Where Are Windows Autorun Registry Keys?
Windows Run and RunOnce keys in HKLM and HKCU plus Startup folders for persistence.
Last updated
Programs that start with Windows register in Run keys under both machine and user hives, with RunOnce variants for single-shot launches. Malware loves these keys, which is why every autoruns audit starts here.
The Startup folders complement the registry and are easier to inspect. Check all four registry spots plus both folders or persistence hides in the one you skipped.
Where Windows stores this, by platform
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Machine-wide autoruns needing admin to write. The user twin sits at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, with RunOnce variants beside each. Startup folders at shell:startup and shell:common startup complete the picture. Audit with Autoruns rather than by eye; entries hide in plain sight.
Frequently asked questions
How do I stop a program launching at boot?
Remove its value from the Run keys above or its shortcut from the Startup folders. Prefer the app's own settings first so updates do not re-add it.
What is the difference between Run and RunOnce?
Run launches every boot while RunOnce deletes itself after one execution. Installers stage through RunOnce; persistence uses Run.
Notice an outdated path? Let us know.