What is Active Setup?

Active Setup is a Windows feature developed by Microsoft, originally introduced with Internet Explorer 4.0. It is used to ensure that user-specific data and settings are initialized the first time a user logs into a Windows computer. This is especially useful in environments where multiple users log onto the same machine, such as in enterprises or educational institutions.

Original Use Case (Internet Explorer Installation)

When installing Internet Explorer, Active Setup would:

• Collect system information (Windows version, language, hardware, installed components).
• Use that information to determine which files needed to be downloaded.
• Skip components already present on the system, optimizing the download and installation process.

How Active Setup Works

• Machine-wide configuration is stored in:
  HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
• User-specific configuration is stored in:
  HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components

At login:

1. Windows checks for entries in both registry paths.
2. If an entry exists in HKLM but not in HKCU, Windows runs the associated command (usually a setup executable or script).
3. After execution, an entry is added to HKCU to mark that the setup has been applied for that user.

Common Uses

• Creating Start Menu or desktop shortcuts
• Registering COM/ActiveX components
• Copying configuration files into the user’s profile
• Initializing application settings for each user

Advantages

• Automates per-user setup
• Does not require login scripts
• Only runs once per user per component
• Works silently and can be included in enterprise imaging or deployment processes

Security and Maintenance

• Since it runs code at user login, attackers have used Active Setup for persistence by injecting malicious entries into the registry.
• Many organizations now prefer newer methods such as Group Policy Preferences, logon scripts, PowerShell, or modern deployment tools like Microsoft Intune or Configuration Manager (SCCM).

Summary