Windows Program Startup Locations

Need to find out where programs launch themselves from? Check out the following
or if you want to know for without a lot of searching. A good solution is to
download AutoStart Guard, the Freeware Autostart Viewing, Alerting
& Control System for Window.

• RunServiceOnce subkey : designed to start service programs before user logs
  on and before other registry subkeys start.
  
  
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    registry key
    
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
    registry key
  
  
  
  
• RunServices subkey : loads immediately after RunServicesOnce and before user
  logon.
  
  
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
    registry key
    
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
    registry key
  
  
  
  
• Run subkey : The Run subkey in HKLM runs immediately before the Run subkey
  in HKCU.
  
  
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    registry key
    
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    registry key
  
  
  
  
• RunOnce subkey : primarily used by Setup programs. The HKLM subkey version
  of RunOnce runs programs immediately after logon and before other registry Run
  entries. The HKCU subkey version of RunOnce runs programs after Run subkeys and
  after the Startup folder.
  
  
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
    registry key
    
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
    registry key XP also has RunOnceEx:
    
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
    registry key
  
  
  
  
• RunOnce\Setup subkey : specifies programs to run after the user logs on
  
  
  
• Explorer\Run subkey :
  
  
  
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    registry key
    
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    registry key
  
  
  
  
• Userinit subkey : there is an entry for userinit.exe but subkey can accept
  multiple comma- separated values. Can’t find where program starting? Look here.
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
  NT\CurrentVersion\Winlogon\Userinit registry key
  
• load subkey :
  HKEY_CURRENT_USER\Software\Microsoft\Windows
  NT\CurrentVersion\Windows\load registry key
  
  
  
• All Users Startup folder : very common place to find autostart programs for
  whoever logs on
  Documents and Settings\All Users\Start
  Menu\Programs\Startup folder
  
  
  
• Startup folder : the most common location for programs to automatically boot
  from
  Documents and Settings\user\Start
  Menu\Programs\Startup folder If you migrated from NT, the path is Profiles\user\Start Menu\Programs\Startup