Registry on windows 2008

Hi all,

With Windows 2003, I'm using
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run to lunch
process each time the user log in.
I tryed to create the same key at the same place with Windows 2008 but it
doesn't work.

How can I do the same with Windows 2008 ? Does the Run Key still exist ?

Thank you,

Olivier

On Mon, 19 Apr 2010 08:45:02 -0700, OlivierT
<> wrote:

>Hi all,
>
>With Windows 2003, I'm using
>HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Run to lunch
>process each time the user log in.
>I tryed to create the same key at the same place with Windows 2008 but it
>doesn't work.
>
>How can I do the same with Windows 2008 ? Does the Run Key still exist ?
>
>Thank you,
>
>Olivier

Yes, the key does exist, but it only exists when the user is currently
logged on. it is specific to each user account and is only assembled
as part of the logon process. If you try to create or copy it without
a user logged on, such as remotely connecting to a machine with no one
logged on, it won't exist. You would need to look at the HKEY_USERS
hive, which has a copy of all users that have logged on.

There is a ".DEFAULT" key that exists with common settings for new
users, but it does not have a Run key. I haven't tried it, but you can
test creating one to see if it populates either an existing user
account once it logs on, or a new user once they've logged on.

Ace

This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.

Ace,

HKEY_USERS\.DEFAULT subkey is not for new users. It is loaded when no one is
logged on aka (system account) For current_user you would, as you mentioned,
need to have the user logged on or edit the users hive by loading (File|Load
Hive) ntuser.dat within their profile folder.

\Default User profile uses ntuser.dat in \default user directory.


--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

"Ace Fekay [MVP - Directory Services]" wrote:
> Yes, the key does exist, but it only exists when the user is currently
> logged on. it is specific to each user account and is only assembled
> as part of the logon process. If you try to create or copy it without
> a user logged on, such as remotely connecting to a machine with no one
> logged on, it won't exist. You would need to look at the HKEY_USERS
> hive, which has a copy of all users that have logged on.
>
> There is a ".DEFAULT" key that exists with common settings for new
> users, but it does not have a Run key. I haven't tried it, but you can
> test creating one to see if it populates either an existing user
> account once it logs on, or a new user once they've logged on.
>
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Please reply back to the newsgroup or forum for collaboration benefit
> among responding engineers, and to help others benefit from your
> resolution.
>
> Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
> MCSA 2003/2000, MCSA Messaging 2003
> Microsoft Certified Trainer
> Microsoft MVP - Directory Services
>
> If you feel this is an urgent issue and require immediate assistance,
> please contact Microsoft PSS directly. Please check
> http://support.microsoft.com for regional support phone numbers.

On 19/04/2010 16:45, OlivierT wrote:
> Hi all,
>
> With Windows 2003, I'm using
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run to lunch
> process each time the user log in.
> I tryed to create the same key at the same place with Windows 2008 but it
> doesn't work.
>
> How can I do the same with Windows 2008 ? Does the Run Key still exist ?

The key still exists, and it's still in the same place.

I'm running Server 2008 R2 x64 and I have a program set to start at
login using this key. It works fine.

If you run the program manually, does it require elevation or do
anything else that might prevent it from working correctly on Server 2008?

--
Chris M.

On Mon, 19 Apr 2010 11:36:42 -0600, "Dave Patrick"
<> wrote:

>Ace,
>
>HKEY_USERS\.DEFAULT subkey is not for new users. It is loaded when no one is
>logged on aka (system account) For current_user you would, as you mentioned,
>need to have the user logged on or edit the users hive by loading (File|Load
>Hive) ntuser.dat within their profile folder.
>
>\Default User profile uses ntuser.dat in \default user directory.


Thanks for the correction. :-)

As for the User Run key, I would imagine if he can identify the SID of
the user, he can change it in HKEY_USERS, too. Sometimes if an account
has problems such as from a virus, if there are any other accounts,
I've logged in as the other account (as long as an admin account), and
went in there to check and change the user's Run key, if anything
looks suspicious.

Ace

Thank you for your responses but it doesn't work with my win 2008 R2.

I create Run key under HCU\Software\Microsoft\Windows. In Run Key, I create
2 entries with REG_SZ named a and b.
I tryed to execute the command by the Run menu and it works fine.

When I logoff and login again, the command doesn't lunched.

Olivier


"Ace Fekay [MVP - Directory Services]" wrote:

> On Mon, 19 Apr 2010 11:36:42 -0600, "Dave Patrick"
> <> wrote:
>
> >Ace,
> >
> >HKEY_USERS\.DEFAULT subkey is not for new users. It is loaded when no one is
> >logged on aka (system account) For current_user you would, as you mentioned,
> >need to have the user logged on or edit the users hive by loading (File|Load
> >Hive) ntuser.dat within their profile folder.
> >
> >\Default User profile uses ntuser.dat in \default user directory.
>
>
> Thanks for the correction. :-)
>
> As for the User Run key, I would imagine if he can identify the SID of
> the user, he can change it in HKEY_USERS, too. Sometimes if an account
> has problems such as from a virus, if there are any other accounts,
> I've logged in as the other account (as long as an admin account), and
> went in there to check and change the user's Run key, if anything
> looks suspicious.
>
> Ace
> .
>

When i lunch the command, it doesn' ask me an elevation of privilege. It
works fine without prompting something.

Thank you.

