StartupApproved

Whether each Run entry and startup item is enabled or disabled in Task Manager.

Use it to see whether a Run entry or Startup item was switched off, so you know if it really starts at logon.

NTUSER.DAT
Persistence

What It Is

The Startup tab of Task Manager and the Settings app let a user enable or disable each program that runs at sign-in. StartupApproved is the key that records that enabled or disabled state for each startup item, so turning an app off leaves its original entry in place but stops it starting. It sits in the user's NTUSER.DAT hive under Explorer\StartupApproved, with a Run subkey for Run-key items.

What It Proves

This key records the enabled or disabled state Task Manager and Settings set for each Run value, Run32 value and Startup folder item. A disabled state here stops an otherwise present autorun.

What It Does Not Prove

It only mirrors the state of entries that exist elsewhere, and it is not itself an autorun location. Values appear only once Task Manager or Settings lists an entry, so a Run entry with no value here still runs.

Where It Lives

StartupApproved lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in StartupApproved, each with what it tells you
Registry Value	What It Tells You
`OneDrive` `REG_BINARY02 00 00 00 00 00 00 00 00 00 00 00`	The genuine OneDrive item is enabled, and 02 with no disable time is the normal state. OneDriveUpdate (odupd.exe) has no entry here, so it still starts at logon.
`Spotify` `REG_BINARY03 00 00 00 80 C8 AF 72 6A 55 DD 01`	Spotify's start at logon was switched off at 6 Oct 2026 08:12 UTC, the time after the leading 03. The same 03 on a security tool would need explaining.

How to Read It

Open Run, Run32 and StartupFolder under StartupApproved, in HKCU and HKLM. Each value matches a Run value or Startup item, and the binary data holds the state and a timestamp. A first byte of 02 or 06 reads as enabled, and 03 as disabled. Treat a disabled defence tool as suspect.

When Windows Writes It: When a user or a program enables or disables a startup item.
Which Windows Versions: Windows 8 to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows the state changing, not the item running. Read the key to see whether it is now enabled.

KQLDefender XDR, Advanced hunting

// Changes to the enabled or disabled state of startup itemsDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey has "StartupApproved"| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what StartupApproved shows.

Run and RunOnce KeysHolds the Run values whose enabled state this key records.
Startup Folder RedirectionShows which folder the Startup items here are read from.
Startup Folder LNK FilesNot in the RegistryLists the Startup items this key enables or disables, each with times of its own.

Sources

The facts on this page come from these public pages, which say more on each point.