Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows XP
    - Admin Tips
      - Miscellaneous
        Windows Program Startup Locations

Section(s): Miscellaneous, Miscellaneous
Published on Apr 20, 2004.
Last Modified on Apr 20, 2004.
Last Modified by Wayne Maples.
Rated 3.7 out of 5 based on 124 votes.

Need to find out where programs launch themselves from? Check out the following or if you want to know for without a lot of searching. A good solution is to download AutoStart Guard, the Freeware Autostart Viewing, Alerting & Control System for Window.

RunServiceOnce subkey : designed to start service programs before user logs on and before other registry subkeys start.
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce registry key
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce registry key
RunServices subkey : loads immediately after RunServicesOnce and before user logon.
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices registry key
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices registry key
Run subkey : The Run subkey in HKLM runs immediately before the Run subkey in HKCU.
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key
RunOnce subkey : primarily used by Setup programs. The HKLM subkey version of RunOnce runs programs immediately after logon and before other registry Run entries. The HKCU subkey version of RunOnce runs programs after Run subkeys and after the Startup folder.
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key XP also has RunOnceEx:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx registry key
RunOnce\Setup subkey : specifies programs to run after the user logs on
Explorer\Run subkey :
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run registry key
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run registry key
Userinit subkey : there is an entry for userinit.exe but subkey can accept multiple comma- separated values. Can't find where program starting? Look here.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit registry key
load subkey :
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key
All Users Startup folder : very common place to find autostart programs for whoever logs on
Documents and Settings\All Users\Start Menu\Programs\Startup folder
Startup folder : the most common location for programs to automatically boot from
Documents and Settings\user\Start Menu\Programs\Startup folder If you migrated from NT, the path is Profiles\user\Start Menu\Programs\Startup