Jump to content

What in windows 10 runs startup items?


kosamja

Recommended Posts

Its not userinit.exe. If I replace userinit value of winlogon registry key with script I use on windows 7, every startup program is started 2 times. Any way to find out what is starting startup items if it is not userinit.exe?

Link to comment
Share on other sites


43 minutes ago, kosamja said:

Its not userinit.exe. If I replace userinit value of winlogon registry key with script I use on windows 7, every startup program is started 2 times. Any way to find out what is starting startup items if it is not userinit.exe?

And WAS it userinit.exe ONLY in previous versions of Windows? :dubbio:

Try running Autoruns:
https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

jaclaz


 

Link to comment
Share on other sites

13 minutes ago, jaclaz said:

And WAS it userinit.exe ONLY in previous versions of Windows? :dubbio:

From these locations YES:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup
%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Edited by kosamja
Link to comment
Share on other sites

1 hour ago, aviv00 said:

use autoruns see the reg path for startup app

What reg path? In case I didnt explain exactly what I want:

Example if userinit is replaced with explorer

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\explorer.exe"
In windows 7 nothing from these locations starts:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup
%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

but in windows 10 all startup programs from these locations still start. What I am interested in is how those programs are started if userinit is changed?

Link to comment
Share on other sites

12 hours ago, aviv00 said:

what is the process parent of the Startup applications ?

explorer.exe, but it looks they are started by Background Tasks Infrastructure Service...

Edited by kosamja
Link to comment
Share on other sites

You can figure that kind of thing out yourself...

4294967295 milliseconds / 1000 milliseconds per second / 60 seconds per minute / 60 minutes per hour / 24 hours per day...

-Noel

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...