Windows Automatic Startup Locations

Martin Brinkmann
Jun 4, 2016
Updated • Jun 4, 2016
Windows
|
26

The Windows operating system ships with options to run custom files or programs on startup.

That's good on the one hand as it enables users of the operating system to select programs that they want to start with Windows. It is also required for some programs, for instance security software as it is usually necessary that these programs start as early as possible.

But it is also a big nuisance as programs can be added to the startup during installations or even on start.

Since this is often not communicated properly to the user, may not only delay system start but also mean that programs that may not be needed all the time are run all the time.

Windows Automatic Startup Locations

windows automatic startup locations

While you can use a program like the excellent Autoruns to manage all startup locations, you sometimes may need direct access to them, for instance when you want to add a program of your own to the startup.

First time users may be overwhelmed by the sheer number of autostart locations -- both as folders on a drive and in the Windows Registry -- and it may take a long time to go through the listing the first time you open it.

Part of why the system is quite complex is the fact that Windows maintains autostart entries for individual users and all users on the system, and if a 64-bit version of Windows is used, another exclusive for 64-bit versions.

Windows Automatic Startup Locations can be divided into the three groups folders, Registry and scheduled Tasks for the most part even though you may also use the Group Policy to add autostart programs to the system (which are reflected in the Windows Registry however).

Windows Automatic Startup Locations: Folders

windows autostart locations folders

The following locations are ideal when it comes to adding custom programs to the autostart. Also, it is rather easy to remove program and shortcuts from those autostart folders.

To make things easier, Microsoft has added keywords for the folders which help you open them quickly. The locations / keywords open the same folder.

Autostart folder of the current user

  • shell:startup
  • %appdata%\Microsoft\Windows\Start Menu\Programs\Startup
  • C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Autostart folder of all users

  • shell:common startup
  • %programdata%\Microsoft\Windows\Start Menu\Programs\Startup
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Windows Automatic Startup Locations: Registry

windows automatic startup registry

The bulk of autostart locations is found in the Windows Registry. You probably know how to load the Registry editor but if you don't, here is how it is done:

  1. Tap on the Windows-key, type regedit.exe and hit enter.
  2. Confirm the UAC prompt that is displayed.

Run keys (individual user)

  • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKCU\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run (only on 64-bit systems)
  • HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce (runs the program/command only once, clears it as soon as it is run)
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx (runs the program/command only once, clears it as soon as execution completes)
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
  • HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Run keys (machine, all users)

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run (only on 64-bit systems)
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce (runs the program/command only once, clears it as soon as it is run)
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx (runs the program/command only once, clears it as soon as execution completes)
  • HKLM\System\CurrentControlSet\Services
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Other autostart keys

Active Setup has been designed to execute commands once per user during logon.

  • HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
  • HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Undocumented autostart feature.

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
  • HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

Shell related autostart entries, e.g. items displayed when you right-click on files or folders.

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects
  • HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
  • HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
  • HKCU\Software\Classes\*\ShellEx\ContextMenuHandlers
  • HKLM\Software\Wow6432Node\Classes\*\ShellEx\ContextMenuHandlers
  • HKCU\Software\Classes\Drive\ShellEx\ContextMenuHandlers
  • HKLM\Software\Wow6432Node\Classes\Drive\ShellEx\ContextMenuHandlers
  • HKLM\Software\Classes\*\ShellEx\PropertySheetHandlers
  • HKLM\Software\Wow6432Node\Classes\*\ShellEx\PropertySheetHandlers
  • HKCU\Software\Classes\Directory\ShellEx\ContextMenuHandlers
  • HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers
  • HKLM\Software\Wow6432Node\Classes\Directory\ShellEx\ContextMenuHandlers
  • HKCU\Software\Classes\Directory\Shellex\DragDropHandlers
  • HKLM\Software\Classes\Directory\Shellex\DragDropHandlers
  • HKLM\Software\Wow6432Node\Classes\Directory\Shellex\DragDropHandlers
  • HKLM\Software\Classes\Directory\Shellex\CopyHookHandlers
  • HKCU\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
  • HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers
  • HKLM\Software\Wow6432Node\Classes\Directory\Background\ShellEx\ContextMenuHandlers
  • HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers
  • HKLM\Software\Wow6432Node\Classes\Folder\ShellEx\ContextMenuHandlers
  • HKLM\Software\Classes\Folder\ShellEx\DragDropHandlers
  • HKLM\Software\Wow6432Node\Classes\Folder\ShellEx\DragDropHandlers
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
  • HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

The following keys specify drivers that get loaded during startup.

