HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
can be used to enable or disable the corresponding values under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
. 02 00 00 …
or 06 00 00 …
seems to indicate that the entry is enabled, all(?) other values that it is disabled. (Possibly, in the case of disabledness, the value is the timestamp of the disabling). taskmgr.exe
. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
.