Active Setup

A StubPath command that runs once per user the first time each user logs on.

Use it to find a command set to run once in every user profile at logon, and whether it will run again for a user.

SOFTWARE
Persistence

What It Is

Active Setup runs a command once for each user the first time that user signs in, which installers use to finish per-user setup that a machine-wide install could not complete. When a user signs in, Windows compares the Installed Components entries under HKLM with those under the matching per-user key. If an entry is missing for that user, it runs the command in that entry's StubPath value and copies the entry across. It lives in HKLM SOFTWARE under Microsoft\Active Setup.

What It Proves

The StubPath command under a component runs for a user when that user has no matching entry, or a lower version, under their HKCU Active Setup. It is a reliable way to run code once in every profile.

What It Does Not Prove

It runs once per user, not at every logon, so a missing or older HKCU entry is the trigger rather than a schedule. Many genuine Microsoft components live here, so judge by the StubPath command.

Where It Lives

Active Setup lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Active Setup\Installed Components\<GUID>

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Active Setup, each with what it tells you
Registry Value	What It Tells You
`StubPath (ie4uinit component)` `REG_SZC:\Windows\System32\ie4uinit.exe -UserConfig`	A genuine Windows component runs ie4uinit.exe once per new profile, from System32. A System32 StubPath is expected, so judge any outside it by its command.
`Version (ie4uinit component)` `REG_SZ11,9549,26100,0`	Its Version, 11,9549,26100,0, carries this Windows build. Compare it with alice's HKCU copy, because a lower or missing one runs the StubPath at her next logon.
`StubPath (Windows Media Player)` `REG_EXPAND_SZ%SystemRoot%\system32\unregmp2.exe /FirstLogon`	Windows Media Player's set-up, unregmp2.exe in System32, also runs once per profile. A StubPath outside System32, or a script host, is the one to chase.

How to Read It

List the component GUIDs under HKLM and read each StubPath value. Compare the Version value with the same GUID under HKCU. A missing HKCU entry, or a lower Version there, means it will run. A StubPath pointing at a script host or an odd path is the signal.

When Windows Writes It: When a component is installed or its StubPath or Version is changed.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Defender records these writes within retention. A hit shows a StubPath being set, not that it has run in any profile.

KQLDefender XDR, Advanced hunting

// StubPath writes under Active Setup Installed ComponentsDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey has "Active Setup" and RegistryValueName =~ "StubPath"| project Timestamp, ActionType, RegistryKey, RegistryValueData, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Active Setup shows.

AmcacheGives the SHA-1 of the program StubPath runs.
Process Starts at Logon, Security Event 4688Not in the RegistryShows the StubPath command running at a user's first logon.

Sources

The facts on this page come from these public pages, which say more on each point.