drop registry export · detect changes to startup approved keys controlling which startup items are enabled · identify startup items disabled or removed via startup approved registry · surface manipulation of startup item visibility · runs locally
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\ · HKLM equivalent · two snapshots for delta
drop HKCU/HKLM registry export(s) with StartupApproved and Run keys