Where Does Autoruns Store Settings and Snapshots?
Where Autoruns keeps its settings in the registry and where saved .arn snapshots and compare baselines live.
Last updated
Autoruns is a single exe with no installer, so its own settings live in the registry under HKCU\Software\Sysinternals\AutoRuns. Everything it shows you belongs to the system, not to the tool.
Scan snapshots are the part you control. File > Save writes an .arn file wherever you point it, and comparisons run against those files. The workflow that works is dated snapshots in one folder: baseline before a change, scan after, compare the two. The VirusTotal column hashes unknown entries on demand.
Where Autoruns stores this, by platform
HKCU\Software\Sysinternals\AutoRuns
Filters, columns, and window state under this key; EulaAccepted sits in the parent Sysinternals key. .arn snapshots go wherever you save them, so keep a dated folder. The tool writes nothing else to disk by itself.
Frequently asked questions
where do autoruns saved files go
Save them as .arn files via File > Save to a folder you choose (Documents is the sane default). There is no automatic save location; unsaved scans vanish on close. Name them with dates so comparisons sort themselves.
where are autoruns settings in the registry
In HKCU\Software\Sysinternals\AutoRuns (window layout, columns, and filters). Delete that key to reset the UI to defaults. Sysinternals tools share the EulaAccepted flag one level up, so accepting once covers the suite.
how do i compare two autoruns scans
Open both .arn files and use File > Compare against the baseline. Entries present in only one scan highlight automatically. Capture the baseline before installing anything suspicious, not after.
Notice an outdated path? Let us know.