What in windows 10 runs startup items?

[kosamja]

Its not userinit.exe. If I replace userinit value of winlogon registry key with script I use on windows 7, every startup program is started 2 times. Any way to find out what is starting startup items if it is not userinit.exe?

[jaclaz]

43 minutes ago, kosamja said:

Its not userinit.exe. If I replace userinit value of winlogon registry key with script I use on windows 7, every startup program is started 2 times. Any way to find out what is starting startup items if it is not userinit.exe?

And WAS it userinit.exe ONLY in previous versions of Windows? 

Try running Autoruns:
https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

jaclaz

 

[kosamja]

13 minutes ago, jaclaz said:

And WAS it userinit.exe ONLY in previous versions of Windows? 

From these locations YES:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup
%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Edited July 11, 2016 by kosamja

[Tripredacus]

Another place that can launch startup programs is from Task Scheduler.

[kosamja]

Its not Task Scheduler (its disabled on my windows 10)

[aviv00]

use autoruns see the reg path for startup app

[kosamja]

1 hour ago, aviv00 said:

use autoruns see the reg path for startup app

What reg path? In case I didnt explain exactly what I want:

Example if userinit is replaced with explorer

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\Windows\\explorer.exe"
In windows 7 nothing from these locations starts:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup
%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

but in windows 10 all startup programs from these locations still start. What I am interested in is how those programs are started if userinit is changed?

[aviv00]

what is the process parent of the Startup applications ?

[kosamja]

12 hours ago, aviv00 said:

what is the process parent of the Startup applications ?

explorer.exe, but it looks they are started by Background Tasks Infrastructure Service...

Edited July 12, 2016 by kosamja

[kosamja]

One more question: How long is this delay? Is it minutes, hours or days?

[aviv00]

around 50 days

[NoelC]

You can figure that kind of thing out yourself...

4294967295 milliseconds / 1000 milliseconds per second / 60 seconds per minute / 60 minutes per hour / 24 hours per day...

-Noel

[kosamja]

Yes, but i didnt know does MSec means miliseconds or microseconds

[dencorso]

Milliseconds. Total time is 49.7 days.

[NoelC]

Microseconds are generally abbreviated µSEC or uSec.  The mu character implies micro (one millionth).

-Noel