finding automatic procedure ran on startup

[warby1212]

HI, I'm an DB application programmer in an IT dept and every few weeks I come to work and some of the registry values are overwritten, restricting various bits like the wallpaper etc. It drives me crazy ! I can't find how it is being initialised. The Operations people say it's not them. I'm thinking a pre-programmed task is running and doing it somehow but I can't find it. My question is, as Windows starts, at what point does it look for any outside configurations, scripts etc and where might they be hiding? It's not a "Scheduled Task". There must be something that writes to the registry or downloads from the network. Any ideas?

Cheers Stephen

I should write something here.

 

[warby1212]

Ps. It's definitely not being done by an overt Group Policy action.

I should write something here.

 

[Frank4d]

Starup scripts can be hidden here, and can be run on the local PC or networked computer:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts

 

[warby1212]

Thanks Frank4d, I've had a good look on my local computer in those spots and the clues they give but no luck as yet

Cheers Stephen

I should write something here.