July 11, 201610 yr Its not userinit.exe. If I replace userinit value of winlogon registry key with script I use on windows 7, every startup program is started 2 times. Any way to find out what is starting startup items if it is not userinit.exe?
July 11, 201610 yr 43 minutes ago, kosamja said: Its not userinit.exe. If I replace userinit value of winlogon registry key with script I use on windows 7, every startup program is started 2 times. Any way to find out what is starting startup items if it is not userinit.exe? And WAS it userinit.exe ONLY in previous versions of Windows? Try running Autoruns:https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx jaclaz
July 11, 201610 yr Author 13 minutes ago, jaclaz said: And WAS it userinit.exe ONLY in previous versions of Windows? From these locations YES: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup %UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Edited July 11, 201610 yr by kosamja
July 11, 201610 yr Author 1 hour ago, aviv00 said: use autoruns see the reg path for startup app What reg path? In case I didnt explain exactly what I want: Example if userinit is replaced with explorer Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\Windows\\explorer.exe" In windows 7 nothing from these locations starts: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup %UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup but in windows 10 all startup programs from these locations still start. What I am interested in is how those programs are started if userinit is changed?
July 12, 201610 yr Author 12 hours ago, aviv00 said: what is the process parent of the Startup applications ? explorer.exe, but it looks they are started by Background Tasks Infrastructure Service... Edited July 12, 201610 yr by kosamja
July 18, 201610 yr You can figure that kind of thing out yourself... 4294967295 milliseconds / 1000 milliseconds per second / 60 seconds per minute / 60 minutes per hour / 24 hours per day... -Noel
July 18, 201610 yr Microseconds are generally abbreviated µSEC or uSec. The mu character implies micro (one millionth). -Noel
Create an account or sign in to comment