HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
contains a user's autostart entries, i. e. the commands that will be run each time a user logs on (not at boot time). $null = new-itemProperty -path HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -name 'Windows Terminal' -value '%localappdata%\Microsoft\WindowsApps\wt.exe'
Autorun
in HKEY_CURRENT_USER\Software\Microsoft\Command Processor
and the corresponding key under HKEY_LOCAL_MACHINE
. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
is %SYSTEMROOT%\System32\SecurityHealthService.exe
.