diff --git a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1 b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
index f95a55b..536d145 100644
--- a/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
+++ b/playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1
@@ -165,6 +165,31 @@ Section 'autostart.txt' {
         if (Test-Path $d) { "--- $d ---"; Get-ChildItem $d | Select-Object Name | Format-Table -AutoSize }
     }
     ''
+    '== enabled/disabled state (StartupApproved) =='
+    # Disabling a startup item via Task Manager or Settings does NOT remove the
+    # Run key or the Startup shortcut - it writes a flag here. So an entry can
+    # appear above and still be switched off. First byte 02/06 = enabled,
+    # 03/07 = disabled. Capturing this is what tells "imaging installed it and
+    # it runs" apart from "imaging installed it and somebody turned it off",
+    # which matters because the fix is not to install it at all.
+    foreach ($k in 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run',
+                   'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder',
+                   'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run',
+                   'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32',
+                   'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder') {
+        if (Test-Path $k) {
+            "--- $k ---"
+            $props = Get-Item $k
+            foreach ($n in $props.Property) {
+                $v = (Get-ItemProperty $k -Name $n).$n
+                $state = if ($v -is [byte[]] -and $v.Length -ge 1) {
+                    switch ($v[0]) { 2 {'ENABLED'} 6 {'ENABLED'} 3 {'disabled'} 7 {'disabled'} default {"unknown(0x{0:X2})" -f $v[0]} }
+                } else { 'unknown' }
+                "{0,-10} {1}" -f $state, $n
+            }
+        }
+    }
+    ''
     '== scheduled tasks (non-Microsoft) =='
     Get-ScheduledTask -EA SilentlyContinue |
         Where-Object { $_.TaskPath -notlike '\Microsoft\*' } |