Paste the tool first
terminal / powershell
function Get-StartupApproval { # name of Run value
param([Parameter(Mandatory)] [string] $Name)
$blob = (Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run' -Name $Name -ErrorAction SilentlyContinue).$Name
if (-not $blob) { return [pscustomobject]@{ Name=$Name; State='Enabled (no blob)'; When=$null; Bytes=$null } }
if ($blob.Length -lt 12) { return [pscustomobject]@{ Name=$Name; State='Unknown (short blob)'; When=$null; Bytes=($blob|%{"{0:X2}" -f $_}) -join ' ' } }
[pscustomobject]@{
Name = $Name
State = switch ($blob[0]) { 2 {'Enabled'} 3 {'Disabled'} default {'Unrecognized'} }
When = [DateTime]::FromFileTimeUtc([BitConverter]::ToInt64($blob[4..11],0)).ToLocalTime()
}
}terminal / powershell
Get-StartupApproval OneDrive
Get-StartupApproval 'Steam Client Bootstrapper'Design notes (the why-behind-the-what)
- Short-blob tolerance is the scandal-free path: installers write 4/8-byte stubs; assuming 12 bytes is how decoders crash exactly when the user's problem is the weird one (see the blob spec post).
Whenis powerful in diff idioms: run the snapshot before changing apps, run again after; the timestamp answers “who flipped this” without you remembering whether it was you.- Nulls everywhere: missing entry, short entry, zero FILETIME — each renders distinctly so logs don't lie by formatting silence.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.
