Where are disabled autostart programs stored? Somewhere in the registry?

Question

I know that the programs that run with Windows are stored in the registry under (inn both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER):

- /Software/Microsoft/Windows/CurrentVersion/Run
- /Software/Microsoft/Windows/CurrentVersion/RunOnce

But when I delete their entries here (or use msconfig to disable programs from autostart), where the information about disabled programs is stored?

I mean the programs that do not run with Windows anymore, but under msconfig->autorun they are marked as "disabled".

Solution 1

Have a look under:

\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run

there should be one corresponding entry for each entry in:

\Software\Microsoft\Windows\CurrentVersion\Run

It's a binary value, "02 00 00 00..." means enabled, any other value seems to mean disabled.

I investigated this under Windows 8.1 but assume the registry key is the same for Windows 7. However in 8.x you disable autostart programs in the 'Task Manager' rather than msconfig.

Solution 2

If you delete them manually via regedit, they're gone for good unless you made a backup first.

If you disabled them using MSConfig, you can find the disabled registry entires at

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

and disabled startup entries¹ at

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder.

The subkeys there contain the necessary information to restore a disabled key. You can safely delete the keys found there but you can't restore them via MSConfig afterwards, though.

Note: MSConfig doesn't include items from Group Policy or the Windows 7 Task Scheduler!

---

¹ Entries from a user's startup folder (Start → Programs → Startup).

Solution 3

@Peter Hahndorf, that is not correct.

Win7 has no StartupApproved key. It uses msconfig instead:

HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

Win 8/10 StartupApproved can also contain binary value "06 00 00 00" that is also mean "enabled" ! I don't know full enumeration of these flags, but it seems reliable way to check whether it is enabled or not - check next 8 bytes that represent FILETIME structure. If all bytes are zeroes - record is enabled.

Comments

[Thomas Weller]

The FILETIME structure seems to be in UTC.