Windows OS Optimization Essentials Part 1 - Active Setup

This blog series introduces you to Microsoft Windows® Operating System (OS) optimizations, starting with version 1903. I will attempt to keep these optimizations as environment agnostic as possible. Hopefully, these optimizations will be just as good to administrators of physical machines as to a virtual environment utilizing Nutanix® Frame, Citrix®, or VMware® Horizon solutions.

This series aims to share the seemingly infinite number of ways you can optimize a Windows environment, with something for beginners as well as administrators familiar with optimizations but looking to deliver an even better experience within your environment.

Of course the optimizations provided in this blog series are intended only as a guide. Be sure to test the optimizations described in this series internally before pushing the changes to your production environment.

This installment addresses Active Setup: its purpose, how it works, and what can be done with it. This particular area of the OS is criminally underused as a method of optimization. As such, it should provide useful information to a wide range of readers.

Future blogs will discuss, in detail, how to optimize your Windows OS environment through Microsoft Store, Services, and Scheduled Tasks.

What is Active Setup?​

Active Setup is a method for executing commands once per user, early during the login process. Active Setup commands are run before the desktop appears. While these commands run synchronously, they block login until the commands are executed.

Note that while Run and RunOnce registry entries work in a very similar fashion, they are run after the user’s desktop appears and therefore, while they can still be optimized and don’t lengthen the user’s login time. We will return to Run and RunOnce registry entries in a later post.

How does Active Setup work?​

Active Setup is used by OS components and applications to set up an initial configuration for new users at their first login. Active Setup utilizes both machine and user specific data, which means it contains information that exists both in a central location on the machine as well as a location that is specific to each user. This information is a combination of files and registry keys and values that are utilized when Active Setup has an executable to run. The files are the locations of the executables while the registry keys and values are what is used to deduce when it should run. For the purposes of this blog we will be focusing on when it should run.

When a user logs in for the first time, Active Setup compares the user-specific registry locations HKCU\Software\Microsoft\Active Setup\Installed Components and HKCU\Software\Wow6432Node\Microsoft\Active Setup\Installed Components against the mirroring machine-specific registry locations in the HKLM hive. If the user-specific data matches the machine-specific data, no executable is run. If there are differences, the machine thinks that those particular Active Setup components have not previously run, at which point it will execute them, then copy those registry keys and values over to the HKCU hive. The next time a user logs in, it notices that the HKCU hive location for Active Setup matches the HKLM hive location and no longer runs those executables.

What does this mean for me?​

With Active Setup, as with most optimizations, there are two scenarios to consider, persistent and non-persistent machines.

Persistent machines contain both a normal physical endpoint scenario, as well as a persistent VDI scenario; it is a one user to one Virtual Machine (VM) usage scenario and the users’ profile grows over time with applications and user data. For a persistent machine scenario, Active Setup works as described in the section above.

Non-persistent machines are almost the exact opposite; the machines return to a default base “Golden Image” level upon reboot and the users’ applications and data are either wiped or kept in alternate locations. This scenario is generally only seen when using VDI and is a many user to one machine usage scenario. This means the Active Setup executes every login, since the user specific data does not exist on any login. Active Setup user-specific data will not exist even using a profile management solution because it runs prior to the users’ profile being added to the scenario. This means that every user login will be longer as those Active Setup processes run, extending the user’s login.

How do I prevent Active Setup from running in my environment?​

As stated above, Active Setup has both machine- and user-specific data. The easiest way to prevent Active Setup from running on a per-user basis is to remove the machine-specific Active Setup registry keys and values, thus preventing the executables from running.

While the files for Active Setup exist in the folder structure of the VM, as stated above, the registry is where Active Setup checks for and runs the executables from. On a 64-bit system, there are multiple places Active Setup can live, listed below:

• HKLM\Software\Microsoft\Active Setup
• HKLM\Software\Wow6432Node\Microsoft\Active Setup
• HKCU\Software\Microsoft\Active Setup
• HKCU\Software\Wow6432Node\Microsoft\Active Setup

Each of these locations, under a default Installed Components key, contains GUID keys, or registry keys that are GUIDs, which reference applications on the system. Inside each of these GUID keys will be a list of values, but the important value to look for is called StubPath. The StubPath value is what is executed against the machine. If there is no Stubpath value, then nothing is executed.

