The RunOnce key in the Windows Registry stores all auto-starting executables. It may be empty. To check for auto-starting applications, try this:
$path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce' $properties = Get-ItemProperty -Path $path $properties
Again, this key may have no values. If it has, each auto-starting program has its own value with its own name. To read just the paths for auto-starting programs, access the registry key and query its GetValueNames() method. It provides you with the registry value names. GetValue() can then retrieve the actual value for you:
$path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce' $key = Get-Item -Path $path $key.GetValueNames() | ForEach-Object { $key.GetValue($_) }
Are you an experienced professional PowerShell user? Then learning from default course work isn’t your thing. Consider learning the tricks of the trade from one another! Meet the most creative and sophisticated fellow PowerShellers, along with Microsoft PowerShell team members and PowerShell inventor Jeffrey Snover. Attend this years’ PowerShell Conference EU, taking place April 17-20 in Hanover, Germany, for the leading edge. 35 international top speakers, 80 sessions, and security workshops are waiting for you, including two exciting evening events. The conference is limited to 300 delegates. More details at www.psconf.eu.
