Microsoft Sysinternals Autoruns: Complete Guide to Windows Startup Programs, Services and Drivers

Quick Answer

Microsoft Sysinternals Autoruns is a free Windows utility from Microsoft that helps you identify and manage programs, services, drivers, scheduled tasks, and other components configured to start automatically when Windows boots, when a user signs in, or when certain Windows components launch. It provides a more comprehensive view of automatic startup locations than the Startup Apps section in Windows Settings or Task Manager.

Autoruns is particularly useful when you want to investigate unwanted background applications, reduce unnecessary startup activity, troubleshoot slow Windows startup, examine suspicious persistence mechanisms, or find software that continues running after you thought you had disabled it. You can inspect entries, check digital signatures, filter Microsoft-signed entries, investigate file and registry locations, and disable selected automatic-start entries without immediately deleting their configurations.

What Is Microsoft Sysinternals Autoruns?

Autoruns for Windows is part of Microsoft's Sysinternals collection of advanced Windows diagnostic and administration utilities. Sysinternals tools help IT professionals, system administrators, security analysts, and technically curious users understand how Windows and its applications operate.

Many applications install components that start automatically. Some launch when you sign in, while others operate as Windows services, load drivers, register scheduled tasks, or integrate with Windows Explorer and other system components. These mechanisms allow legitimate software to provide features such as antivirus protection, cloud synchronization, device management, backup, updates, and hardware support.

However, unwanted applications, poorly configured software, and malware can also use automatic-start mechanisms. Autoruns provides a central interface for examining many of these locations.

Unlike a simple startup manager, Autoruns does not restrict its view to applications that appear in the Windows notification area or launch immediately after a user signs in. It also examines a much broader set of registry and file-system locations associated with automatic execution.

How Does Autoruns Work?

Windows provides multiple mechanisms through which applications and system components can configure themselves to run automatically. These mechanisms include registry entries, startup folders, scheduled tasks, services, drivers, and Windows extension points.

Autoruns examines supported automatic-start locations and presents the discovered entries in a searchable, categorized interface. Depending on the entry, it can show details such as the entry name, description, publisher, image path, and associated registry or file-system location.

The general workflow is as follows:

1. Discover: Autoruns enumerates supported locations where automatic-start components are registered.
2. Organize: It groups entries into categories so you can investigate logon applications, services, drivers, scheduled tasks, Explorer extensions, and other components.
3. Inspect: You can examine an entry's properties, identify its associated file, and navigate to the relevant configuration location.
4. Verify: Where applicable, you can check digital signatures and use the optional VirusTotal integration to investigate file reputation.
5. Manage: You can uncheck an entry to disable its automatic-start configuration or delete the configuration entry when you understand the consequences.

Autoruns is primarily a discovery, inspection, and configuration-management utility. It is not a complete real-time process monitor, a guaranteed malware detector, or an automatic optimizer that determines which entries your computer needs.

Autoruns vs. Windows Task Manager Startup Apps

Windows already provides built-in tools for controlling startup applications. Autoruns is useful when those tools do not reveal enough information about a component or when you need to investigate less obvious automatic-start locations.

Practical recommendation: Start with Task Manager or Windows Settings when you only need to disable an ordinary startup application. Use Autoruns when you need deeper visibility, technical investigation, or a more comprehensive inventory of automatic-start components.

What Does Autoruns Offer?

1. Comprehensive Startup Entry Discovery

Autoruns can display automatic-start entries from numerous Windows locations. These include startup folders, registry Run and RunOnce keys, services, drivers, scheduled tasks, and other supported extension points.

This is useful when an application repeatedly returns after a reboot or does not appear in the normal Startup Apps list. Its automatic-start configuration may exist in a different location, or another component may be responsible for launching it.

2. Categorized Tabs for Different Startup Locations

Autoruns organizes its findings into tabs so that you can focus on a particular type of automatic-start mechanism rather than examining one long list.

