs get entries? | DAM targets desktop processes around standby | Compare BAM and DAM lists after a day of normal use |
Document the build, the hardware and the exact steps, and keep the exported hives: a reproducible test is worth more in a report than a blog's summary, including this one.
Frequently asked questions
What is the difference between BAM and DAM?
BAM moderates background activity on any Windows 10 1709+ system. DAM suspends or throttles desktop apps while a Modern Standby device sleeps. Both keep per-user executable/timestamp records in the SYSTEM hive in the same format; DAM usually holds far fewer entries.
Why is the DAM key empty on my image?
Most likely the machine does not support Modern Standby (connected standby), so the DAM driver never loaded. That is normal on most desktops and servers and is not a sign of tampering by itself.
Sources
- Microsoft Learn, Desktop Activity Moderator and Modern Standby.
- Maxim Suhanov, BAM internals (BAM only).
- Shlomi Boutnaru, The Windows Forensic Journey — DAM.