Policies Explorer Run
A policy backed run location that starts programs at logon, kept apart from Run.
Use it to find programs set to start at logon through policy, in a run location that a check of the Run keys misses.
- SOFTWARE
- Persistence
What It Is
The Run these programs at user logon Group Policy setting lets an administrator list programs Windows starts automatically when a user signs in, in addition to the standard startup items. Enabling that policy writes the programs into the Policies\Explorer\Run key, kept apart from the ordinary Run key. It can be set per machine in HKLM SOFTWARE or per user in the user's hive.
What It Proves
A value here runs its command at logon, for the machine (HKLM) or the user (HKCU). It is set through policy, so it looks like administration rather than a classic Run key.
What It Does Not Prove
Shows what is set now, not whether it ran or who added it. Values carry no time of their own. The key last write dates the newest change.
Where It Lives
Policies Explorer Run lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The machine has no policy Run key, so no program starts this way for every user. Check the same key in each user's NTUSER |
| alice's hive has no policy Run key either. The logon persistence found on ws-042 sits in the Run keys and Winlogon's Userinit instead. |
How to Read It
Check the key under HKLM and under every user NTUSER.DAT. Each value name is a label, and the data is the command line that runs. A legitimate setting usually arrives through Group Policy, so an ad hoc value is suspect.
- When Windows Writes It
- When policy, a user or an attacker writes a value.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Defender records these writes within retention. It does not tell you whether the command ran.
// Values written to the Policies Explorer Run keyDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Policies Explorer Run shows.
- AmcacheGives the SHA-1 of the program the value starts.
- Process Starts at Logon, Security Event 4688Not in the RegistryShows the command ran at logon, and when.
Sources
The facts on this page come from these public pages, which say more on each point.