The available categories and entries depend on the Windows environment and Autoruns version. Microsoft has also expanded Autoruns to support Windows packaged applications. Do not assume that every computer will display identical entries or an identical set of categories.

3. Hide Signed Microsoft Entries

A typical Windows installation can contain many Microsoft-signed components. When troubleshooting third-party software, this can make the results difficult to review.

Autoruns provides the Hide Signed Microsoft Entries option to filter out entries with verified Microsoft signatures. This helps you concentrate on third-party components without manually reviewing every Windows entry.

This option is a display filter. It does not disable or delete the hidden entries. Also, an entry that remains visible is not necessarily malicious: legitimate third-party applications, hardware utilities, security software, and drivers can all appear in the filtered results.

4. Inspect File Properties and Configuration Locations

When you select an entry, Autoruns can display its properties and help you investigate its associated executable or configuration location.

Useful investigation options include:

• Properties: Examine available file and entry details.
• Jump to Entry: Navigate to the registry or file-system location where the automatic-start configuration is registered, when supported.
• Jump to Image: Locate the executable or other image associated with the entry, when available.
• Search Online: Research an unfamiliar entry or file name using the available search option.

These capabilities help you identify which application owns an entry and whether it is related to software you recognize. A file path or publisher name is evidence for investigation, not proof that an entry is safe or unsafe.

5. Digital Signature Verification

A digital signature can help establish whether a file was signed by a particular publisher and whether the signature is valid. Autoruns supports signature verification to help you assess the identity and integrity information available for startup components.

To enable signature verification, open Autoruns and use the relevant option under Options, where available in your version.

Keep these limitations in mind:

• A valid signature does not guarantee that software is harmless or appropriate for your computer.
• An unsigned file is not automatically malware. Some legitimate tools and internally developed applications are unsigned.
• An unknown publisher, missing description, or unusual filename should prompt investigation rather than an immediate deletion.

6. Optional VirusTotal Integration

Autoruns can use VirusTotal to check the reputation of associated files by their hashes. A file hash is a calculated identifier that helps match a file to previously analyzed samples.

This can help you investigate entries that are unfamiliar or potentially suspicious. The integration is optional, and VirusTotal results must be interpreted carefully.

• A detection by one or more security engines does not automatically prove that a file is malicious.
• A clean result does not guarantee that a file is safe, particularly if the file is new or has not been analyzed.
• Detection results can change over time and may differ between security engines.
• Review the file path, publisher, signature, application ownership, and other evidence before taking action.

7. Disable an Automatic-Start Entry Without Immediately Deleting It

One of Autoruns' most useful features is the ability to uncheck an entry to disable its automatic-start configuration. This is generally a better first step than deleting an unfamiliar entry.

Disabling a startup entry does not necessarily uninstall the associated application or stop an already running process immediately. Its exact effect depends on the type of entry and the mechanism involved.

For example, disabling a logon entry may prevent an application from launching at the next sign-in, while disabling a service or driver can have more significant consequences. A reboot or sign-out may be necessary before you can evaluate the change.

8. Support for Other User Accounts

Autoruns can examine automatic-start entries associated with other user accounts configured on the same Windows computer. This is valuable for IT technicians investigating problems that affect only one profile or identifying software configured for another account.

Run Autoruns with appropriate permissions and select the relevant account through the User menu. Visibility depends on the account, permissions, and type of entry being examined.

9. Command-Line Automation with Autorunsc

The Autoruns download package includes Autorunsc, the command-line version of Autoruns. It is useful for IT support teams, system administrators, scripting, reporting, and comparing automatic-start configurations across computers.

Autorunsc supports filtering, digital-signature verification, file hashes, structured output, and other inspection options. Its capabilities and switches should be checked against the documentation for the installed version.

For example, to display command-line help, open Command Prompt or PowerShell in the directory containing the executable and run:

.\autorunsc64.exe -?

