Home

StartSet

StartSet is the Windows port of macadmins/outset. It runs scripts and installs packages at boot, at the login window, at user logon, and on demand, from well-known directories under C:\ProgramData\ManagedState, with per-user "once" tracking.

A LocalSystem Windows service (StartSet) watches for the events that fire payloads; a CLI (managedstatekeeper.exe) runs the same execution engine by hand and manages the directories, the ignored-user list, overrides and checksums. Payloads can be .ps1, .cmd, .bat, .exe, .msi or .msix.

The important design difference from outset: on Windows a service lives in session 0, so a "login" payload that runs as SYSTEM cannot touch the signed-in user's registry hive or desktop. StartSet therefore launches user-context payloads into the console session with CreateProcessAsUser, and if it cannot get there it records the payload as Deferred rather than reporting a success it did not achieve. See Windows Session Model.

Quick start

Download startset-x64.zip from the releases page, extract both executables to C:\Program Files\StartSet, then register and start the service from an elevated prompt.

sc.exe create StartSet binPath="C:\Program Files\StartSet\StartSetService.exe" start=auto
sc.exe start StartSet

The service creates every payload directory on first start. Drop a script into login-every and sign out and back in:

Copy-Item .\Set-Wallpaper.ps1 'C:\ProgramData\ManagedState\login-every\'

Or run the same payload type immediately without waiting for a logon event:

& 'C:\Program Files\StartSet\managedstatekeeper.exe' process login-every

List what is staged and which run-once payloads have already fired:

& 'C:\Program Files\StartSet\managedstatekeeper.exe' list --show-executed

Release artifacts are built unsigned. Sign them with your own code-signing certificate before fleet deployment — see Installation.

Where things live

Thing	Path
Binaries	C:\Program Files\StartSet
Payload directories, config, state	C:\ProgramData\ManagedState
Configuration	C:\ProgramData\ManagedState\Config.yaml
Run-once ledgers	C:\ProgramData\ManagedState\share\runonce-*.json
Session logs	C:\ProgramData\ManagedState\logs\YYYY-MM-DD\HHMM\
Machine-readable reports	C:\ProgramData\ManagedState\reports\

Contents

Page	What it covers
Installation	Supported platforms, MSI/nupkg/zip/source, verification, uninstall
Payload Directories	Every payload type, its directory, context, elevation and once-semantics
Configuration	Every Config.yaml key, defaults, and a complete worked example
CLI Reference	Every command, flag, argument and exit code
Architecture	Service workers, execution engine, processors, ordering
Windows Session Model	Logon types that fire payloads, session 0, HKCU, deferral
Package Delivery	Getting payloads into the directories from a managed installer
Logging and Reporting	Session log layout, events.jsonl, items.json, retention
Coming From Outset	Concept, directory and flag mapping, and where behaviour differs
Troubleshooting	Symptom → cause → fix
Development	Repo layout, build, tests, release process
FAQ	Questions a Windows admin arriving from outset asks