Break Server Core registry to disallow processing of Run and RunOnce entries

By default, when you install Server Core, it is configured to process the Run and RunOnce registry entries during the log on.

You can prevent this behaviour by removing the part of the full command configured at following registry location:

Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Entry Name: Shell
Value: cmd.exe /c “cd /d “%USERPROFILE%” & start cmd.exe /k runonce.exe /AlternateShellStartup”

You need to remove “/k runonce.exe /AleternateShellStartup” from the above value and then restart the system for the changes to take affect.

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top