  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers
  • HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
  • HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32

Misc Startup keys

  • HKLM\Software\Classes\Filter
  • HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance
  • HKLM\Software\Wow6432Node\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance
  • HKLM\Software\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance
  • HKLM\Software\Wow6432Node\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance
  • KLM\System\CurrentControlSet\Control\Session Manager\KnownDlls
  • HKCU\Control Panel\Desktop\Scrnsave.exe
  • HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
  • HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64

Windows Automatic Startup Locations: Group Policy

group policy startup

The Group Policy editor is only available on professional versions of Windows while the Registry keys associated with policies are available on all versions.

  1. Tap on the Windows-key, type gpedit.msc and hit enter to start the Group Policy Editor.

Navigate to the following keys using the tree structure on the left to check, modify, add or remove entries using policies.

  • Computer Configuration > Administrative Templates > System > Logon > Run these programs at user logon
  • User Configuration > Administrative Templates > System > Logon > Run these programs at user logon

The corresponding Registry keys are:

  • HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Windows Automatic Startup Locations: Tasks

task scheduler

You can open the Windows Task Scheduler to manage tasks on the Windows operating system:

  1. Tap on the Windows-key, type Task Scheduler, and hit enter.

You may check out tasks using Windows Explorer / File Explorer as well.

  • C:\Windows\Tasks
  • C:\Windows\System32\Tasks

Files

The following files can be used to autostart programs on Windows start:

  • c:\autoexec.bat
  • c:\config.sys
  • c:\windows\winstart.bat
  • c:\windows\wininit.ini
  • c:\windows\dosstart.bat
  • c:\windows\system.ini
  • c:\windows\win.ini
  • c:\windows\system\autoexec.nt
  • c:\windows\system\config.nt

Resources

The following resources provide you with additional information about specific Registry keys.

Summary
Windows Automatic Startup Locations
Article Name
Windows Automatic Startup Locations
Description
The following guide lists Windows automatic startup locations that are used by programs, the operating system or the user to run programs on logon.
Author
Publisher
Ghacks Technology News
Logo
Advertisement

Tutorials & Tips


Previous Post: «
Next Post: «

Comments

  1. Andrew said on January 13, 2020 at 1:07 am
    Reply

    I unselected something and windows 10 cannot start. Auto repair also doesn’t work. Is there an Autorun application that can be started from the boot CD?

  2. Jojo said on June 5, 2016 at 8:24 pm
    Reply

    Dang, alot of infos :)
    Thanks…
    I’ve recently moved from XP to 8.1, and now some programs I had autostarting on XP, won’t autostart with windows on 8.1
    Don’t remember if it’s due to me choosing portable versions [need to take a look] or is it some windows issue.
    I did add shortcuts to the Start Folder , following random article about this…
    And I did check the right boxes for it on the programs itself [Specifically: XtraButtons (so awesome, when it worked, now it fails… must look into it again :\ ) and ScreenCaptor & WizMouse —– 3 awesome programs!!! check it out guys!!]
    Another thing that might has to do with it: Windows security crap USER ACCOUNT CONTROL [Ok, Ive taken a look, it does lead to portable folders… that means I have to simply be forced to Fully Install rather than use portable ones Shortcuts from within Unpacked Folders?] UAC – jumping everytime..
    I do not wish to lower UAC’s settings, in order to prevent damageful progs from hitting my PC… So I leave the demand ON…
    Why is there no way to Exclude specific progs from this UAC jumping each time…

    A rthough – will AUtoRuns solve any of the issue\s?
    Thanks y’all :)

    1. John in Mtl said on June 5, 2016 at 10:57 pm
      Reply

      Ah, WizMouse. Couldn’t live without it!

      Now if I could only get something equivalent to “WindowsWhere” ( © Zack Snow 2010) that **works**, things would be awesome on this windows 7 OS, and 8.1 !

