Baby Lesher

Quirks of Run and RunOnce

This material originally appeared in the November 1998 issue of Windows Developer's Journal (copyright 1998 Miller Freeman Inc.) and is reproduced here with permission of the publisher.

HKEY_LOCAL_MACHINE
  \Software
    \Microsoft
      \Windows
        \CurrentVersion

Every time a user logs in to the machine, Windows enumerates all values stored under "Run" and "RunOnce" and treats each value's data as a command. During login, Windows executes all commands listed under "Run". Windows also executes commands listed under "RunOnce", but deletes each registry value, so the command will not execute again during subsequent logins. You can use these keys to automate tasks during user login or to replace files that were in use during a previous session. However, there are a few quirks programmers should know about to avoid potential problems:

• Windows executes "RunOnce" commands synchronously. In other words, the operating system waits until each command is finished before executing the next command. On the other hand, Windows executes commands listed under "Run" asynchronously (all at once).
• Windows will process commands listed in either "Default" or named values under "Run" and "RunOnce", but not values contained in subkeys of "Run" and "RunOnce".
• While enumerating values, Windows attempts to read the name of each value into a 32-character buffer. If you insert a value with a name longer than 32 characters (including the terminating NULL), the command will not execute, and in the case of "RunOnce", the value will not be deleted.
• With NT 4.0 security, users must have permission to manipulate registry entries. By default, non-administrator users do not have permission to delete values under "Run" or "RunOnce". This means that "RunOnce" commands will execute every time a regular user logs in because the registry entries cannot be deleted. This continues until the next time a user with suffcient privileges (e.g., an administrator) logs in.
• NT 4.0 calls ShellExecuteEx() to invoke each command, which means you can take advantage of file type associations (e.g., you could execute a .txt file to run Notepad). In contrast, Windows 95 calls CreateProcess(), which does not provide this functionality. Windows 98 uses ShellExecuteEx for "Run" commands and CreateProcess for "RunOnce" commands.

Baby Lesher