Journey Into Incident Response
Revealing Program Compatibility Assistant HKCU AppCompatFlags Registry Keys
The Application Experience and Compatibility feature ensures compatibility of existing software between different versions of the Windows operating system. The implementation of this feature results in some interesting program execution artifacts that are relevant to Digital Forensic and Incident Response (DFIR). I highlighted a Windows 7 artifact in the post Revealing the RecentFileCache.bcf File and Yogesh Khatri highlighted a Windows 8 artifact in his post Amcache.hve in Windows 8 — Goldmine for malware hunters. However, there are still even more artifacts associated with this feature and the AppCompatFlags registry keys are one of them. This post provides some additional information about these registry keys in the Windows 7 and 8 operating systems and the relevance of the data stored within them.
Exploring the Program Compatibility Assistant
The Program Compatibility Assistant (PCA) is another technology the Windows operating system uses to ensure software compatibility between different Windows versions. The Windows Internals, Part 1: Covering Windows Server 2008 R2 and Windows 7 in the built-in diagnostic utilities section states the following about PCA:
Program Compatibility Assistant (PCA), which enables legacy applications to execute on newer Windows versions despite compatibility problems. PCA detects application installation failures caused by a mismatch during version checks and run-time failures caused by deprecated binaries and User Account Control (UAC) settings. PCA attempts to recover from these failures by applying the appropriate compatibility setting for the application, which takes effect during the next run. In addition, PCA maintains a database of programs with known compatibility issues and informs the users about potential problems at program startup.
The Program Compatibility Assistant is a Windows service. It’s service display name is Program Compatibility Assistant Service, service name is PcaSvc and its default description states «this service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems. If this service is stopped, PCA will not function properly.» The screenshot below shows the Windows 7 PCA service’s properties including the path to the executable which is «svchost.exe -k LocalSystemNetworkRestricted.»
The article The Program Compatibility Assistant — Part Two goes into a little more detail about how PCA works. It mentions the following:
«When a user launches a program, if that program is on a list of programs that are known to have compatibility issues, then PCA informs the user of this. This list is maintained in the System Application Compatibility Database. Depending on the nature of the issue, the application may be Hard Blocked or Soft Blocked.»
A hard block prevents the application from running or installing while a soft block indicates the program has known compatibility issues. The process creation stages were detailed in the post Revealing the RecentFileCache.bcf File; if you are not familiar with the process it’s recommend to read the article.
Exploring the HKU AppCompatFlags Layers Registry Keys
The Program Compatibility Assistant uses compatibility modes to help programs run on Windows. These compatibility modes are set in the following registry keys (which one is used depends on if the setting is for all users or the current user):
HKLM\ Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
For each compatibility setting there is a registry value listed beneath the Layers registry key. The value contains: the path to the executable and the compatibility mode being applied. To illustrate how this works I’ll walk through the FTK imager installation process on a Windows 7 system. The picture below shows FTK imager’s file properties with the Windows XP (Service Pack 3) compatibility mode selected. This setting only applies to the current user; for it to apply to all users the «Change settings for all users» must be used.
After applying the compatibility setting the registry value is updated beneath the Layers key as shown below.
This compatibility setting is queried during the process creation stages. The image below shows Explorer.exe starting the AccessData FTK Imager_3.1.22_Copy.exe process.
The image below shows the compatibility setting being queried during the process creation.
Exploring the Windows 7 AppCompatFlags Persisted Registry Key
The article The Program Compatibility Assistant — Part Two goes into further detail about how PCA works. Besides the Layers registry key, » PCA stores the list of all programs for which it came up under the following key for each user, even if no compatibility modes were applied (in other words, the user indicated that the program worked correctly).» In Windows 7, it appears that PCA records the programs that have an installation routine inside the user account registry hive it executed under. The registry location is:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
To illustrate how this works I’ll again walk through the FTK imager installation process on a Windows 7 system. (note: I tested various programs without installation routines but none of them were recorded in the Windows 7 Persisted registry key). The image below shows the FTK imager process starting.
The next image shows the Application Experience service modifying the RecentFileCache.bcf file since the AccessData FTK Imager_3.1.22.exe file was recently created.
Up to this point in the process creation it is very similar to what I described in the post about the RecentFilecache.bcf file. However, the next image shows the PCA process becoming more active.
The properties of the svchost.exe process confirms it is in fact the Program Compatibility Assistant service as shown below:
The PCA service performs various activities as the FTK Imager application starts to load. One of those activities is querying the registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted as shown below:
This modification is to record the AccessData FTK Imager_3.1.22.exe file that executed on the system. The other programs listed in the Persisted registry key all had installation routines when they executed.
Exploring the Windows 8 AppCompatFlags Store Registry Key
In Windows 8, the Program Compatibility Assistant appears to function similar to the process I described previously. However, there is one key difference in Windows 8. It appears that PCA records all third party programs inside the user account registry hive it executed under regardless if it has an installation routine or not. The Persisted registry key is no longer present and the data is stored in the location below:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
To illustrate how this works I’ll through the Process Explorer program executing on a Windows 8 system. Process Explorer is a standalone program so it doesn’t have an installation routine. The walkthrough I’m doing is very similar to programs with installation routines running on Windows 8. The image below shows the Process Explorer starting.
For brevity I’m excluding other images in the process creation and only showing the activity related to PCA. The image below shows PCA accessing the application compatibility database.
PCA continues by querying the File registry key inside the Amcache.hve registry hive. In Windows 8, this registry hive replaces the RecentFilecache.bcf file. For more information about this new artifact refer to the posts: Yogesh Khatri’s Amcache.hve in Windows 8 — Goldmine for malware hunters and Amcache.hve — Part 2.
PCA queries various locations as Process Explorer starts to load; one of them is the registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store as shown below.
The other activity PCA does with the store registry key is to record information about Process Explorer as shown below.
Looking at the registry values in the Store registry key shows it contains references to various third party applications. The applications are ones without installation routines (procmon.exe, Tweb.exe, and procexp.exe) as well as ones with installation routines (FTK imager and FoxIt). The Store registry key even ties applications to Internet Explorer (Tweb.exe).
AppCompatFlags Registry Keys’ Relevance
The AppCompatFlags registry keys’ are another artifact that shows program execution. The following are some of the relevant registry keys:
HKLM\ Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store
The relevance of the executables listed in these keys mean the following:
1. The program executed on the system.
2. The program executed on the system under the user account where the keys are located
Turn off Program Compatibility Assistant – PCA
In Windows Vista, Windows 7, Windows 8.1, and Windows 10, a compatibility assistant runs in the background (in use).
It seems intended to help prevent if the software is not officially compatible with such Windows versions.
However, it also happens that the wizard is wrong, and that a fully compatible software is in the list, or perhaps you know what you are doing and that you do not want to see the window appear, such as :
Disable Program Compatibility Assistant – Windows 10
When you install software, Windows 7 then displays a window asking if the installation went well, which it does 99% of the time. You can turn off this message, which can get quite annoying in the long run.
Step 1: Trun off and Disable Program Compatibility Assistant Service In Window 10
- Click on the Start button, or you can press Windows Button + R.
- In the Search field, enter the command services.msc and validate with Enter.
What is Program Compatibility Assistant?
- When a user launches a program , if that program is on a list of programs that are known to have compatibility issues, then PCA informs the user of this.
- In these instances, the program will run, but the user will be presented with a dialog box indicating known compatibility issues.
How do I turn off Compatibility Assistant in Windows 7?
-
Click on Start and type in services. msc, hit enter.
- Scroll down the list from the window, which appears until you visit program compatibility helper support.
- Highlight the ceremony.
- Click it and choose properties.
- Besides startup type, pick disable.
- Click on the use button .
- Finally, all set, click on OK.
How To Turn Off Windows Program Compatibility?
-
- Go to your Downloads folder or the place where you saved the installer files.
- Right-click on the Visual Studio Installer image.
- You can see the Properties here; select it.
- There are some tabs. Go to the Compatibility tab.
- Look for the Compatibility Mode section. Uncheck “ Run this program in compatibility mode for: ”
- All set at the last Restart the installation
What is program compatibility troubleshooter?
- Windows includes an integrated tool named Program Compatibility Troubleshooter, which may automatically resolve some compatibility issues for you.
In the event the troubleshooter can not repair the issue, you can manually create a program operate in a compatibility manner, which will conduct the program with all the settings in a previous version of Windows.
Blogger, WordPress, JavaScript, software leadership, software development, and related technologies. Love to write blogs and Articles and Passionate About sharing Knowledge.
Program compatibility assistant Service
The Program Compatibility Assistant (PCA) is a Windows service that helps users run older programs on newer versions of the Windows operating system. It is designed to detect and resolve compatibility issues that may arise when running older programs on newer versions of Windows. PCA is included in all versions of Windows since Windows Vista.
What is the Program Compatibility Assistant?
The Program Compatibility Assistant is a Windows service that helps users run older programs on newer versions of the Windows operating system. It is designed to detect and resolve compatibility issues that may arise when running older programs on newer versions of Windows. PCA is included in all versions of Windows since Windows Vista.
When a user attempts to run an older program on a newer version of Windows, PCA will detect any compatibility issues and offer solutions to resolve them. It can also detect and resolve issues related to hardware and software compatibility. PCA can also detect and resolve issues related to user accounts, security settings, and other system settings.
PCA can also detect and resolve issues related to user accounts, security settings, and other system settings. It can also detect and resolve issues related to hardware and software compatibility. PCA can also detect and resolve issues related to user accounts, security settings, and other system settings.
Why is the Program Compatibility Assistant Needed?
The Program Compatibility Assistant is needed to help users run older programs on newer versions of Windows. As Windows operating systems are updated, some older programs may not be compatible with the new version. PCA helps users identify and resolve compatibility issues so that they can run their older programs on the new version of Windows.
PCA can also help users identify and resolve hardware and software compatibility issues. This can help users avoid potential conflicts between different hardware and software components. It can also help users identify and resolve issues related to user accounts, security settings, and other system settings.
Is the Program Compatibility Assistant Safe?