The executable name may differ depending on the architecture and files included in the downloaded package. If the command is not recognized, use the actual executable name and run it from the extracted directory.

To export an inventory to a CSV file, use:

.\autorunsc64.exe -accepteula -a * -c > autoruns-report.csv

This example uses the 64-bit command-line executable, requests all supported entry categories, and redirects comma-separated output to a file. Run it from a directory where you have permission to create the report. Review the output and command-line help for the options supported by your installed version.

For a more focused inventory of entries that do not have verified Microsoft signatures, the -m option can be combined with signature verification using -s:

.\autorunsc64.exe -accepteula -a * -m -s -c > third-party-autoruns.csv

This filtered report is intended for investigation, not as a definitive list of unwanted software. Third-party entries include many legitimate Windows applications, security products, drivers, and hardware utilities.

10. Offline Windows Analysis

Autoruns supports examining an offline Windows installation in appropriate circumstances. This can be useful for technicians investigating a Windows installation that cannot boot normally or for examining a system disk from another environment.

Offline analysis is an advanced workflow. It requires access to the relevant Windows installation and appropriate permissions. Follow Microsoft's current Autoruns documentation for the available offline-analysis options rather than applying commands intended for a running system without modification.

How to Download and Run Autoruns

1. Open Microsoft's official Autoruns for Windows documentation and download page.
2. Download the official Autoruns package.
3. Extract the downloaded ZIP archive into a suitable folder.
4. Choose the executable that matches your Windows architecture, such as the 64-bit executable on a typical x64 Windows computer.
5. Right-click the executable and select Run as administrator when you need to inspect machine-wide startup locations, services, or drivers.
6. If Windows displays a User Account Control prompt, review the publisher and approve elevation only if you trust the downloaded tool.
7. Allow Autoruns to populate its entries before beginning your investigation.

Autoruns is distributed as a portable utility, so a conventional installation wizard is not required for the standard download. Download it directly from Microsoft rather than an unfamiliar third-party download site.

How to Find and Disable Unwanted Startup Programs

The following procedure is intended for users who want to stop a known, nonessential application from launching automatically. It is not a recommendation to disable every unfamiliar entry.

Step 1: Create a Baseline

Before changing anything, note the current startup behavior and identify the application you want to investigate. If the computer is used for work, create an inventory of the relevant entries or capture screenshots so you can compare the configuration later.

Step 2: Open Autoruns as Administrator

Run Autoruns with appropriate permissions. Review the Logon tab first when investigating applications that open after signing in. If the program does not appear there, inspect the other relevant categories, such as Scheduled Tasks or Services.

Step 3: Filter the Results

Use the Hide Signed Microsoft Entries option when available to reduce the number of Microsoft-signed entries displayed. You can also use the available search or filtering controls to find the application name, publisher, executable name, or file path.

Step 4: Identify the Entry Before Changing It

Select the entry and inspect its description, publisher, image path, signature information, and associated configuration location. If the entry belongs to a recognized application, check the application's own settings first to see whether it provides an option to disable startup behavior.

If you cannot establish what an entry does, leave it enabled until you have gathered sufficient information.

Step 5: Disable the Entry

For an entry you have identified as unnecessary, clear its checkbox in Autoruns. Do not use the Delete command as the first troubleshooting step unless you understand the configuration being removed and have a suitable recovery plan.

Step 6: Restart and Verify

Restart Windows if the change requires it. Sign in and check whether the application still launches automatically. Confirm that related functionality, such as device controls, security protection, synchronization, backup, or update services, continues to work as expected.

If the application still launches, investigate whether another entry, scheduled task, service, or application component is responsible. Disabling one entry does not guarantee that every mechanism associated with an application has been disabled.

Using Autoruns to Investigate High Background Activity

Autoruns can help identify applications and components that start automatically, but it does not directly measure how much CPU, memory, disk, or network activity each running process consumes. