Autorun: Misconfigured report

[sebouh]

What does this report actually signify? What is actually misconfigured? I have several hunderd computers that are on this report with over 1500 autorun entries each. From where is it pulling the autorun entries? A majority of the entries are in Location "Startup" per the database. How can it be corrected?

Thanks
Sebouh

[taeratrin]

Yes, but...that's odd. I went and double-checked the S-1-5-18 key and now it is empty. Hmm...


Our network is weird.

[Hemoco]

Is the Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders key filled or the affected user (not the S-1-5-18 key)

[taeratrin]

Any word on what might be causing this? The linked article doesn't apply since the regkey value is filled in with a valid path.

[taeratrin]

The folder that the regkey points is empty, but the report lists 2000+. Going to Configuration->Windows->Autorun, I see a list of all the files in the Windows folder. This occurs on about half of our computers.

Edit : Quick question. Do variables (such as {user}) work when defining a regkey to scan?

[Hemoco]

taeratrin wrote:
Edit : Quick question. Do variables (such as {user}) work when defining a regkey to scan?

No

[Hemoco]

How many startus items do you have, and are they "real" startup items?

[taeratrin]

Odd, I had jsut found this report today and was wondering about it, as well. I did some investigation, and found that the regkey in question was pointing to "C:\Documents and Settings\{last user}\Start Menu\Programs\Startup", which does indeed exist. Any ideas?

[Ed_Thibert]

What is this key used for?

[Hemoco]

Ed Thibert wrote:
What is this key used for?

Is this key is not set correctly wmi returns all files in the windows folder as startup items incorrectly