Boot
Native programs the session manager runs very early at boot, before most services.
Use it to find a native program set to run at boot before services start, beside the default disk check.
- SYSTEM
- Persistence
What It Is
BootExecute lists the native applications that the Session Manager runs very early during startup, before most services load. Its default value, autocheck autochk *, runs Autochk to check the integrity of the file system on any disk flagged as dirty. The value is stored under the Session Manager key in HKLM SYSTEM under CurrentControlSet\Control. Microsoft advises against deleting the default value.
What It Proves
A program listed in BootExecute is run by smss.exe during boot, before the Win32 subsystem and services start. Treat an extra entry as serious, because native code there runs early, with high privilege.
What It Does Not Prove
The normal value is autocheck autochk star, so extra entries stand out. It shows what is set, not a record that it ran.
Where It Lives
BootExecute lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| BootExecute holds only the default disk check, which smss runs at boot. A program other than autochk, or an odd autochk path, would stand out. |
| SetupExecute is empty, as expected outside an upgrade. With BootExecuteNoPnpSync absent too, autochk is the only program these lists run. |
How to Read It
Read BootExecute in the Session Manager key, where the default is a single autocheck line. Treat any program other than autochk, or an autochk pointed at an odd path, as suspect. Check BootExecuteNoPnpSync and SetupExecute in the same key as well.
- When Windows Writes It
- When the value is changed, usually by an attacker with admin rights.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Defender records these writes within retention and keeps the previous data, so you can see what was added. A hit shows the list changing, not the program running at boot.
// Changes to the BootExecute valueDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what BootExecute shows.
- Last Shutdown TimeShows whether Windows shut down after the change, because the list runs only at the next boot.
Sources
The facts on this page come from these public pages, which say more on each point.