  3. buffer said on June 5, 2016 at 10:57 am
    Reply

    autoexec.bat and config.sys… lol. I thought I was in 1995 when I read that ; )
    I prefer to keep it simple (https://en.wikipedia.org/wiki/KISS_principle) by going to msconfig.msc, which in Windows 10 is in taskmanager>startup. IMHO this should be the first (and easiest) place to check before proceeding to Autoruns, etc.

  4. Zaungast said on June 4, 2016 at 6:37 pm
    Reply

    Hallo, Herr Brinkmann

    bitte vorab um Nachsicht, meine Frage hier zu stellen:

    Gibt es Ihre Seite auch auch Deutsch und wenn nicht, kennt jemand der Poster hier vergleichbare Seiten auf Deutsch ? Mein Vater kann zwar Schulenglisch vorweisen, ist aber mit z.B. dieser Seite überfordert. Vielen Dank.

    1. Martin Brinkmann said on June 4, 2016 at 6:51 pm
      Reply

      Hallo, die Seite gibt es nur auf Englisch. Vielleicht hilft Google Translate weiter? Eine vergleichbare deutsche Seite ist mir leider nicht bekannt.

      1. Zaungast said on June 4, 2016 at 9:10 pm
        Reply

        Ok, vielen Dank für die schnelle Antwort. Google Translate hilft manchmal, aber mitunter kommen doch die tollsten und irrsinnigsten Verdrehungen vor, die den Inhalt in sich selbst auf den Kopf stellen.

        Dennoch von hier aus mal herzlichen Dank für eine tolle Webseite mit riesigem Informationsgehalt. Ich werde halt wie bisher bei Bedarf für Daddy übersetzen.

  5. KameSennin said on June 4, 2016 at 5:34 pm
    Reply

    Thanks.

    I always wondered, which is the boot order of all these startup items. Any good info?

    1. Martin Brinkmann said on June 4, 2016 at 5:39 pm
      Reply

      Check out the Bleeping Computer article linked under reference.

  6. Gary D said on June 4, 2016 at 5:30 pm
    Reply

    @ Martin

    My post ref WinPatrol seems to have disappeared ! Reposting.

    WinPatrol can be used to add, delete and disable startup programs.

    https://winpatrol.com/download.html

    1. Martin Brinkmann said on June 4, 2016 at 5:39 pm
      Reply

      Should be there now :)

      1. Gary D said on June 4, 2016 at 5:43 pm
        Reply

        Thanks Martin :))

  7. Gary D said on June 4, 2016 at 5:19 pm
    Reply

    Martin, there is a program which you can use
    WinPatrol enables addition, deletion and disablement of programs very simply and easily in its startup gui

    https://www.winpatrol.com

  8. Jeff-FL said on June 4, 2016 at 3:00 pm
    Reply

    @Martin, this is the kind of meaty, juicy, under the hood Windows info that I come here for.

    Thanks!

  9. chesscanoe said on June 4, 2016 at 2:56 pm
    Reply

    The Notification function on Win10 x64 Home periodically tells me I have 3 or more programs autostarting, and this may slow my system down. I’ve investigated this with Autoruns and Process Explorer and it appears to me I want the starts as is. The useful comments here may lead me to reevaluate my conclusion. Thanks for a great article.

  10. John Krazinski said on June 4, 2016 at 2:26 pm
    Reply

    Autoruns from Sysinternals is comprehensive. https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
    It only misses Group Policies I guess.

  11. Mick said on June 4, 2016 at 2:02 pm
    Reply

    Thanks, very informative indeed.

  12. Adithya FRK said on June 4, 2016 at 1:22 pm
    Reply

    That’s a lot of autostart entries. Why can’t they be all at a single place?

    1. ilev said on June 4, 2016 at 5:36 pm
      Reply

      Because Microsoft never had the knowledge how to properly develop an OS.

      On OSX all startup items are in 1 system folder : /Library/StartUpItems
      Removing users/group startup items is build in OSX System Preferences.

      1. Martin said on February 13, 2019 at 12:29 pm
        Reply

        Nonsense! Typical Apple/Linux hybris.
        Inform yourself about Dave Cutler who developed Windows NT.

        My answer is: Because Windows is a multi-user OS, and because those start options are all for differnet purposes.
        Plus: some things (like AD and GPOs) were introduced at a later time, i.e. evolution.

