Retrieve the properties of startup apps

Hello,

i am trying to retrieve the Status and CPU at start-up of the startup apps using BigFix relevance, - i am not able to find the right class where from this property can be exploited. is there any other way to get this information

You can start from below but you might need to run some scripts to populate all type of data, not everything available by default.

Q: select objects "* from Win32_StartupCommand" of wmi

A: %0ainstance of Win32_StartupCommand%0a{%0a%09Caption = "com.squirrel.Teams.Teams";%0a%09Command = "C:\\Program Files (x86)\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"";%0a%09Description = "com.squirrel.Teams.Teams";%0a%09Location = "HKU\\S-1-5-18\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";%0a%09Name = "com.squirrel.Teams.Teams";%0a%09User = "NT AUTHORITY\\SYSTEM";%0a%09UserSID = "S-1-5-18";%0a};%0a`

Q: (string value of property "name" of it, string value of property "location" of it) of select objects "* from Win32_StartupCommand" of wmi
A: com.squirrel.Teams.Teams, HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Thanks for the reply. I can see the Win32_StartupCommand class has only the following Properties.

[Dynamic, Provider(“CIMWin32”), Privileges(“SeRestorePrivilege”), UUID(“{8502C50A-5FBB-11D2-AAC1-006008C78BC7}”), AMENDMENT]
class Win32_StartupCommand : CIM_Setting
{
** string Caption;**
** string Description;**
** string SettingID;**
** string Command;**
** string Location;**
** string Name;**
** string User;**
** string UserSID;**
};

I cannot see any property or method related to status , start-up type and CPU at start-up.

Yes, that’s what I meant to say. There isn’t much available by default (no direct inspector or single WMI query), so you might need to work with your Windows team to find out more information and create a custom script to gather and combine various items.