The script
terminal / powershell
$run = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
$apr = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run' -ErrorAction SilentlyContinue
$rows = foreach ($p in $run.PSObject.Properties) {
if ($p.Name -like 'PS*') { continue } # drop PS metadata props
$blob = $apr.$($p.Name) # 12-byte approval, may be absent
[pscustomobject]@{
Name = $p.Name
Command = $p.Value
State = if (-not $blob) { 'Enabled(unmarked)' }
elseif ($blob.Length -lt 12) { 'Unknown (short blob)' }
elseif ($blob[0] -eq 2) { 'Enabled' }
elseif ($blob[0] -eq 3) { 'Disabled' }
else { 'Unrecognized' }
}
}
$rows | Export-Csv "$env:USERPROFILE\Desktop\startup-inventory.csv" -NoTypeInformationWhy baseline-first pays
- Diffable: run it weekly or before/after installing a suspect app;
Compare-Objectshows entries anything added. - Paste as evidence: a CSV line beats recounting a UI row from memory on a support call.
- No write, at all: every command above is read-only. Safe on production images, an instructor machine, whatever you care to name.
The whole exercise takes under a second on a stock system and answers the expensive question — What did this machine *exactly* launch last week? — every time.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.