Enumerating Computer Startup Commands

  • Article

Microsoft® Windows® 2000 Scripting Guide

Computer startup does not end after the operating system has been loaded. Instead, the Windows operating system can be configured so that startup commands are run each time Windows starts. Startup commands are stored in the registry or as part of the user profile and are used to automatically start specified scripts or applications each time Windows is loaded.

In most cases, autostart programs are useful; they ensure that certain applications, such as antivirus tools, are automatically started and run each time Windows is loaded. However, autostart programs also can be responsible for problems such as:

  • Computers that take an exceptionally long time to start. This might be the result of a large number of applications that must be started each time Windows starts.

  • Applications that are represented in the Taskbar or in Task Manager, even though the user did not start them. Although these applications do not necessarily cause problems, they can result in help desk calls from users who are confused as to where these programs came from and why they are running.

  • Computers experiencing problems even when they seem idle. These problems are often traced to startup commands that are running when no one is aware that they are running.

Identifying the applications and scripts that automatically run at startup is an important but difficult administrative task, because startup commands can be stored in many different locations:

  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run

  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run

  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

  • HKU\ProgID\Software\Microsoft\Windows\CurrentVersion\Run

  • systemdrive\Documents and Settings\All Users\Start Menu\Programs\Startup

  • systemdrive\Documents and Settings\username\Start Menu\Programs\Startup

You can use the WMI Win32_StartupCommand class to enumerate autostart programs regardless of where the information is stored. A partial set of properties available through the Win32_StartupCommand class is shown in Table 8.18.

Table 8.18 Win32_StartupCommand Properties

Property

Description

Command

Command run by the startup command. For example, "c:\windows\notepad.exe myfile.txt".

Description

Description of the startup command.

Location

Path to where the startup command resides in the file system or the registry. For example:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name

File name of the startup command.

User

User profile under which this startup command will run.

Scripting Steps

Listing 8.20 contains a script that enumerates the startup commands on a computer. To carry out this task, the script must perform the following steps:

  1. Create a variable to specify the computer name.

  2. Use a GetObject call to connect to the WMI namespace root\cimv2, and set the impersonation level to "impersonate."

  3. Use the ExecQuery method to query the Win32_StartupCommand class.

    This query returns a collection consisting of all the startup commands on the computer.

  4. For each startup command in the collection, echo the property values.

Listing 8.20 Enumerating Computer Startup Commands

   
1
2
3
4
5
6
7
8
9
10
11
12
13

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colStartupCommands = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_StartupCommand")
For Each objStartupCommand in colStartupCommands
 Wscript.Echo "Command: " & objStartupCommand.Command
 Wscript.Echo "Description: " & objStartupCommand.Description
 Wscript.Echo "Location: " & objStartupCommand.Location
 Wscript.Echo "Name: " & objStartupCommand.Name
 Wscript.Echo "SettingID: " & objStartupCommand.SettingID
 Wscript.Echo "User: " & objStartupCommand.User
Next