ask:
Hello, script expert! How to list all items in the Run key in the registry?
-- JW
answer:
Hello, JW. How to list all items in the Run key in the registry? To be honest, we are not going to tell you. Really sorry. Not because we don't like you, but because we think we have a better answer for you. (If we are wrong, well, we can only say that this will not be the first time.)
Since you are interested in the Run item, we assume that what you really want to know is how to find out which programs are configured to run automatically every time Windows boots up. You can definitely read this information from the Run item and don't be suspicious of it. In fact, you can read this information from the Run item and check whether both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE have Run items. All of them have the RunOnce item. Next is the Startup folder, All Users Startup folder, etc.
You have found the answer to the question. The problem involved in trying to find out which programs are configured to run automatically every time Windows starts up is that the information may be stored in any of the numerous different locations. Can we write a script to check each of these numerous locations? It is certainly possible to do this. But we think the following script is better:
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colStartupCommands = _
("Select * from Win32_StartupCommand")
For Each objStartupCommand in colStartupCommands
"Command: " &
"Description: " &
"Location: " &
"Name: " &
"User: " &
Next
Instead of looking around and viewing the location where Windows uses to save the information of automatically running programs, we have decided to let WMI do all this for us. WMI class Win32_StartupCommand is used to find information about automatically running programs, regardless of whether the information is stored in the registry, in the Startup folder, or in some other location. For example, when running this script, information similar to the following will be returned:
Command: Microsoft Office OneNote 2003 Quick
Description: Microsoft Office OneNote 2003 Quick Launch
Location: Startup
Name: Microsoft Office OneNote 2003 Quick Launch
User: FABRIKAM\kenmyer
Command: C:\WINDOWS\System32\
Description:
Location: HKU\S-1-5-21-1987391165-1004336648-1605550848-8553\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Name:
User: FABRIKAM\kenmyer
As you can see, there are two different auto-run programs: one has shortcuts in the Startup folder, and the other is the application listed in Run in the HKEY_USERS section of the registry. (There is another location on a computer that might store information for autoruns.) One of our simple little scripts can call and retrieve information about both programs and any other autoruns. This is why we think that using Win32_StartupCommand scripts is better.
So, how does the script itself work? That's it, it's almost as simple as the WMI script that was once written. We first connect to the WMI service on the local computer. Needless to say, we can also use this script to connect to the WMI service on the remote computer (this will return a list of programs that have been configured to run automatically on that computer). Then we call the ExecQuery method and issue the following query, which calls and gets a collection of all the auto-running programs it can find:
Set colStartupCommands = _
("Select * from Win32_StartupCommand")
Now, all that's left to do is to create a For Each loop to iterate through the collection of programs and echo data such as the application name and location where the automatic run information can be found. The method is simple and fast, with the biggest advantage that it returns much more information than can be obtained by reading only the values populated under a single registry key. Very good, right?
We hope it will help you, JW. If it doesn't work, let us know when you really do need to just read the Run item and do everything by using it so we can know what we can do for you. Is there any problem? Do we know who ate the last piece of cake (the one you reserved for yourself)? That's it, we can answer this question, JW. But we don't plan to do that.
Hello, script expert! How to list all items in the Run key in the registry?
-- JW
answer:
Hello, JW. How to list all items in the Run key in the registry? To be honest, we are not going to tell you. Really sorry. Not because we don't like you, but because we think we have a better answer for you. (If we are wrong, well, we can only say that this will not be the first time.)
Since you are interested in the Run item, we assume that what you really want to know is how to find out which programs are configured to run automatically every time Windows boots up. You can definitely read this information from the Run item and don't be suspicious of it. In fact, you can read this information from the Run item and check whether both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE have Run items. All of them have the RunOnce item. Next is the Startup folder, All Users Startup folder, etc.
You have found the answer to the question. The problem involved in trying to find out which programs are configured to run automatically every time Windows starts up is that the information may be stored in any of the numerous different locations. Can we write a script to check each of these numerous locations? It is certainly possible to do this. But we think the following script is better:
Copy the codeThe code is as follows:
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colStartupCommands = _
("Select * from Win32_StartupCommand")
For Each objStartupCommand in colStartupCommands
"Command: " &
"Description: " &
"Location: " &
"Name: " &
"User: " &
Next
Instead of looking around and viewing the location where Windows uses to save the information of automatically running programs, we have decided to let WMI do all this for us. WMI class Win32_StartupCommand is used to find information about automatically running programs, regardless of whether the information is stored in the registry, in the Startup folder, or in some other location. For example, when running this script, information similar to the following will be returned:
Command: Microsoft Office OneNote 2003 Quick
Description: Microsoft Office OneNote 2003 Quick Launch
Location: Startup
Name: Microsoft Office OneNote 2003 Quick Launch
User: FABRIKAM\kenmyer
Command: C:\WINDOWS\System32\
Description:
Location: HKU\S-1-5-21-1987391165-1004336648-1605550848-8553\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Name:
User: FABRIKAM\kenmyer
As you can see, there are two different auto-run programs: one has shortcuts in the Startup folder, and the other is the application listed in Run in the HKEY_USERS section of the registry. (There is another location on a computer that might store information for autoruns.) One of our simple little scripts can call and retrieve information about both programs and any other autoruns. This is why we think that using Win32_StartupCommand scripts is better.
So, how does the script itself work? That's it, it's almost as simple as the WMI script that was once written. We first connect to the WMI service on the local computer. Needless to say, we can also use this script to connect to the WMI service on the remote computer (this will return a list of programs that have been configured to run automatically on that computer). Then we call the ExecQuery method and issue the following query, which calls and gets a collection of all the auto-running programs it can find:
Set colStartupCommands = _
("Select * from Win32_StartupCommand")
Now, all that's left to do is to create a For Each loop to iterate through the collection of programs and echo data such as the application name and location where the automatic run information can be found. The method is simple and fast, with the biggest advantage that it returns much more information than can be obtained by reading only the values populated under a single registry key. Very good, right?
We hope it will help you, JW. If it doesn't work, let us know when you really do need to just read the Run item and do everything by using it so we can know what we can do for you. Is there any problem? Do we know who ate the last piece of cake (the one you reserved for yourself)? That's it, we can answer this question, JW. But we don't plan to do that.