As applications and background services accumulate on a Windows 11 machine, boot times can steadily degrade, and unnecessary background processes consume system memory and CPU cycles. While Task Manager provides an interactive user interface to view and disable startup applications, IT administrators, system engineers, and power users often require automated, auditable, and scriptable methods to inspect software configured to launch at login.
PowerShell provides deep visibility into Windows startup locations across WMI/CIM repositories, registry hives, and system startup directories. This guide demonstrates how to query, audit, and export startup applications in Windows 11 using PowerShell cmdlets.
Why Audit Windows Startup Applications via PowerShell?
Auditing auto-start extensibility points (ASEPs) via PowerShell provides several distinct benefits over standard graphical tools:
- Comprehensive Visibility: Applications register for startup across diverse locations, including the 64-bit and 32-bit (WoW64) registry Run keys, user startup folders, and system-wide task triggers. PowerShell can query all these targets concurrently.
- Remote Fleet Inspection: Using PowerShell Remoting (
Invoke-Command), administrators can audit startup software on remote enterprise endpoints without interrupting active user sessions. - Security and Malware Forensics: Malicious persistence mechanisms frequently establish footholds within startup registry entries. Querying hashes and command paths enables immediate detection of unauthorised binaries.
- Automated Compliance Reporting: Results can be converted directly into CSV, JSON, or HTML formats for system documentation and compliance audits.
Step 1: Open PowerShell with Administrative Privileges
While basic user registry keys can be queried without elevation, inspecting system-wide startup entries and WMI objects requires administrative access:
- Right-click the Start button on your Windows 11 taskbar (or press Win + X).
- Select Terminal (Admin) or PowerShell (Admin).
- Click Yes when prompted by the User Account Control (UAC) security dialogue.
Step 2: Query Startup Applications Using Get-CimInstance
The Common Information Model (CIM) repository provides a unified representation of applications registered to start during user logon:
Get-CimInstance -ClassName Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-Table -AutoSizeThis command returns four critical attributes:
- Name: The friendly name or identifier of the startup programme.
- Command: The exact executable path, binary parameters, and runtime switches.
- Location: The source origin (such as
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunorStartupfolder). - User: The scope of the trigger (such as
All Users,NT AUTHORITY\SYSTEM, or a specific local user account).
Step 3: Audit Windows Registry Run Keys Directly
Software developers frequently place persistence entries directly into registry Run and RunOnce keys. You can inspect these keys across both current user and local machine hives.
Query Current User Startup Keys
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" |
Select-Object -Property * -ExcludeProperty PSPath, PSParentPath, PSChildName, PSDrive, PSProvider |
Format-ListQuery Machine-Wide (All Users) Startup Keys
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" |
Select-Object -Property * -ExcludeProperty PSPath, PSParentPath, PSChildName, PSDrive, PSProvider |
Format-ListQuery 32-bit Compatibility (WoW6432Node) Keys
Older or 32-bit legacy programmes running on 64-bit Windows 11 write to redirected registry nodes:
Get-ItemProperty -Path "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" |
Select-Object -Property * -ExcludeProperty PSPath, PSParentPath, PSChildName, PSDrive, PSProvider |
Format-ListStep 4: Audit Physical Startup Folders
Windows maintains two physical folder locations containing shortcuts (.lnk files) or scripts that execute automatically upon user login:
- Current User Startup Directory:
$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup - All Users Startup Directory:
$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Query both directories in a single pipeline:
Get-ChildItem -Path @(
"$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
"$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
) -File | Select-Object Name, Length, LastWriteTime, DirectoryName | Format-Table -AutoSizeStep 5: Run a Comprehensive Audit Script and Export to CSV
To aggregate all startup commands into a single structured report and export it to a clean CSV spreadsheet for security auditing, execute the following PowerShell script:
$Results = Get-CimInstance -ClassName Win32_StartupCommand | ForEach-Object {
[PSCustomObject]@{
ApplicationName = $_.Name
ExecutablePath = $_.Command
RegistryOrigin = $_.Location
TargetUser = $_.User
DetectionDate = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
}
}
$ExportPath = "$env:USERPROFILE\Desktop\Startup_Audit_Report.csv"
$Results | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding utf8
Write-Host "Audit completed successfully. Report saved to: $ExportPath" -ForegroundColor GreenStep 6: How to Remove or Disable an Unwanted Startup Registry Key
If you identify an unauthorised or obsolete startup binary during your audit, you can delete its registry entry directly via PowerShell:
# Remove from Current User
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "ExampleApp" -ErrorAction SilentlyContinue
# Remove from Local Machine (requires Administrator privileges)
Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "ExampleApp" -ErrorAction SilentlyContinueNote: Always export a backup of the registry key using Export-Clixml or reg export before removing property values.
Troubleshooting Common PowerShell Startup Queries
Get-CimInstance Win32_StartupCommand Returns Incomplete Results
In certain corporate environments governed by strict security policies, WMI repository access might be restricted or corrupted. If Get-CimInstance returns an empty list or errors out, use the direct registry and folder inspection methods shown in Steps 3 and 4, which access filesystem and registry providers independently of WMI.
Command String Truncated in Console Output
If long executable paths with intricate argument flags appear truncated with ellipses (...), pipe the output into Format-Table -Wrap or Out-GridView to inspect the complete unclipped string:
Get-CimInstance -ClassName Win32_StartupCommand | Out-GridView -Title "Startup Applications Audit"Frequently Asked Questions
Does Win32_StartupCommand include Windows Services?
No. Win32_StartupCommand only tracks applications configured to start during interactive user login sessions. To audit background services that launch during system boot prior to login, use the Get-Service cmdlet and filter for StartType -eq 'Automatic'.
Can I disable a startup item without deleting its registry key?
Yes. Windows Task Manager achieves this by moving the disabled item to the HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run key. In PowerShell, you can mirror this behaviour or simply prefix the command path with a dummy remark to disable execution while preserving the parameter string.
How can I check the file hash of a startup executable?
To verify whether a startup binary has been tampered with, extract its file path and run Get-FileHash -Path "C:\Path\To\binary.exe" -Algorithm SHA256 to generate its cryptographic checksum for malware analysis.