Startup Folder on Windows 10, Windows 11, Windows Server 2019

1. One Startup folder that operates at the system level and is shared among all user accounts
2. Another Startup folder that operates at the user level and is unique to each user on the system

The All Users Startup folder is found in the following path:
C:\ProgramData\Microsoft\WindowsStart Menu\Programs\StartUp

To access the “All Users” Startup folder in Windows 10, open the Run dialog box (Windows Key + R), type shell:common startup

The Current User Startup folder is located here:
C:\Users[User Name]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

For the “Current User“ Startup folder, open the Run dialog and type shell:startup rather shell:common startup

Locating Windows Startup Folder Programs from Command Prompt

wmic startup get caption,command

Locating Startup Programs in Registry

To access it, press WIN+R and type REGEDIT and go to:

“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run”

The startup folder path for the current user is C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.

The following run keys are created by default on Windows systems:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Run keys may exist under multiple hives. The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. ^[4] For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" ^[5]

The following Registry keys can be used to set startup folder items for persistence:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

The following Registry keys can control automatic startup of services during boot:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

In Windows environment, each user is assigned a unique identifier called Security ID or SID, which is used to control access to various resources like Files, Registry keys, network shares etc. We can obtain SID of a user through WMIC USERACCOUNT command. Below you can find syntax and examples for the same.

Get SID of a local user

wmic useraccount where name='username' get sid

For example, to get the SID for a local user with the login name  ‘KARL, the command would be as below

wmic useraccount where name='KARL' get sid

Get SID for current logged in user

To retrieve the SID for current logged in user we can run the below command. This does not require you to specify the user name in the command. This can be used in batch files which may be executed from different user accounts.

wmic useraccount where name='%username%' get sid

Get SID for current logged in domain user

Run the command ‘whoami /user’ from command line to get the SID for the logged in user.
Example:

c:\>whoami /user
USER INFORMATION
----------------
User Name      SID
============== ==============================================
mydomain\wincmd S-1-5-21-7375663-6890924511-1272660413-2944159
c:\>

Get SID for the local administrator of the computer

wmic useraccount where (name='administrator' and domain='%computername%') get name,sid

Get SID for the domain administrator

wmic useraccount where (name='administrator' and domain='%userdomain%') get name,sid

Find username from a SID
Now this is tip is to find the user account when you have a SID. One of the readers of this post had this usecase and he figured out the command himself with the help of the commands given above. Adding the same here.

wmic useraccount where sid='S-1-5-21-1471586919-1128665872-1817863081-504' get name

If Thunderbird is specified as your system's default email application, it will integrate with other applications (such as word processors and web browsers). For example, when you click an email address link (like "This email address is being protected from spambots. You need JavaScript enabled to view it.") on a web page or invoke a mail function (such as "Send to") from a word processor, Thunderbird will launch and open a message composition window.

Force Thunderbird to check if it is the default

Thunderbird can be configured to check if it is the operating system's default mail client each time it is started.

1. At the top of the Thunderbird window, click the Tools menu and select Options, or click the menu button  and choose Options.
2. On the Advanced panel, select the General tab.
3. Make sure that "Always check to see if Thunderbird is the default mail client on startup" is checked.
4. Click Check Now to check if Thunderbird is set as the default mail client immediately.

• If you want to set Thunderbird as the default client for e-mail, newsgroups or feeds, check the corresponding boxes and click OK. When a box is grayed out, Thunderbird is already set as the default client for that purpose.
• If you set Thunderbird to be the default mail client, other applications (such as your web browser or word processing application) may need to be restarted for the changes to take effect.

Set Thunderbird as the operating system default

Set Thunderbird as an application default

In some cases (such as Firefox on KDE Linux), the application doesn't check the operating system preferences to determine the default email application. When that is the case, you must set the default in the application itself. Refer to the application documentation for instructions.