Can anyone tell me the registry key(s) for applications that have been pinned to the start menu?
I need to these items to help build a profile of user activity from the user assist registry key. It is my understanding that items pinned to the start menu are not added to the counts contained in the application specific entries in the user assist key. I am seeing a lot if web activity but there is no browser listed in this user's user assist key. I am thinking that the browser has been pinned to the start menu and the user is running it from there.
Thoughts?
Thanks …
Try looking here
C\Documents and Settings\{user}\Start Menu\Programs
Remember the UserAssist key is populated by the user's interaction via the shell…if the browser is being launched some other way (ie, Run box, etc.) then the browser entry may not appear.
If the system is XP, try checking the Prefetch directory, too.
Also, one other thought…"web activity" is populated by the use of the WinInet APIs, not specifically the IE browser. I've seen entries put in the web history follow the use of tools such as wget.exe…
HTH
keydet89,
Thanks for the response. I really need to find the registry entries. The start menu folder does not hold the pinned items and pre-fetch is not user specific although it can be very helpful.
Also, items run from the run box do show up in user assist. If the user were to open up a command prompt from the run box and the execute a command from the command prompt THEN it would NOT show up in the user assist key.
Thanks you all the people out there that take the time to share info on this forum.
-m
Thanks for the response. I really need to find the registry entries. The start menu folder does not hold the pinned items and pre-fetch is not user specific although it can be very helpful.
Well, I would suggest using something like RegShot to do a diff on two separate runs of your own NTUSER.DAT. Or you can monitor the Registry with RegMon while you add or remove an entry from the start menu…
Also, items run from the run box do show up in user assist.
True, and also in the RunMRU key.
If the user were to open up a command prompt from the run box and the execute a command from the command prompt THEN it would NOT show up in the user assist key.
Correct. Programs launched via the command prompt are NOT executed via the shell, so therefore do not appear in the UserAssist key.
mhallman
C\Documents and Settings\All Users\Start Menu
The above folder would be the easiest.
I believe the reg keys that you are looking for are here
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\MenuOrder\Start Menu2\Programs
Value Name Order
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\StartPage
Value Name Favorites
Value Name FavoritesResolve
All of those are REG_BINARY values
Chris