In which order are startup programs loaded?

Are Windows 10 startup programs initiated in a specific sequence, such as alphabetical or CPU impact order, or are they all initiated simultaneously?

Are there special cases in which programs are given preference from others, such as Windows Defender loading first for security purposes?


Windows launches on startup the programs in parallel, but in groups, as follows:

  • Windows Boot Device Drivers, having a Start value equal to 0
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  • Windows Auto-start Services & Drivers, having a Start value equal to 2
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  • Windows delayed Auto-start Services & Drivers, having a Start value equal to 2 and DelayedAutostart equal to 1:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  • Run Services Once only:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

  • Run Services permanently:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

After the user logs on, the order is as follows :

  • Notify of the logon event:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

  • User Initialization:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

  • Shell:
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

  • ShellServiceObjectDelayLoad pointing to CLSID InProcServer:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

  • RunOnce Local Machine Key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

  • Run permanently:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

  • RunOnce Current User Key (mostly for installations):
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

  • Explorer Run:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

  • Load Key (deprecated):
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

  • SharedTaskScheduler:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

  • AppInit_DLLs:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

  • All Users Startup Folder:

    C:\Users\All Users\Start Menu\Programs\Startup
    
  • User Profile Startup Folder :

    C:\Users\username\Start Menu\Programs\Startup
    

Sources :

  • Windows Registry Persistence, Part 2: The Run Keys and Search-Order
  • Windows Program Automatic Startup Locations.