Ask:
Hello, Scripting Guy! How do I list all the items in the Run key in the registry?
--JW
For:
Hello, JW. How do I list all the items in the Run key in the registry? Frankly speaking, we are not going to tell you. I'm really sorry about that. Not because we don't like you, but because we think we have a better answer for you. (If we're wrong, well, we can only say this won't be the first time.) ）
Because you are interested in the run item, we assume that what you really want to know is how to find out which programs are configured to run automatically every time Windows starts. You must be able to read this information from the Run key and do not doubt it. In fact, you can read this information from the run key to see if there are Run items in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. All of them have RunOnce items. Next comes the Startup folder, the all Users Startup folder, and so on.
You have found the answer to the question. The problem with trying to figure out which programs are configured to run automatically every time Windows starts is that the information may be stored in any location in a large number of different locations. Can we write a script to check each of these numerous locations? You can certainly do so. But we think the following script is better:
Copy Code code as follows:
StrComputer = "."
Set objWMIService = GetObject ("winmgmts:\\" & StrComputer & "\root\cimv2")
Set Colstartupcommands = objWMIService.ExecQuery _
("SELECT * from Win32_startupcommand")
For each objstartupcommand in Colstartupcommands
WScript.Echo "Command:" & Objstartupcommand.command
WScript.Echo "Description:" & objstartupcommand.description
WScript.Echo "Location:" & objstartupcommand.location
WScript.Echo "Name:" & Objstartupcommand.name
WScript.Echo "User:" & Objstartupcommand.user
WScript.Echo
Next
Instead of looking around and finding out where Windows is going to store the information for Autorun programs, we've decided to let WMI do all of the work for us. WMI class Win32_startupcommand is used to find information about Autorun programs, whether that information is stored in the registry, in the Startup folder, or somewhere else. For example, when you run this script, you will return information similar to the following:
Command:microsoft Office OneNote 2003 Quick Launch.lnk
Description:microsoft Office OneNote 2003 Quick Launch
Location:startup
Name:microsoft Office OneNote 2003 Quick Launch
User:fabrikam\kenmyer
Command:c:\windows\system32\ctfmon.exe
Description:ctfmon.exe
Location:hku\s-1-5-21-1987391165-1004336648-1605550848-8553\software\microsoft\
Windows\currentversion\run
Name:ctfmon.exe
User:fabrikam\kenmyer
As you can see, there are two different Autorun programs: One program has a shortcut in the Startup folder, and the other program is the application listed in Run in the HKEY_USERS section of the registry. (There is another location on the computer that might store the Autorun information.) We have a simple little foot that can be invoked and retrieved in seconds for information about both programs and any other Autorun application. That's why we think the script that uses Win32_startupcommand is better.
So, how does the script work itself? Well, it's almost as simple as a WMI script that you've been writing. We first connect to the WMI service on the local computer. Needless to say, we can also use this script to connect to the WMI service on a remote computer (this will return a list of programs that have been configured to run automatically on that computer). Then we call the ExecQuery method and issue the following query, which invokes and gets a collection of all the Autorun programs that it can find:
Set Colstartupcommands = objWMIService.ExecQuery _
("SELECT * from Win32_startupcommand")
Now, all that remains to be done is to create a For Each loop that iterates through the collection of programs and echoes back data such as the application name and location where automatic running information can be found. This method is simple and quick, and the biggest advantage is that it returns far more information than can be obtained by reading only the values that are filled under a single registry key. Pretty good, huh?
We hope it will be of some help to you, JW. If it doesn't work, tell us when you really need to read only the Run key and use it to fix everything, so we can know what we can do for you. Do you have any more questions? We know who ate the last piece of cake (the piece of cake you kept for yourself)? Yes, we can answer that question, JW. But we do not intend to do so.
