This message was deleted.
# _generals
Slackbot
01/21/2022, 3:45 PMThis message was deleted.
j
James Rankin
01/21/2022, 3:46 PMDownload autoruns from SysInternals and it will tell you all
⤴️ 1
a
Andrew Gresbach
01/21/2022, 3:51 PMit will tell you the registry location? issue is i may have a batch of users across the company like this and no idea who so was hoping i could use PDQ to scan specific reg locations to report the enabled/disabled status for all
j
James Rankin
01/21/2022, 3:52 PMIt should do, IIRC, even if they are unchecked (disabled)......worth a try anyways
a
Andrew Gresbach
01/21/2022, 4:05 PMweird so on mine i have Slack listed in the startup tab right.....autoruns doesn't show it at all regardless if its set to enabled or disabled
Andrew Gresbach
01/21/2022, 4:05 PMfriggin Microsoft i tell ya
Andrew Gresbach
01/21/2022, 4:15 PMdamn even Nirsoft WhatInStartup doesn't list Slack. and if i test by disabling Teams, Onedrive, etc in that Startup tab they dont even show as disabled autoruns or nirsoft.
Andrew Gresbach
01/21/2022, 8:32 PMfigured it out and confirmed w/ another user on a forum by doing a registry compare by disabling/reenabling it. (the disabled hex value changes from person to person but the enabled always looks to be the same so far).
m
Musklor
01/22/2022, 9:14 PMYes I used procmon and I saw this registry entry (startupapproved). I have deleted run key and I have changed value for Skype in the approved/run key. Now, autostart of Skype is disabled.
a
Andrew Gresbach
01/22/2022, 9:15 PMawesome thanks for confirming ! glad to know i'm on the right track!
2 Views