[Proof] Which runs first or last?

[mazin]

Among the following eight installation points,

which one starts first? Which is last?

1- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

2- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

3- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

4- HKCU\Software\Microsoft\Windows\CurrentVersion\Run

5- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

6- HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEX

7- "%AllUsersProfile%\Start Menu\Programs\Startup"

8- "%UserProfile%\Start Menu\Programs\Startup"

I, first, thought it could be a matter of a few minutes to test

the priority the system gives to each installation point.

It, actually, took about an hour to do four tests.

And the results were the same except for the Startup folder.

In the first three tests, %AllUsersProfile%\..\StartUp executed

prior to %UserProfile%\..\StartUp.

They changed priority on the fourth (final) test, where

%UserProfile%\..\StartUp executed prior to %AllUsersProfile%\..\StartUp!

However, not only the Startup folder was amazing; but what amazed me

is HKCU\..\RunOnce!

I never used that key for installation, but I decided to add it

for the project to be complete.

HKCU\..\RunOnce came LAST!!

Well! I used 8 WinRAR-SFX (exe) files for this purpose.

Each SFX is 3.69 MB, which contains 12.2 MB representing 12 system files.

Each SFX is extracted, by a separate batch file, into a separate

destination folder which is deleted by the same batch file.

Each one of the 8 batch files was called from a different

installation point.

Conclusion: The results are summarized in the following table.

As you can see, the Desktop hadn't been loaded yet when

the first three batch files were run.

Also, each one of the first three batch files runs alone; not in company.

The results show whether files start/finish alone or in company.

:===========:=============:=============:=========:============:
:-CMD from--:-Start Time--:-Finish Time-:-Desktop-:-CMD runs---:
:===========:=============:=============:=========:============:
:-1-LM-ROEX-:-14:16:31.05-:-------------:-NO------:-alone------:
:-1-LM-ROEX-:-------------:-14:16:44.19-:-NO------:-alone------:
:-----------:-------------:-------------:---------:------------:
:-2-CU-ROEX-:-14:16:51.32-:-------------:-NO------:-alone------:
:-2-CU-ROEX-:-------------:-14:16:58.59-:-NO------:-alone------:
:-----------:-------------:-------------:---------:------------:
:-3-LM-RO---:-14:17:11.01-:-------------:-NO------:-alone------:
:-3-LM-RO---:-------------:-14:17:17.81-:-NO------:-alone------:
:-----------:-------------:-------------:---------:------------:
:-4-LM-RUN--:-14:17:43.02-:-------------:-YES-----:-alone------:
:-4-LM-RUN--:-------------:-14:18:47.01-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-5-CU-RUN--:-14:17:46.00-:-------------:-YES-----:-in company-:
:-5-CU-RUN--:-------------:-14:18:45.97-:-YES-----:-alone------:
:-----------:-------------:-------------:---------:------------:
:-6-STRTP-A-:-14:18:51.49-:-------------:-YES-----:-alone------:
:-6-STRTP-A-:-------------:-14:19:41.85-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-7-STRTP-U-:-14:18:52.29-:-------------:-YES-----:-in company-:
:-7-STRTP-U-:-------------:-14:19:43.53-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-8-CU-RO---:-14:18:53.07-:-------------:-YES-----:-in company-:
:-8-CU-RO---:-------------:-14:19:33.24-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:

STRTP-A stands for %AllUsersProfile%\..\StartUp.

STRTP-U stands for %UserProfile%\..\StartUp.

The rest abbreviations are self explainatory, I hope!

I think this could be useful for my next UACD.

I hope you share what you think.

Or may someone do a similar test and share their results, too?

< EDIT >

More new 10 tests are done. Table refreshed.

< EDIT >

Project files attached.

proof.rar

Edited September 11, 2006 by mazin

[PaulIA]

Ack! You're killing me! It took me a week to figure out that RunOnce/RunOnceEx ran before the desktop was loaded! Next time, do your research sooner.

One question related to this that's been nagging me for awhile. I've been meaning to run some tests, but since you already have done such a good job with this, maybe you can tell me. When does the network get loaded in relationship to these installation points? I had trouble running the Symantec LiveUpdate during RunOnceEx, but it works fine using Run.

Nice work!

[mazin]

Now I could, finally, adjust the table.

Well! I was also interested since I'm not using all those installation points

on the same UACD.

Instead of researching, I decided to test it by myself.

