Windows Program Startup Locations


Need to find out where programs launch themselves from? Check out the following
or if you want to know for without a lot of searching. A good solution is to
download AutoStart Guard, the Freeware Autostart Viewing, Alerting
& Control System for Window.


  • RunServiceOnce subkey : designed to start service programs before user logs
    on and before other registry subkeys start.

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
      registry key
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
      registry key


  • RunServices subkey : loads immediately after RunServicesOnce and before user
    logon.

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
      registry key
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
      registry key


  • Run subkey : The Run subkey in HKLM runs immediately before the Run subkey
    in HKCU.

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
      registry key
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
      registry key


  • RunOnce subkey : primarily used by Setup programs. The HKLM subkey version
    of RunOnce runs programs immediately after logon and before other registry Run
    entries. The HKCU subkey version of RunOnce runs programs after Run subkeys and
    after the Startup folder.

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
      registry key
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
      registry key XP also has RunOnceEx:
    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
      registry key


  • RunOnce\Setup subkey : specifies programs to run after the user logs on


  • Explorer\Run subkey :

    • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
      registry key
    • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
      registry key


  • Userinit subkey : there is an entry for userinit.exe but subkey can accept
    multiple comma- separated values. Can’t find where program starting? Look here.

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
    NT\CurrentVersion\Winlogon\Userinit
    registry key
  • load subkey :
    HKEY_CURRENT_USER\Software\Microsoft\Windows
    NT\CurrentVersion\Windows\load
    registry key


  • All Users Startup folder : very common place to find autostart programs for
    whoever logs on
    Documents and Settings\All Users\Start
    Menu\Programs\Startup
    folder


  • Startup folder : the most common location for programs to automatically boot
    from
    Documents and Settings\user\Start
    Menu\Programs\Startup
    folder If you migrated from NT, the path is Profiles\user\Start Menu\Programs\Startup

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top