Przemysław Łukawski's blog » Windows Server 2008 and 2008 R2

Windows registry autorun locations

p_lider — Sun, 17 Nov 2013 12:14:46 +0000

Many times people ask me to check their computers for malware or for the reason it is working slow. The first thing I do is to check all programs that automatically start with windows. Normally I remember 4 or 5 locations in registry where to look for such programs and almost all the time I must search the internet for another ones. That made me to write this post, which will allow me to always have the full (or almost full) list about the registry locations for auto startup purpose in one place.

In the below table I described all of the registry locations I know which programs are using to start automatically with Windows:

No.	Registry Location (blue ones are present in 64bit OS only)	Description
1	HKML\Software\Microsoft\Windows\CurrentVersion\Run\ HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	All values under this key are executed when any user logs in.
2	HKML\Software\Microsoft\Windows\CurrentVersion\RunOnce\ HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\	All values under this key are executed when any user logs in. After execution the values are being deleted.
3	HKML\Software\Microsoft\Windows\CurrentVersion\RunServices\ HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\	All values under this key are executed as services when any user logs in.
4	HKML\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\ HKML\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\	All values under this key are executed as services when any user logs in. After execution the values are being deleted.
5	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\	All values under this key are executed when current user logs in.
6	HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\	All values under this key are executed when current user logs in. After execution the values are being deleted.
7	HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup\	Used only by setup. A progress bar is being displayed.
8	HKU\.Default\Software\Microsoft\Windows\CurrentVersion\Run\	Same as 5 but applies to LOCAL SYSTEM user only.
9	HKU\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce\	Same as 6 but applies to LOCAL SYSTEM user only.
10	HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\	„Shell” and „Userinit” values contain file names separated with comma which are executed when any user logs in.
11	HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\	„Shell” and „Userinit” values contain file names separated with comma which are executed when current user logs in.
12	HKLM\Software\Microsoft\Active Setup\Installed Components\ HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\	All subkeys are evaluated for execution when any user logs in. The “StubPath” value under each subkey describes the program being run.
13	HKCU\Control Panel\Desktop	„SCRNSAVE.EXE” value is executed when screen saver is being displayed for current user.
14	HKLM\System\CurrentControlSet\Control\Session Manager\	The „BootExecute” value is being executed at boot time.
15	HKLM\System\Control\WOW\cmdline	Value is executed when 16 bit application is being run for all users.
16	HKLM\System\Control\WOW\wowcmdline	Value is executed when 16 bit DOS application is being run for all users.
17	HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad\	Values contains GUID for COM library which is being run after explorer finished loading.
18	HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\	The „run” and „load” values are executed when current user logs in.
19	HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs	AppInit_DLLs value contains dll file names separated with comma which are being loaded into every process being run in the system. IMPORTANT: Very dangerous entry used by many malware programs.
20	HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\	Same as 5. Normally values are named here as numbers starting from „1”.
21	HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\	Same as 1. Normally values are named here as numbers starting from „1”.

Some information in the above table has been taken from this forum: Registry AutoStart Locations

Restoring Selfimage’s partition image to a greater partition

p_lider — Sun, 19 Dec 2010 12:26:06 +0000

Sometimes you must restore you partition images made by programs like SelfImage to a greater partitions – for example after buying new greater hard drive and setting the partitions’ sizes to greater values as they were in original drive.

The problem with such operation is that after restoring for example 20GB partition image to a partition which has 40GB, you will see, that the file system says that there is only 20GB of total partition’s space. This is caused due to old partition size information saved inside internal filesystem’s structures, which was made during the format of the partition on the original drive. Fortunately, the DISKPART utility built in Windows XP and newer systems can fix that problem. To do that follow the following steps after you restore the image to the new, reater partition:

Launch the diskpart command line utility.
Execute “select volume ” command, where “” is a number of the volume containing the restored partition image (the list of all volumes and their numbers can be retrieved by executing “list volume” command).
Execute “extend filesystem” command.
And this is all – now exit the diskpart utility by executing “exit” command and the system will correctly see the real partition size.

Thanks to this tip you can use programs like SelfImage not only for making backups but also for moving entire partitions (including system partitions) to other hard drives even, when they size do not match.

HYPER-V and wrong time measurement in virtual servers

p_lider — Fri, 03 Dec 2010 14:42:12 +0000

If you have a virtual server which has more than 1 virtual processor and is hosted by HYPER-V technology then you can face problems during time measurement. As the result you can see that login to such server can take quite long time and you can see strange errors in EventViewer saying something like “Windows cannot obtain the domain controller name for your computer network” etc.

The solution to such problems is quite easy – you only have to add /usepmtimer switch to your server’s boot.ini file and restart the virtual server. This will cause a different approach during time measurement and will fix mentioned problems.

VPN connection and internal DNS names

p_lider — Fri, 03 Dec 2010 14:31:57 +0000

Sometimes after you connect to your VPN network by means of any VPN client (CiscoVPN, OpenVPN, etc.) you are not able to access network resources using their names, however you can access them using IP addresses. This is caused by the DnsCache service, which sometimes may cache wrong IP addresses for your internal network names.

To fix this irritating behavior clearing the dnscache will not always work. The best way to cope with this problem is to stop DnsCache service – after doing that every time you try access any network resource by its name, the DNS name query will be passed directly to your DNS servers omitting your local cache.

EDIT:

After some time I noticed one more problem with DNS especially when using VPNs established using RRAS. Simply the names were not being resolved by DNS servers provided by RRAS but they were trying to be resolved by DNS servers outside of VPN. This prevented accessing VPN network resources using names. The problem can be fixed by following the following steps:

Go to Network Connections in Control Panel.
Go to Menu: Advanced -> Advanced Settings -> Adapters & Bindings
Move DialUp connections to the top of the list.
Save changes by clisking OK button.
In Windows XP & 2k also follow the instructions described under the following link: http://support.microsoft.com/default.aspx?scid=kb;en-us;311218
Reboot your computer.

After performing the above operations you should not have any DNS issues when using VPNs on your computer.

Installing OS using DRAC cards having damaged DVD with OS physically inserted into server’s DVD-ROM.

p_lider — Sun, 07 Nov 2010 13:54:26 +0000

If your server is equipped with DRAC card and you have also a DVD with an operating system inserted into server’s DVD-ROM, installing the OS remotely is quite an easy operation. However, problems occur when the inserted DVD is damaged and makes the OS installer to stop – without physical presence in the server room, you will have to install the OS using Virtually mounted DVD through network. There would be no problem with that if the Windows Installer would be ignorring the inserted physical DVD – unfortunately it does not ignore it.

So even when you request the server to boot from Virtual media, during the installation the Windows Installer will be using the physically inserted DVD as a source. To avoid that sick behavior you have to disable any optical drives in server’s BIOS setup for the time of installation. After disabling them, Windows Installer will look for source files only on virtual media and not on physical DVD allowing you to successfully install the OS.