I always used SVCPACK and HKLM\..\RUN and I never had a problem

setting up my PC, and even others.

And I always pull my CD out after the copying phase of Windows

SETUP finishes and the computer reboots.

At the HKLM\..\RUN point, and as the test shows, the Desktop has been loaded.

This means that Explorer shell has been loaded and all drivers/services, too.

[PaulIA]

Nice work. That explains the problem I was having trying to run something at RunOnceEx that needed to download files from the network. I'm sure there are going to be a lot of us newbies that will benefit from this information.

[Ctrl-X]

@mazin: excellent work, I'm impressed!

[mazin]

Thanks! Now, I can't be in doubt.

NB: More 10 tests were done and the table refreshed.

[MHz]

Thanks! Now, I can't be in doubt.

Agreed that doubt has been removed for you. I did a similar test long ago to remove doubt so I could make good use of the run points of execution. I certainly acknowledge your results as tabled.

As you may have noticed with your testing is that the 1st 3 keys will in synchronous operation, 1 after the other while the system does wait in loading the desktop. These are keys you would use if you want to install something before desktop but in knowledge that only 1 install can take place at any given time.

Both of the Run keys are for permanent entries that execute programs and some drivers...so have little benefit for installations in general.

The startup folders are synchronous in operation which means thier startup time depends on the time that the desktop loads. Again little good use for installations but merely an easy method for a desktop user to quickly add a shortcut to start their favorite program at startup or whatever pleases.

As you mention mazin about HKCU\...\RunOnce, this key is amazingly the last opportunity and as the system continues to finish loading so this key does give good use of a script to do your UA misc. tasks like shortcut cleanup, file and folder removal, window handling (using AutoIt)...and finally shutdown\reboot operation. I add a script into this key at T-12 which inserts it into the default user at the time. This means every account logged in the 1st time will run that key once and every new account will also. Your script should reside on the HDD so it is available for every account and future accounts. Adding a "z" to the start of the entry name can help it to be the very last entry to run.

Hope my experiences and insight helps and thanks for sharing yours.

[mazin]

When I PMed you to post your opinion,

I was certain that you'd post helpful hints. And you did!

Now you come up with a new (to me) idea. Importing

some reg keys to CU-RO at T-12 (or T-13, maybe?) provides

a good routine for some need-to-be-sticky actions.

This will be useful to me (at least) in applying a certain Power Policy

for each created user.

I've had to log on to each user account to run an INF file to apply

that policy.

Now, using CU-RO, I'd leave that INF in \system32 or in \INF directory

and let it be called by CU-RO.

So, even if a new user is created, after I'm gone, it will get the same policy applied.

That's a brilliant use of CU-RO.

Thanks Michael!

BTW, you've done a good job with "AutoIt3 Unattended Software Deployment". If I get interested in AutoIt, one day, I'm sure I'll use it.

[Takeshi]

mazin: that's very impressive. Very scientific and methodical. And your standard of English in your posts is truly excellent for a non-native English speaker and would put a shame to many native English speakers!

Apart from the two user folders whose start sequences are not totally consistent, do the remaining reg keys all start in the same order in all the 10 tests?

The info you have posted is similar but not identical to the other sources that I've seen.

How do you time the start, finish to the sfx extraction (writing to a txt file?) and how to log when the desktop loads?

[mazin]

Thank you very much for being interested in this topic, Takeshi.

Actually, and after reading some posts here in the forum

(especially by PaulIA and MHz),I got in a mess, myself.

That's because I only use SVCPACK and LM-RUN.

I was curious about whether other methods are also effective.

Well, PaulIA has decided to research and I've decided to do it, myself.

Apart from the two user folders whose start sequences are not totally consistent,

do the remaining reg keys all start in the same order in all the 10 tests?

Yes, they do.

The info you have posted is similar but not identical

to the other sources that I've seen.

I've just been doing my tests. But you may want to post the other results.

How do you time the start, finish to the sfx extraction (writing to a txt file?)

and how to log when the desktop loads?

Yes, it was written to a txt file.

I can't log the loading of Desktop. But I like watching.

Here's one of my batch files.

