C:\Windows\System32\GroupPolicy\User\Scripts\Logon C:\Windows\System32\GroupPolicy\Machine\Scripts\Logon C:\Windows\System32\GroupPolicy\User\Scripts\Logoff C:\Windows\System32\GroupPolicy\Machine\Scripts\Logoff HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce (only when members of the Administrators group log on after the reboot) RunOnce are deleted before (or after, if prefixed with a !) the command is run. *).