I am currently facing a dilemma. Somewhere on our network at work there is a batch file, a script, something that runs and is overwriting part of the HKEY current user registry for a piece of software that we use. We have updated our version of this software so this script is making it difficult for users to use the software and I have to manually change the registry value every day for certain users.

We have a new script that should be overwriting the value every time they startup but sometimes the new script runs before the old one and the old value is being written.

I have looked everywhere and simply cannot find it, not even sure what to look for. Is there a way to detect what scripts / batch files are running on startup? I have checked the startup folder for each user/computer, including on our server. I've checked every network drive.

We are currently using Windows 7 Professional.

Any tips?


  • 1
    Windows 7 what? Home Premium? Professional? Enterprise? – InterLinked Jun 19 '17 at 12:31
  • 1
    sorry, professional – Azuraith Jun 19 '17 at 12:35
  • 1
    Script running on startup or logon? Two very different scenarios – InterLinked Jun 19 '17 at 12:45
  • 3
    Go to MSCONFIG. In startup Tab can you see any script .bat file in startup. If there remove it. Are sure whether the script is coming from network. Remove the network cable and restart once check the registry is edited again. – Techie Gossip Jun 19 '17 at 12:45
  1. If the computers in question are on a domain, make sure there are no scripts located in \\domaincontroller\sysvol\domainname\Policies\{PolicyGUID}\User\Scripts\ that would overwrite what you have described. If the culprit is here, make sure this new script runs after the script that is causing the problem, or remove what is causing the problem if it's not needed. You don't need domain admin rights to these scripts, but you do need domain admin rights to modify them, which is usually done indirectly. Run NETDOM QUERY /D:MyDomain DC in Command Prompt if you don't know the names of your domain's domain controllers.
  2. Check Task Scheduler Logon/Startup scripts for the user and the system.
  • 2
    THIS WAS THE ANSWER! Thank you good sir! It was in the \\domaincontroller\sysvol\domainname\Policies\{PolicyGUID}\User\Scripts\ location! – Azuraith Jun 19 '17 at 12:54

You can use one of Microsoft Sysinternals utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys.

Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Read More OR Download directly from Microsoft website

NOTE: Run this tool as administrator because some scripts are running with SYSTEM privileges and this tool require Administrator privileges to grab details about that specific task/service.


You can try AVZ tool from Kaspersky Lab.


Link to download: http://media.kaspersky.com/utilities/ConsumerUtilities/avz4.zip

Under Service menu you can find many usefull tools. enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.