@ECHO OFF

CD >NUL

TITLE CU----RunOnce

SET TIMEONE=:-8-CU-RO---:-%TIME%-:-------------:-YES-----:-Alone------:

SET EXENAME=HKCURO

SET TXTNAME=%SystemDrive%\%EXENAME%.txt

SET PATHONE=%SystemDrive%\Install\Utils

SET PATHTWO=%SystemRoot%\%EXENAME%

SET LINESET=:-----------:-------------:-------------:---------:------------:

echo %TIMEONE%>%TXTNAME%

start /wait %PATHONE%\%EXENAME%.exe

RD /S /Q %PATHTWO%

SET TIMETWO=:-8-CU-RO---:-------------:-%TIME%-:-YES-----:-Alone------:

echo %TIMETWO%>>%TXTNAME%

echo %LINESET%>>%TXTNAME%

Not bad, I hope!

NB: The words "8, YES, and Alone" are just written for convenience.

I chane them later after looking at the time log and watching the Desktop.

However, I can attach the whole project, without SFXs, if anyone

is interested in doing the same test on their computer. This saves much time.

Edited September 9, 2006 by mazin

[PaulIA]

Well, PaulIA has decided to research and I've decided to do it, myself.

I don't know if burning my drives out with VMWare is research, but it is keeping me busy.

Based on the testing that I have done over the last couple of weeks, the execellent research by mazin and posts by others, I have cleaned up most of the installation problems that I had. Moving certain installations to the LM-RUN or CU-RUN (especially anything that needs the desktop or network) was a must for me. Unfortunately, I spent a couple of weeks of trial/error instead of having the brain matter to conduct a test as mazin did.

@mazin: I think posting your testing batch files would be nice. It might come in handy somewhere down the road or be something that could be extended for other "when does this occur" testing.

[CoffeeFiend]

Knowing the actual order is nice and handful. Thanks for the little test. But there are more things to take into consideration as well...

You somewhat forgot some places (or didn't know of, or left them out intentionally or whatever), like:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

(which is called by MS themselves "Run at Startup" while the old HKLM\...\Run is called "Legacy Run at Startup", so it might be worth adding)

or

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\ Run

(and the RunServices & RunServicesOnce keys too, and things like logon scripts and group policies which also happen at startup)

And there's a TON of little things one should know of... Things like:

-The RunOnce entries are only ran if you're allowed to delete the keys (of the entries to run)

-They aren't ran in safe mode but can be prefixed to force them to

-There are some prefixes (* and !)

-A lot of people don't know the difference between RunOnce and RunOnceEx either

etc.

Mind you most of those keys aren't used a whole lot, and those exceptions don't matter very often. Just like it doesn't matter very much in which particular order things are ran... (You decide between HKCU or HKLM depending on task and users, and Run or RunOnce depending on how many times it must be ran)

There's an awful lot of infos about all this on support.microsoft.com, and I remember seeing a list like yours a few times before... (Either on MS' site, or perhaps even linked on a site like digg, and google can find more similar infos too)

[Takeshi]

I've been testing this evening and it happened I included some of the other keys crahak mentioned and two others he didn't.

I only tested this out on an existing installation as I wanted to get the steps right first. My cmd scripts are somewhat simpler than mazin's. I just introduced a 10s delay with ping and all the cmd outputs are appended to the same log.txt file. I also included another cmd to repopulate the deleted runonce keys for repeated testing (optional). I actually wanted to see the cmd windows so I didn't put in @echo off. All the cmd files for the reg keys are in the root of C.

*.cmd:

echo %~n0 started %date% %time%>>C:\log.txt
ping 127.0.0.1 -n 10 -w 1000
echo %~n0 finished %date% %time%>>C:\log.txt

The last test (test 11) results:

LU started 10/09/2006 0:21:55.62

LRO started 10/09/2006 0:21:57.07

LU finished 10/09/2006 0:22:06.14

LRO finished 10/09/2006 0:22:06.43

CL started 10/09/2006 0:22:08.81

LR started 10/09/2006 0:22:10.06

CR started 10/09/2006 0:22:10.45

AUPSM started 10/09/2006 0:22:11.85

UPSM started 10/09/2006 0:22:19.82

CRO started 10/09/2006 0:22:20.00

CL finished 10/09/2006 0:22:22.03

AUPSM finished 10/09/2006 0:22:22.60

CR finished 10/09/2006 0:22:23.03

LR finished 10/09/2006 0:22:23.12

CRO finished 10/09/2006 0:22:31.82

UPSM finished 10/09/2006 0:22:32.17

Abbreviations:

L = HKLM

C = HKCU

R = Run (so LR = HKLM Run, etc.)

