We help IT Professionals succeed at work.

Startup Items Missing

Medium Priority
92 Views
Last Modified: 2020-04-01
Undetected application removes startup items that are unsigned on my Windows 10, periodically. My guess, about once a week.

I put them back, then after a while they disappear. Those items are internal software that should have nothing to do with any machine cleanup.

I suspect Defender Cleanup, but cannot be sure about that. Maybe some setting?
Comment
Watch Question

CERTIFIED EXPERT

Commented:
are some items dissapearing or all of them?

..\Users\<<Username>>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
If you delete either your Startup folder or the All Users startup folder, then all items disappear from Task Manager Startup tab (even if all items normally there are from the registry).

Author

Commented:
Not all items. Only the ones that are unsigned. I used Microsoft's Autoruns utility to make sure about that.
CERTIFIED EXPERT

Commented:
you have any third party antivirus installed?

are those items totally missing or just unchecked?
CERTIFIED EXPERT

Commented:
Also are those UWP apps coded by your team?

Author

Commented:
1. No

2. Items are removed from the Run key in the registry. Then I choose start with windows in each item options to put them back.

Author

Commented:
What is UWP? Yes, those are internal software, that's why they are unsigned.
CERTIFIED EXPERT

Commented:
UWP is the new WINDOWS 10 apps (not windows forms).

Author

Commented:
Those are windows forms applications.
CERTIFIED EXPERT
Commented:
habve a lok at this information
there you have 2 options for monitoring the registry , those should aide you in finding out what or why are those keys being removed.

Author

Commented:
thanks, it looks like auditpol is a built-in Windows utility... This seems a good idea, but it takes time. And if it's Defender, then what?
CERTIFIED EXPERT

Commented:
then you should add an exclusion to defender for each of those apps.
https://winaero.com/blog/exclusions-windows-defender-windows-10/

Author

Commented:
If I add an exclusion as "Process" - "any file used by this process won't be scanned by Windows Defender" - would this protect the process's registry entries? Maybe so, because Defender won't scan the executable (presumably) to find if it is signed or not (?)

Author

Commented:
Most excellent help. Thank you.
CERTIFIED EXPERT

Commented:
At the end how did you solve it? so others can benefit from your solution.

Author

Commented:
Not yet solved. It may take some time.
I have excluded those in Defender. However, once a week or so, rebooting would still result in the same items missing, probably by scheduled OS cleanup involving Defender.

But, not with the last week's cleanup. Now those items persisted. Maybe Windows updates made some amends to the cleanup code. Or maybe they'll be missing after rebooting some other time. We'll see.