{"id":67923,"date":"2006-02-20T10:39:00","date_gmt":"2006-02-20T10:39:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2006\/02\/20\/how-can-i-list-all-the-items-in-the-run-key-in-the-registry\/"},"modified":"2006-02-20T10:39:00","modified_gmt":"2006-02-20T10:39:00","slug":"how-can-i-list-all-the-items-in-the-run-key-in-the-registry","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-list-all-the-items-in-the-run-key-in-the-registry\/","title":{"rendered":"How Can I List All the Items in the Run Key in the Registry?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I list all the items in the Run key in the registry?

— JW<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, JW. How can you list all the items in the Run key in the registry? Well, to be honest, we\u2019re not going to tell you. Nope, sorry. Not because we don\u2019t like you, but because we think we have a better answer for you. (If we\u2019re wrong, well, let\u2019s just say it won\u2019t be the first time.) <\/P>\n

Because you\u2019re interested in the Run key we\u2019re assuming that what you really<\/I> want to know is how to find out which programs are configured to automatically run each time Windows starts. You can definitely read that information from the Run key, do doubt about that. Well, actually, you can read that information from the Run keys<\/I>, seeing as how both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE have Run keys. And they both have RunOnce keys. And then there\u2019s the Startup folder, and the All Users Startup folder, and \u2026.<\/P>\n

You get the idea. The problem with trying to figure out which programs are configured to automatically run each time Windows starts is that this information might be stored in any one of a million different places. Could we write a script that checks each and every one of those million places? You bet we could. But we think this is a better way:<\/P>

strComputer = “.”<\/p>\n
Set objWMIService = GetObject(“winmgmts:\\\\” & strComputer & “\\root\\cimv2”)<\/p>\n
Set colStartupCommands = objWMIService.ExecQuery _\n    (“Select * from Win32_StartupCommand”)<\/p>\n
For Each objStartupCommand in colStartupCommands\n    Wscript.Echo “Command: ” & objStartupCommand.Command\n    Wscript.Echo “Description: ” & objStartupCommand.Description\n    Wscript.Echo “Location: ” & objStartupCommand.Location\n    Wscript.Echo “Name: ” & objStartupCommand.Name\n    Wscript.Echo “User: ” & objStartupCommand.User\n    Wscript.Echo\nNext\n<\/PRE>\n
Instead of poking around in every nook and cranny trying to find out where Windows keeps information about auto-run programs we\u2019ve decided to let WMI do all that work for us. The WMI class Win32_StartupCommand<\/B> is designed to ferret out information about auto-run programs, regardless of whether that information is stored in the registry, in a Startup folder, or in some other location. For example, when we run this script we\u2019ll get back information similar to this:<\/P>
Command: Microsoft Office OneNote 2003 Quick Launch.lnk\nDescription: Microsoft Office OneNote 2003 Quick Launch\nLocation: Startup\nName: Microsoft Office OneNote 2003 Quick Launch\nUser: FABRIKAM\\kenmyer<\/p>\n
Command: C:\\WINDOWS\\System32\\ctfmon.exe\nDescription: ctfmon.exe\nLocation: HKU\\S-1-5-21-1987391165-1004336648-1605550848-8553\\SOFTWARE\\Microsoft\\\nWindows\\CurrentVersion\\Run\nName: ctfmon.exe\nUser: FABRIKAM\\kenmyer\n<\/PRE>\n
As you can see, we have two different auto-run programs here: one that has a shortcut in the Startup folder, the other is an application listed in Run in the HKEY_USERS portion of the registry. (Yet another<\/I> location on the computer where auto-run information might be stored.) And our one simple little script can go out and, in a matter of seconds, retrieve information about both these programs, as well as any other auto-run applications. That\u2019s why we consider a script that uses Win32_StartupCommand to be the better approach.<\/P>\n
So how does the script itself work? Well, it\u2019s about as simple a WMI script as you\u2019ll ever write. We start off by connecting to the WMI service on the local computer. Needless to say, we could also use this script to connect to the WMI service on a remote computer (which would return a list of programs configured to auto-run on that<\/I> machine). We then call the ExecQuery<\/B> method and issue the following query, one that goes out and grabs a collection of all the auto-run programs it can find:<\/P>
Set colStartupCommands = objWMIService.ExecQuery _\n    (“Select * from Win32_StartupCommand”)\n<\/PRE>\n
All that\u2019s left now is to set up a For Each loop and walk through the collection of programs, echoing back such data as the application name and the location where the auto-run information can be found. It\u2019s fast, it\u2019s easy and – best of all – it returns a lot more information than you could get just by reading values filed under a single registry key. What\u2019s not to like, huh?<\/P>\n
We hope that helps, JW. If it doesn\u2019t, if you really did<\/I> need to just read the Run key and be done with it, well, let us know and we\u2019ll see what we can do for you. Any more questions? Do we know who ate the last piece of cake, the one you were saving for yourself? Well, we could<\/I> answer that, JW. But we\u2019re not going to.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I list all the items in the Run key in the registry?— JW Hey, JW. How can you list all the items in the Run key in the registry? Well, to be honest, we\u2019re not going to tell you. Nope, sorry. Not because we don\u2019t like you, but because we […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[16,3,386,5],"class_list":["post-67923","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-desktop-management","tag-scripting-guy","tag-startup-and-shutdown","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I list all the items in the Run key in the registry?— JW Hey, JW. How can you list all the items in the Run key in the registry? Well, to be honest, we\u2019re not going to tell you. Nope, sorry. Not because we don\u2019t like you, but because we […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=67923"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/67923\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=67923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=67923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=67923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}