"Chris M" wrote:

> On 19/04/2010 16:45, OlivierT wrote:
> > Hi all,
> >
> > With Windows 2003, I'm using
> > HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run to lunch
> > process each time the user log in.
> > I tryed to create the same key at the same place with Windows 2008 but it
> > doesn't work.
> >
> > How can I do the same with Windows 2008 ? Does the Run Key still exist ?
>
> The key still exists, and it's still in the same place.
>
> I'm running Server 2008 R2 x64 and I have a program set to start at
> login using this key. It works fine.
>
> If you run the program manually, does it require elevation or do
> anything else that might prevent it from working correctly on Server 2008?
>
> --
> Chris M.
> .
>

On 20/04/2010 16:55, OlivierT wrote:
> Thank you for your responses but it doesn't work with my win 2008 R2.
>
> I create Run key under HCU\Software\Microsoft\Windows. In Run Key, I create
> 2 entries with REG_SZ named a and b.
> I tryed to execute the command by the Run menu and it works fine.

You shouldn't need to create the Run key itself - it should already be
there under HKCU\Software\Microsoft\Windows\CurrentVersion - was it not
there already?

--
Chris M.

> "Ace Fekay [MVP - Directory Services]" wrote:
>
>> On Mon, 19 Apr 2010 11:36:42 -0600, "Dave Patrick"
>> <> wrote:
>>
>>> Ace,
>>>
>>> HKEY_USERS\.DEFAULT subkey is not for new users. It is loaded when no one is
>>> logged on aka (system account) For current_user you would, as you mentioned,
>>> need to have the user logged on or edit the users hive by loading (File|Load
>>> Hive) ntuser.dat within their profile folder.
>>>
>>> \Default User profile uses ntuser.dat in \default user directory.
>>
>>
>> Thanks for the correction. :-)
>>
>> As for the User Run key, I would imagine if he can identify the SID of
>> the user, he can change it in HKEY_USERS, too. Sometimes if an account
>> has problems such as from a virus, if there are any other accounts,
>> I've logged in as the other account (as long as an admin account), and
>> went in there to check and change the user's Run key, if anything
>> looks suspicious.
>>
>> Ace
>> .
>>

I agree with Chris. You do not create that key. The system creates it
for the currently logged on user account.

You stated in created it in this location.
HCU\Software\Microsoft\Windows

It should exist in:
HCU\Software\Microsoft\Windows\CurrentVersion\Run

But it looks like it was just a typo, since you stated the correct
path in your original post.

Are there any errors in the Event logs?

Ace



On Tue, 20 Apr 2010 08:55:02 -0700, OlivierT
<> wrote:

>Thank you for your responses but it doesn't work with my win 2008 R2.
>
>I create Run key under HCU\Software\Microsoft\Windows. In Run Key, I create
>2 entries with REG_SZ named a and b.
>I tryed to execute the command by the Run menu and it works fine.
>
>When I logoff and login again, the command doesn't lunched.
>
>Olivier
>
>
>"Ace Fekay [MVP - Directory Services]" wrote:
>
>> On Mon, 19 Apr 2010 11:36:42 -0600, "Dave Patrick"
>> <> wrote:
>>
>> >Ace,
>> >
>> >HKEY_USERS\.DEFAULT subkey is not for new users. It is loaded when no one is
>> >logged on aka (system account) For current_user you would, as you mentioned,
>> >need to have the user logged on or edit the users hive by loading (File|Load
>> >Hive) ntuser.dat within their profile folder.
>> >
>> >\Default User profile uses ntuser.dat in \default user directory.
>>
>>
>> Thanks for the correction. :-)
>>
>> As for the User Run key, I would imagine if he can identify the SID of
>> the user, he can change it in HKEY_USERS, too. Sometimes if an account
>> has problems such as from a virus, if there are any other accounts,
>> I've logged in as the other account (as long as an admin account), and
>> went in there to check and change the user's Run key, if anything
>> looks suspicious.
>>
>> Ace
>> .
>>

Hi,

No, the key wasn't already created. I had to create it myself...

Olivier

"Chris M" wrote:

> On 20/04/2010 16:55, OlivierT wrote:
> > Thank you for your responses but it doesn't work with my win 2008 R2.
> >
> > I create Run key under HCU\Software\Microsoft\Windows. In Run Key, I create
> > 2 entries with REG_SZ named a and b.
> > I tryed to execute the command by the Run menu and it works fine.
>
> You shouldn't need to create the Run key itself - it should already be
> there under HKCU\Software\Microsoft\Windows\CurrentVersion - was it not
> there already?
>
> --
> Chris M.
>
> > "Ace Fekay [MVP - Directory Services]" wrote:
> >
> >> On Mon, 19 Apr 2010 11:36:42 -0600, "Dave Patrick"
> >> <> wrote:
> >>
> >>> Ace,
> >>>
> >>> HKEY_USERS\.DEFAULT subkey is not for new users. It is loaded when no one is
> >>> logged on aka (system account) For current_user you would, as you mentioned,
> >>> need to have the user logged on or edit the users hive by loading (File|Load
> >>> Hive) ntuser.dat within their profile folder.
> >>>
> >>> \Default User profile uses ntuser.dat in \default user directory.
> >>
> >>
> >> Thanks for the correction. :-)
> >>
> >> As for the User Run key, I would imagine if he can identify the SID of
> >> the user, he can change it in HKEY_USERS, too. Sometimes if an account
> >> has problems such as from a virus, if there are any other accounts,
> >> I've logged in as the other account (as long as an admin account), and
> >> went in there to check and change the user's Run key, if anything
> >> looks suspicious.
> >>
> >> Ace
> >> .
> >>
>
> .
>