Yes, the Program Compatibility Assistant is safe. It is designed to detect and resolve compatibility issues that may arise when running older programs on newer versions of Windows. It does not modify or delete any files or settings on the user’s computer. PCA is included in all versions of Windows since Windows Vista.
Program Compatibility Assistant Service Errors
The Program Compatibility Assistant service can sometimes encounter errors. These errors can be caused by a variety of factors, such as corrupted system files, outdated drivers, or incompatible hardware or software. If the PCA service encounters an error, it will display an error message and offer solutions to resolve the issue.
Program Compatibility Assistant Troubleshooting
If the Program Compatibility Assistant service encounters an error, it is possible to troubleshoot the issue. The first step is to check the Event Viewer for any errors related to the PCA service. If any errors are found, they should be addressed. It is also important to ensure that all drivers and software are up-to-date. If the issue persists, it may be necessary to perform a system restore or reinstall Windows.
Can the Program Compatibility Assistant be Disabled?
Yes, the Program Compatibility Assistant can be disabled. To do so, open the Services window by typing “services.msc” in the Run dialog box. Then, locate the Program Compatibility Assistant service and double-click it. In the Properties window, select the “Disabled” option and click “OK”. The PCA service will now be disabled.
How to Fix Program Compatibility Assistant Errors?
If the Program Compatibility Assistant service encounters an error, it is possible to fix the issue. The following steps can be taken to resolve PCA errors:
- Check the Event Viewer – Check the Event Viewer for any errors related to the PCA service.
- Update Drivers and Software – Ensure that all drivers and software are up-to-date.
- Perform a System Restore – If the issue persists, it may be necessary to perform a system restore.
- Reinstall Windows – If all else fails, it may be necessary to reinstall Windows.
By following these steps, it is possible to fix Program Compatibility Assistant errors and ensure that the PCA service is running properly.
Conclusion
The Program Compatibility Assistant is a Windows service that helps users run older programs on newer versions of the Windows operating system. It is designed to detect and resolve compatibility issues that may arise when running older programs on newer versions of Windows. PCA is included in all versions of Windows since Windows Vista and is safe to use. If the PCA service encounters an error, it is possible to troubleshoot and fix the issue by following the steps outlined above.
What is pcalua.exe and should you Delete or Disable it?
Microsoft is keen to ensure that any application you download over the internet into the Windows OS meets their compatibility standards. While many of us may already know about the process “pcalua.exe”, there are still many of us still wondering what this process does.
The process “pcalua.exe” is related to Program Compatibility Assistant. According to Microsoft:
The Program Compatibility Assistant detects known compatibility issues in older programs. After you have run an older program in this version of Windows, it notifies you if there is a problem and offers to fix it the next time you run the program. If the compatibility issue is serious, the Program Compatibility Assistant might warn you or block the program from running. If that happens, you’ll have the option to check online for possible solutions.
Basically, PCA (Program Compatibility Assistant) interacts with all the software and applications you install on your computer to make sure you have the smoothest experience in Windows. PCA will sometimes take measures to amend rules for an application or run the application in such a way that it stimulates a previous version of Windows.
If you downloaded an application which is designed for Windows 7 but you are installing it on Windows 10, PCA will come into action and either ask you to run it in compatibility mode or do it for you automatically. This very mechanism is what makes Windows support older versions of applications on its new operating system builds. We recommend checking the authenticity of the service. If it is authentic, it is advised that you don’t disable the service. If you are an advanced user and know what you are doing, you can carry on.
How to Verify if pcalua.exe is Authentic?
First of all, you should check if the application is digitally signed by a legitimate source. Digital signatures verify that an application is from a verified publisher/development and in most cases, digitally verified applications are not malware. You should check the file path of the executable. It should be in Local Disk C under System 32 and should be digitally signed by Microsoft Cooperation.
If you find the software not authentic, you should take immediate action and remove it from your computer as soon as possible. There are tons of virus and malware on the internet who pose to be some Microsoft service but are indeed harming your computer in the background.
There are plenty of ways through which you can remove illegal software from your computer. There are tons of good antivirus software which do the job. You can download any software from Malwarebytes to Hitman Pro etc. Here we will use Microsoft Security Scanner to scan your computer for discrepancies and check if there is indeed any problem.
Microsoft Safety Scanner is a scan tool designed to find and remove malware from your computer. Do note that this software is not a substitute for your regular antivirus. It only runs when it is triggered but has the latest definitions upgraded. Furthermore, we recommend that you only use this software by downloading the latest version as virus definitions are updated frequently.
- Head over to Microsoft’s official website and download the Safety Scanner. Make sure you are downloading the correct version for your computer by selecting the bits.
- The file will be around 120MB. Download the file to an accessible location and click on the exe file to runit.
- Wait for the scan to complete completely. If there were any threats detected, the scanner would notify you immediately.
How can I Disable Program Compatibility Assistant?
If the service is authentic and is giving you problems (like popping up whenever you install a new program on your computer), you can disable it using the methods listed below. Do note that you will lose the capability to run the applications which are suited for a previous version of Windows as discussed earlier.