In which order are startup programs loaded?
Are Windows 10 startup programs initiated in a specific sequence, such as alphabetical or CPU impact order, or are they all initiated simultaneously?
Are there special cases in which programs are given preference from others, such as Windows Defender loading first for security purposes?
Windows launches on startup the programs in parallel, but in groups, as follows:
Windows Boot Device Drivers, having a
Start
value equal to 0HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Windows Auto-start Services & Drivers, having a
Start
value equal to 2HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Windows delayed Auto-start Services & Drivers, having a
Start
value equal to 2 andDelayedAutostart
equal to 1:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Run Services Once only:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
Run Services permanently:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
After the user logs on, the order is as follows :
Notify of the logon event:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
User Initialization:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Shell:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
ShellServiceObjectDelayLoad pointing to CLSID InProcServer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
RunOnce Local Machine Key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
Run permanently:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
RunOnce Current User Key (mostly for installations):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Explorer Run:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Load Key (deprecated):
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
SharedTaskScheduler:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
AppInit_DLLs:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
-
All Users Startup Folder:
C:\Users\All Users\Start Menu\Programs\Startup
-
User Profile Startup Folder :
C:\Users\username\Start Menu\Programs\Startup
Sources :
- Windows Registry Persistence, Part 2: The Run Keys and Search-Order
- Windows Program Automatic Startup Locations.