Link to home
Get AccessLog in
Avatar of campinam
campinam

asked on

Startup Items Missing

Undetected application removes startup items that are unsigned on my Windows 10, periodically. My guess, about once a week.

I put them back, then after a while they disappear. Those items are internal software that should have nothing to do with any machine cleanup.

I suspect Defender Cleanup, but cannot be sure about that. Maybe some setting?
Avatar of Arana (G.P.)
Arana (G.P.)

are some items dissapearing or all of them?

..\Users\<<Username>>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
If you delete either your Startup folder or the All Users startup folder, then all items disappear from Task Manager Startup tab (even if all items normally there are from the registry).
Avatar of campinam

ASKER

Not all items. Only the ones that are unsigned. I used Microsoft's Autoruns utility to make sure about that.
you have any third party antivirus installed?

are those items totally missing or just unchecked?
Also are those UWP apps coded by your team?
1. No

2. Items are removed from the Run key in the registry. Then I choose start with windows in each item options to put them back.
What is UWP? Yes, those are internal software, that's why they are unsigned.
UWP is the new WINDOWS 10 apps (not windows forms).
Those are windows forms applications.
ASKER CERTIFIED SOLUTION
Avatar of Arana (G.P.)
Arana (G.P.)

Link to home
membership
This content is only available to members.
To access this content, you must be a member of Experts Exchange.
Get Access
thanks, it looks like auditpol is a built-in Windows utility... This seems a good idea, but it takes time. And if it's Defender, then what?
then you should add an exclusion to defender for each of those apps.
https://winaero.com/blog/exclusions-windows-defender-windows-10/
If I add an exclusion as "Process" - "any file used by this process won't be scanned by Windows Defender" - would this protect the process's registry entries? Maybe so, because Defender won't scan the executable (presumably) to find if it is signed or not (?)
Most excellent help. Thank you.
At the end how did you solve it? so others can benefit from your solution.
Not yet solved. It may take some time.
I have excluded those in Defender. However, once a week or so, rebooting would still result in the same items missing, probably by scheduled OS cleanup involving Defender.

But, not with the last week's cleanup. Now those items persisted. Maybe Windows updates made some amends to the cleanup code. Or maybe they'll be missing after rebooting some other time. We'll see.