>

List Startup Programs with Win32_StartupCommand

Enumerate autostart entries from Run keys and Startup folders — a forgotten WMI class for spotting unwanted startup software.

WindowswmistartuppowershellLow risk
Run Get-CimInstance Win32_StartupCommand | Select Name, Command, Location, User to list every user startup entry and where it is defined.

01Command

Command
$ Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User | Format-Table -AutoSize -Wrap

02What it does

Task Manager's Startup tab shows a curated subset; Win32_StartupCommand walks the per-user Run/RunOnce keys, the HKLM equivalents, and both Startup folders in one query, with the Location column telling you exactly which key or folder to clean. It does not cover services or scheduled tasks — pair it with Get-ScheduledTask and Get-Service for the full picture. This is also a fast first pass when hunting persistence after a suspicious install.

03Risk

RiskLow risk

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Win32_StartupCommand class
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Describes the Name, Command, Location, and User properties of startup entries.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17
Zip Files with Compress-Archive
WindowsZip & Archivesarchivepowershell

Create or update a .zip from any files or folder contents straight from PowerShell.

Low risk ✓ 2026-09-17
Test a TCP port connection on Windows with Test-NetConnection
Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17