While the instructions below walk you through a manual method for implementing these optimizations, you could utilize Group Policy to implement these optimizations as well. That being said, a domain-joined machine is not necessary for these registry keys and values to exist.

Instructions​

For the purposes of this documentation, we will focus on the HKLM registry hive.

What are the potential downsides to altering Active Setup?​

Active Setup can be utilized by any application developer to perform actions that are necessary for functionality of the application. Editing or removing any files and registry keys and values could prevent the application from running in the intended way. While the Active Setup keys listed in the below section are all safe to optimize in most scenarios, the recommendation is to vet all Active Setup keys to verify the required business purpose of the application is met prior to optimization. Only after the purpose of the Active Setup key is understood should you move forward with optimization.

What to optimize and what not to optimize in Active Setup?​

While all Active Setup keys should be vetted for purpose and functionality within an environment, all Active Setup keys that come built into the Windows OS can be optimized in a VDI environment. A list of these Active Setup keys, and the PowerShell command to optimize them, is listed below:

Windows 10 OS​

The below keys exist on all newer versions of Windows 10 (1903+).

• HKLM:\Software\Microsoft\Active Setup\Installed Components{2C7339CF-2B09-4501-B3F3-F3508C9228ED}
• HKLM:\Software\Microsoft\Active Setup\Installed Components{6BF52A52-394A-11d3-B153-00C04F79FAA6}
• HKLM:\Software\Microsoft\Active Setup\Installed Components{89820200-ECBD-11cf-8B85-00AA005B4340}
• HKLM:\Software\Microsoft\Active Setup\Installed Components{89820200-ECBD-11cf-8B85-00AA005B4383}
• HKLM:\Software\Microsoft\Active Setup\Installed Components{89B4C1CD-B018-4511-B0A1-5476DBF70820}
• HKLM:\Software\Microsoft\Active Setup\Installed Components{22d6f312-b0f6-11d0-94ab-0080c74c7e95}
• HKLM:\Software\Wow6432Node\Microsoft\Active Setup\Installed Components{44BBA840-CC51-11CF-AAFA-00AA00B6015C}
• HKLM:\Software\Wow6432Node\Microsoft\Active Setup\Installed Components{6BF52A52-394A-11d3-B153-00C04F79FAA6}
• HKLM:\Software\Wow6432Node\Microsoft\Active Setup\Installed Components{89B4C1CD-B018-4511-B0A1-5476DBF70820}
• HKLM:\Software\Wow6432Node\Microsoft\Active Setup\Installed Components{22d6f312-b0f6-11d0-94ab-0080c74c7e95}

Windows Server OS​

In addition to the keys denoted above, the below keys exist for most newer versions of Windows Server (2016+).

• HKLM:\Software\Microsoft\Active Setup\Installed Components{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}
• HKLM:\Software\Microsoft\Active Setup\Installed Components{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}
• HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components{44BBA840-CC51-11CF-AAFA-00AA00B6015C}

PowerShell command template to remove StubPath value:

Remove -ItemProperty -Path "HKLM:[Installed Components Location]\[GUID]" -Name "StubPath"

For example:

Remove -ItemProperty -Path "HKLM:\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}" -Name "StubPath"

What’s next?​

This document covers Active Setup as it relates to operating system optimization, but Active Setup can be used by any developer as part of their application. Consequently, we recommend checking all Active Setup locations, either periodically or after each application installation to verify new entries have or have not been added. If they have, vet them for purpose, and then remove or keep them as needed.

The next blog post will discuss Microsoft Store items within Windows 10, including how to see what's installed, how to go about removing the items, and what types of benefits you can see by doing so. If you need assistance in optimizing your VDI or DaaS images, check out our Xpert Services Template Image Creation and Optimization service.