Gfrktyl

How do I find the source of a Windows hotkey / shortcut? I know the keys that start it are Ctrl-Alt-M and I know the program it runs is Windows explorer pointed to the My Documents folder. But how do I find the location of the originator?

I want to find the "source" and remove the hotkey from it so that I can create another one.

We're on fairly secured machines and I won't be able to download any software so I need something native to windows to solve the problem.

I'm on Windows 7 64-bit if that matters.

There is a wmi query in vbs that enumerates all .lnk shortcut files, but it doesn't expose the hotkey property.

The wscript.shell comobject does.

I prefer PowerShell, the following script uses a function found on stackoverflow.com.

It recurses the whole c-drive to find .lnk files and checks if it contains a Hotkey

## Enum-ShortcutHotkeys.ps1

# Function from Tim Lewis https://stackoverflow.com/a/21967566/6811411

function Get-Shortcut {

  param(

    $path = $null

  )

  $obj = New-Object -ComObject WScript.Shell

  if ($path -eq $null) {

    $pathUser = [System.Environment]::GetFolderPath('StartMenu')

    $pathCommon = $obj.SpecialFolders.Item('AllUsersStartMenu')

    $path = dir $pathUser, $pathCommon -Filter *.lnk -Recurse 

  }

  if ($path -is [string]) {$path = dir $path -Filter *.lnk}

  $path | ForEach-Object { 

    if ($_ -is [string]) {$_ = dir $_ -Filter *.lnk}

    if ($_) {

      $link = $obj.CreateShortcut($_.FullName)

      $info = @{}

      $info.Hotkey = $link.Hotkey

      $info.TargetPath = $link.TargetPath

      $info.LinkPath = $link.FullName

      $info.WorkingDirectory = $link.WorkingDirectory

      $info.Arguments = $link.Arguments

      $info.Target = try {Split-Path $info.TargetPath -Leaf } catch { 'n/a'}

      $info.Link = try { Split-Path $info.LinkPath -Leaf } catch { 'n/a'}

      $info.Description = $link.Description

      $info.WindowStyle = $link.WindowStyle

      $info.IconLocation = $link.IconLocation

      New-Object PSObject -Property $info

    }

  }

}

Get-ChildItem -path c: -filter *.lnk -rec -force -EA 0|

  ForEach-Object {

    get-shortcut $_.FullName|where Hotkey

  }

This sample output revealed an Acronis hotkey I didn't know off.

> .Enum-ShortcutHotkeys.ps1



WorkingDirectory : C:Program Files (x86)AcronisTrueImageHome

Link             : Acronis System Report.lnk

TargetPath       : C:Program Files (x86)AcronisTrueImageHomeSystemReport.exe

WindowStyle      : 1

Description      : Ermöglicht Ihnen, Informationen über Ihr System zu sammeln.

IconLocation     : ,1

Hotkey           : Ctrl+F7

Target           : SystemReport.exe

Arguments        :

LinkPath         : C:ProgramDataMicrosoftWindowsStart MenuProgramsAcronisTrue ImageExtras und

                   WerkzeugeAcronis System Report.lnk



WorkingDirectory : C:Program Files (x86)AcronisTrueImageHome

Link             : Acronis System Report.lnk

TargetPath       : C:Program Files (x86)AcronisTrueImageHomeSystemReport.exe

WindowStyle      : 1

Description      : Ermöglicht Ihnen, Informationen über Ihr System zu sammeln.

IconLocation     : ,1

Hotkey           : Ctrl+F7

Target           : SystemReport.exe

Arguments        :

LinkPath         : C:UsersAll UsersMicrosoftWindowsStart MenuProgramsAcronisTrue ImageExtras und

                   WerkzeugeAcronis System Report.lnk