question

SvnhiDurga-3665 avatar image
0 Votes"
SvnhiDurga-3665 asked SvnhiDurga-3665 commented

How can we extract startup UWP applications?

I am using C++ code base to develop a forensic tool. The requirement is to display all the startup applications. However UWP apps which are enabled to run at startup, are not found in RegEdit at "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" or any other paths which have startup applications info.

If I have to write a code to extract Startup applications like Cortana,Skype,Spotify etc (UWP apps) from registry or windows folders, how do I do it?
Is there any path where UWP startup applications are stored?

Note:

This is continuation question to :

https://answers.microsoft.com/en-us/windows/forum/windows_10-start-win_general/startup-apllications-in-windows-10/0b895da7-fa49-4a4d-816f-0adb3445fc74?messageId=1c952cf4-85f4-4bc2-bb21-5d4a7f1c9035

c++
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

If I understand you correctly, you are developing a win32 app using C++, not a UWP app, right? Then you want to list all the startup applications include UWP apps. Is that correct?

0 Votes 0 ·

Yes, its not UWP app. Its a C++,MFC based forensic tool. One of the feature is to display all the startup applications. I am able to display most of the Startup applications except UWP apps as I am not able to find them in registry that easily.

0 Votes 0 ·
JeanineZhang-MSFT avatar image
1 Vote"
JeanineZhang-MSFT answered SvnhiDurga-3665 commented

Hi,

I suggest you could try to use the Windows.Management.Deployment APIs.

1,Enumerate installed packages by PackageManager.FindPackagesForUserWithPackageType

2,Use GetPackageApplicationIds to get the IDs of apps in the specified package.

3,Use StartupTask.GetAsync to get a startup task by Id.

I suggest you could refer to the sample: Enumerate app packages

Best Regards,

Jeanine



If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for the answer @JeanineZhang-MSFT

0 Votes 0 ·
Castorix31 avatar image
0 Votes"
Castorix31 answered SvnhiDurga-3665 commented
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you @Castorix31 for the link.

From the thread, I got how to manage startup items of UWP apps.
So, If I have Skype, then its path is
HKCU\Software\Classes\LocalSettings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.SkypeApp_kzf8qxf38zg5c\SkypeStartup\State=2(dword)

By considering that UWP apps will have state value as '2' when they are enabled as Startup, then if I want to find all such UWP apps, there are lot of Subkeys in the registry to browse through only to find 2 to 3 results.
Its a complicated and costly operation for my forensic tool (Displaying Startup applications is one small feature in this tool)
So just wanted to know if there is any path which stores UWP apps Startup information which is not so complicated and easy to retrieve.

0 Votes 0 ·