asked on

Startup Items Missing

Undetected application removes startup items that are unsigned on my Windows 10, periodically. My guess, about once a week.

I put them back, then after a while they disappear. Those items are internal software that should have nothing to do with any machine cleanup.

I suspect Defender Cleanup, but cannot be sure about that. Maybe some setting?

Arana (G.P.)

are some items dissapearing or all of them?

..\Users\<<Username>>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
If you delete either your Startup folder or the All Users startup folder, then all items disappear from Task Manager Startup tab (even if all items normally there are from the registry).

campinam

ASKER

Not all items. Only the ones that are unsigned. I used Microsoft's Autoruns utility to make sure about that.

Arana (G.P.)

you have any third party antivirus installed?

are those items totally missing or just unchecked?

Arana (G.P.)

Also are those UWP apps coded by your team?

campinam

ASKER

1. No

2. Items are removed from the Run key in the registry. Then I choose start with windows in each item options to put them back.

campinam

ASKER

What is UWP? Yes, those are internal software, that's why they are unsigned.

Arana (G.P.)

UWP is the new WINDOWS 10 apps (not windows forms).

campinam

ASKER

Those are windows forms applications.

ASKER CERTIFIED SOLUTION

Arana (G.P.)

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

campinam

ASKER

thanks, it looks like auditpol is a built-in Windows utility... This seems a good idea, but it takes time. And if it's Defender, then what?

Arana (G.P.)

then you should add an exclusion to defender for each of those apps.
https://winaero.com/blog/exclusions-windows-defender-windows-10/

campinam

ASKER

If I add an exclusion as "Process" - "any file used by this process won't be scanned by Windows Defender" - would this protect the process's registry entries? Maybe so, because Defender won't scan the executable (presumably) to find if it is signed or not (?)

campinam

ASKER

Most excellent help. Thank you.

Arana (G.P.)

At the end how did you solve it? so others can benefit from your solution.

campinam

ASKER

Not yet solved. It may take some time.

campinam

ASKER

I have excluded those in Defender. However, once a week or so, rebooting would still result in the same items missing, probably by scheduled OS cleanup involving Defender.

But, not with the last week's cleanup. Now those items persisted. Maybe Windows updates made some amends to the cleanup code. Or maybe they'll be missing after rebooting some other time. We'll see.