When writing some scripts I wanted to slip in a reboot in the middle but I didn’t know how to run stuff after the reboot. The RunOnce command seemed like a logical step and I finally was able to use it in a script that will reinstall our AV software, but I also learned a lot of caveats about it as well.

LANDESK Antivirus can be installed with two simple commands: vulscan.exe /installav and /removeav. Here is my simple script to uninstall, reboot, and reinstall LDAV:

REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v InstallAV /d "\"C:\Program Files\LANDesk\LDClient\vulscan.exe\" /installav /showui" /f
"%LDMS_LOCAL_DIR%\..\vulscan.exe" /removeav /showui /noreboot
shutdown -r -t 0

Here are the things I learned:

  1. RunOnce doesn’t like environment variables in the key values, so this will not work: RunOnce1
  2. RunOnce doesn’t like the tricky stuff you can do in CMD. The vulscan.exe file is one directory above the LDMS_LOCAL_DIR env variable but you can’t use C:\Program Files\LANDesk\LDClient\Data\..\vulscan.exe in the registry key value. RunOnce2
  3. Using REG ADD will expand the environment variables before creating the registry key. That’s probably a CMD thing that I should have known about but I relearned it anyways.