      2. Rosstafarian said on July 4, 2016 at 3:56 am
        Reply

        hahaha I’m coming a bit late to this post but come on give me a break
        First of all microsoft has plenty of brilliant people working on windows which keeps improving with every OS. I like apple’s stuff but os x or macOS or whatever they want to call it now has been going down hill unfortunately.
        Second do to os x’s unix legacy it has TONS of startup locations, windows probably has it beat but not by much
        heres some from a google search
        — User Login Items (~/Library/Preferences/com.apple.loginitems.plist)
        — ~/Library/LaunchDaemons
        — ~/Library/LaunchAgents
        — ~/.bash_profile
        — /Library/LaunchDaemons
        — /Library/LaunchAgents
        — /Library/StartupItems
        — /System/Library/LaunchDaemons/
        — /System/Library/LaunchAgents
        — /System/Library/StartupItems
        — /Library/Preferences/loginwindow.plist can have Login Items that apply to all users
        — /etc/profile
        — /etc/mach_init.d/
        — /etc/rc/ and /etc/rc.local – totally unsupported, and not created by default (but probably still work)
        — Network/Library/LaunchDaemons, but I don’t know)?
        — /etc/mach_init_per_login_session.d/ and /etc/mach_init_per_user.d/
        — cron launched @reboot items (yes, cron is still there), this might even work for everyone’s crontabs
        — /Library/Security/SecurityAgentPlugins that have been loaded by being listed in the proper spots in /etc/authorization
        — /private/var/root/Library/Preferences/com.apple.loginwindow.plist, in the LoginHook key (runs as root, passed the username)MCX (WorkgroupManager) login hooks (runs as root, but passed the username) note: below this network home directories are more reliably available, as is a connection to the WindowsServer
        — MenuBar items from ~/Library/Preferences/com.apple.systemuiserver.plist and /Library/Preferences/com.apple.systemuiserver.plist (+MXC added items)
        — /Library/Preferences/loginwindow.plist, in the key (array of paths) AutoLaunchedApplicationDictionary (everyone gets this launched at login, runs as user) (+MXC added items)
        — LoginItems (generally GUI items) ~/Library/Preferences/com.apple.loginitems.plist and possibly /Library/Preferences/com.apple.loginitems.plist (have not tried) (+MXC added items)

        Not to mention browser plugins and things of that nature.
        Please don’t act like an expert and post a definite answer until you’re completely certain of it. A 10 second google search could’ve stopped you from spreading misinformation and making people think apple users are tools

    2. Pants said on June 4, 2016 at 4:35 pm
      Reply

      They are .. in Autoruns under the Everything tab :)

  13. Henk van Setten said on June 4, 2016 at 12:26 pm
    Reply

    A very interesting and complete overview indeed! Still for the sake of ultimate completeness, there’s one thing that might have been mentioned here, too: the fact that all kinds of third-party utilities can be used to auto-launch programs at system boot or user logon, too.

    Two well-known freeware examples are Nirsoft’s nircmd.exe and Outertech’s batchrun.exe. Both are capable of running their own script to launch one’s own precomposed list of programs: Nircmd from its own *.ncl scripts, Batchrun from its own *.brs scripts.

    The advantage is that these scripts have many built-in options for things like startup timing (such as autostart each program one second after the previous one) and fine-tuning (such as autostart some specific programs in minimized mode). This makes them more handy than using a simple old-fashioned autoexec.bat script.

    The disadvantage however is that this kind of boot scripts will make it even more hard to get one complete overview of everything that will autostart when you boot your system. Take the wonderful Autoruns utility mentioned above: Autoruns will just list one instance of Nircmd or Batchrun, but it will NOT list any of the programs that are autostarted by this Nircmd or Batchrun instance.

    In practice, this means that when troubleshooting startup or overload problems with someone else’s PC, you should always look carefully for the presence of such third-party auto-launchers too, and check what’s in their scripts.

  14. Birmingham said on June 4, 2016 at 9:15 am
    Reply

    Thank you very much for gathering these infos on one page. Some where still unknown to me, thx 20 yrs MS UnHelp :)

    1. Bosh said on June 4, 2016 at 1:17 pm
      Reply

      I thank to all virus, spyware, trojan developers to use mostly of this locations. And because of this, no introduction for Autorun is needed. It is part of Hiren’s boot cd for so many years.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.