Jtdylktuy

I have an application that updates software on the local machine. I need the software to be updated prior to user log on, and have read that running the application via the RunServicesOnce registry key is probably the most appropriate to use for this purpose.

But I can't find this key using regedit and it doesn't appear in the same location as the HKLM RunOnce key in HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce.

1. Where is this key located? Same in Windows XP Vista 7 8 8.1 10 ?


2. How do I use it, are there any optional parameters?


3. How do I determine the user that the application is run as? Is it run by the user that created the key? If a LocalSystem service creates the key, will it be run as LocalSystem ?

Where is the RunServicesOnce registry key

I have an application that updates software on the local machine. I
need the software to be updated prior to user log on

Start Program before User Logon Windows 7

If you want it to start before the user logs on, you will have to
start it as a service. Here is the startup sequence of the major
registry keys, starting immediately after bootmgr has been read and
ending with the program shortcut entries in the two Startup folders.

1. HKLMSYSTEMCurrentControlSetControlSession ManagerBootExecute. This can include instructions to schedule the running of chkdsk but
   not user programs.


2. Services start next, followed by the RunServicesOnce and RunServices registry keys (if present)


3. User then logs on to the system


4. HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserInit. This points to the program
   C:WINDOWSsystem32userinit.exe and the entry ends with a comma.
   Other programs can be started from this key by appending them and
   separating them with a comma.


5. HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonShell. This should contain just one entry, explorer.exe.


6. Program entries in these 2 registry keys for ALL USERS start next: HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun and RunOnce


7. Program entries in these 2 registry keys for CURRENT USER start next: HKCUSoftwareMicrosoftWindowsCurrentVersionRun and RunOnce


8. Programs in the Startup Folders of All Users and Current User are started last of all.

Important programs like antivirus and firewall
start early in the sequence as Services. The icons that appear in the
Notification Area (bottom right of the screen) are just their user
interfaces, i.e. options and preferences.

The additional location
for 32-bit software in a 64-bit computer is HKLMSOFTWAREWow6432Node
and HKCU.

The Run Keys and Search-Order

The registry is accessed even before the NT kernel is loaded, so it is
very important to understand what the computer is configured to load
at startup. The following list of registry keys are accessed during
system start in order of their use by the different windows
components:

1. HKLMSYSTEMCurrentControlSetControlSession
   ManagerBootExecute


2. HKLMSystemCurrentControlSetServices (start value of 0 indicates
   kernel drivers, which load before kernel initiation)


3. HKLMSystemCurrentControlSetServices (start value of 2, auto-start
   and 3, manual start via SCM)


4. HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce


5. HKCUSoftwareMicrosoftWindowsCurrentVersionRunServicesOnce


6. HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices


7. HKCUSoftwareMicrosoftWindowsCurrentVersionRunServices


8. HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonNotify


9. HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogonUserinit


10. HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogonShell


11. HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogonShell


12. HKLMSOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad


13. HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce


14. HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnceEx


15. HKLMSoftwareMicrosoftWindowsCurrentVersionRun


16. HKCUSoftwareMicrosoftWindowsCurrentVersionRun


17. HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce


18. HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun


19. HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun


20. HKCUSoftwareMicrosoftWindows NTCurrentVersionWindowsload


21. HKLMSoftwareMicrosoftWindows NTCurrentVersionWindows


22. HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
    (XP, NT, W2k only)


23. HKLMSoftwareMicrosoftWindows
    NTCurrentVersionWindowsAppInit_DLLs

Note: Some of these keys are also reflected under
HKLMSoftwarewow6432node on systems running on a 64bit architecture
and with a 64bit version of Windows. I won’t be covering each of these
in this post.

Run your service as the LocalSystem account unless the account needs to access network resources at which point you'd create a domain service account, give it access to the applicable resources, and then hard-code its credentials for the service to run as. On the local machine, it'll have administrative permissions to everything and not require any password for the service credential.

LocalSystem Account

The LocalSystem account is a predefined local account used by the
service control manager. This account is not recognized by the
security subsystem, so you cannot specify its name in a call to the
LookupAccountName function. It has extensive privileges on the local
computer, and acts as the computer on the network. Its token includes
the NT AUTHORITYSYSTEM and BUILTINAdministrators SIDs; these
accounts have access to most system objects. The name of the account
in all locales is .LocalSystem. The name, LocalSystem or
ComputerNameLocalSystem can also be used. This account does not have
a password. If you specify the LocalSystem account in a call to the
CreateService or ChangeServiceConfig function, any password
information you provide is ignored.