RO = RunOnce

AUPSM = AllUsers Start Menu\...\Startup dir.

UPSM = Current user Start Menu\...\Startup dir.

Two new keys tested and which actually executed:

LU = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

NT\CurrentVersion\Winlogon\Userinit

CL = HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

Summary:

• RunOnceEx cannot be tested as they didn't execute.

• Policy keys (HKLM and HKCU) didn't execute the added cmd scripts, presumably they only execute pre-determined keys.

• This key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceSetup

failed to execute.

• The HKLM RunServices and RunServicesOnce keys failed to execute (the corresponding HKCU keys not tested as a result).

• HKLM RunOnce started after user logon has actually started.

• In Test 6, HKLM RunOnce and HKCU RunOnce did not run but they ran in all the others.

• In Test 6, CR and AUPSM started in a different order.

• In Test 7, CRO started earlier than AUPSM and UPSM.

• In Test 7, the startup order corresponds to that listed in Insider Power Techniques for Microsoft Windows XP (MS Press).

• The desktop has started to load (but not fully loaded) when HKLM Run executes.

• The finished order differs sometimes from test to test.

Not tested:

GP startup scripts,

legacy locations - autoexec.bat, config.sys, etc.

Edited September 10, 2006 by Takeshi

[mazin]

@mazin: I think posting your testing batch files would be nice.

Sure! I'll be attaching them after I've finished

writing the ReadMe file.

You somewhat forgot some places

Certainly!

But I'd like to widen my test as far as I could.

I'll consider testing the run points you've mentioned

and will refresh the first post when done.

The RunOnce entries are only ran if you're allowed

to delete the keys (of the entries to run)

I assume you mean that a user must have permission or admin previlages.

There's an awful lot of infos about all this

on support.microsoft.com, and I remember seeing a

list like yours a few times before... (Either on

MS' site, or perhaps even linked on a site like

digg, and google can find more similar infos too)

Sure, there is.

But I decided to do it myself since I have

the tools, already.

Plus, I beleive in sharing; which brought your ideas here in public.

Thanks for the input and stay tuned.

@ Takeshi

I'm reading your post carefully ATM.

< EDIT >

Project files attached to the first post.

Edited September 10, 2006 by mazin

[mazin]

@ Takeshi

Well! I've just reformatted your results in a tabular form.

Your posted test shows the same results as mine,

regarding to the priority.

The ROEX keys did not execute, in your tests, because you may need

to run this command prior to testng:

rundll32.exe iernonce.dll,RunOnceExProcess

Please consider using my project files, so your results are tabulated.

:===========:=============:=============:=========:============:
:-CMD from--:-Start Time--:-Finish Time-:-Desktop-:-CMD runs---:
:===========:=============:=============:=========:============:
:-1-LM-ROEX-:-Not-Tested--:-------------:NotTested:-Not-Tested-:
:-1-LM-ROEX-:-------------:-Not-Tested--:NotTested:-Not-Tested-:
:-----------:-------------:-------------:---------:------------:
:-2-CU-ROEX-:-Not-Tested--:-------------:NotTested:-Not-Tested-:
:-2-CU-ROEX-:-------------:-Not-Tested--:NotTested:-Not-Tested-:
:-----------:-------------:-------------:---------:------------:
:-3-LM-RO---:-00:21:57.07-:-------------:-NO------:-Alone------:
:-3-LM-RO---:-------------:-00:22:06.43-:-NO------:-Alone------:
:-----------:-------------:-------------:---------:------------:
:-4-LM-RUN--:-00:22:10.06-:-------------:-YES-----:-Alone------:
:-4-LM-RUN--:-------------:-00:22:23.12-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-5-CU-RUN--:-00:22:10.45-:-------------:-YES-----:-in company-:
:-5-CU-RUN--:-------------:-00:22:23.03-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-6-STRTP-A-:-00:22:11.85-:-------------:-YES-----:-in company-:
:-6-STRTP-A-:-------------:-00:22:22.60-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-7-STRTP-U-:-00:22:19.82-:-------------:-YES-----:-in company-:
:-7-STRTP-U-:-------------:-00:22:32.17-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------:
:-8-CU-RO---:-00:22:20.00-:-------------:-YES-----:-in company-:
:-8-CU-RO---:-------------:-00:22:31.82-:-YES-----:-in company-:
:-----------:-------------:-------------:---------:------------: