Windows 10 & limited account – edit startup programs

 

How does one go about enabling and disabling startup items in Windows 8 onwards? Very simple. You open the task manager, click on the right tab, and then enable/disable items as you see fit. However, this is not the case if you run a limited account that does not have administrative privileges by default.

In this guide, I would like to show you several convenient methods how you can selectively enable/disable startup programs if you are running a limited account in Windows 10 without having to actually log into an (the) administrator user. Let us.

Teaser

Startup items

As I’ve briefly mentioned earlier, the old msconfig utility has been deprecated, replaced with a tab inside the Task Manager program. Click on the Startup tab, you will have the list of all programs enabled to run when your system boots. Of course, it gets a little more complicated than that, because there are multiple ways you can enable programs to run in Windows, including things and options like scheduled tasks, run, run once, startup folder, and more. But, for now, let’s focus on the task manager.

Task manager, list of programs

If you’re running an admin account, you just need to select an entry and then either enable or disable it. With a limited account in place, which is a healthy security practice you may want to consider, this functionality will be disabled.

Attempt to solve

As a solution, you may want to run the task manager as an admin. Right-click, run as administrator. If you have an administrator account active on your system, which you should if you opt for the limited user approach, then you will now be asked to provide the correct password. This will launch the task manager with the full privileges, but the startup list may actually be empty.

Task manager, empty

You may wonder why. And the reason is, you will be looking at the startup list for your particular user, rather than the global list, which is normally displayed. If you have not installed any programs ONLY for the current user, this list will be empty.

Let’s briefly look at the registry through regedit to understand this in more detail. The registry, of course, stores all the necessary information, so you can always consult it if things do not look right through this or that programs. Startup items that you see in the task manager are listed in two locations. For your current user:

HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersion
ExplorerStartupApprovedRun

The global list:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion
ExplorerStartupApprovedRun

The first list will only have things for your existing user – if no program is specific to just this particular user, it will be empty. The second location will have everything, but you must have the necessary credentials to edit it. Catch 22, and the reason for this article.

Regedit, startup items

Disable programs, method 1: Registry

Now, how do we disable startup items, OTHER than logging into the admin account. The most straightforward option is, run regedit as admin and then either delete the entry you do not want, or change the binary data. What you want is a bunch of zeros. Not the best way of doing it.

Reg data values

Disable programs, method 2: SuRun

This is an interesting one. If you recall my tutorial on this topic, SuRun is an unofficial sudo-like mechanism for Windows. It has worked great in Windows XP, but it also has its merits in Windows 7 and Windows 10. I’ve been using it alongside the standard Windows prompts and tools, and everything seems to be in perfect order. Now, this program does let you execute applications with elevated privileges, both in and outside the context of the current user. This is neat, because it will let you launch the task manager with the correct credentials, allowing you to make the necessary changes.

Start as, SuRun option

Disable item

Conclusion

I believe this article is useful. Not specifically because it helps you solve a rather trivial issue, but because it highlights the merits of using a limited account and using SuRun, as it allows you to have the full admin control without cumbersome and frequent logoff and logon operations, which break the normal flow and usage model.

This way, you have the best of all worlds, and you can use whichever tool or mechanism offers the most convenience plus the added benefit of security that comes from using a non-admin account by default. It has nothing to do with the wider Internet scare and all that. Pure and simple, it’s just best practices, and it’s been around in the UNIX/Linux world for the past billion years. Windows is catching up, and the practicality is 90% there. For those corner cases, like the startup items, go figure, you can use the tips and tricks listed here to work around the problem, without any work disruptions.

Source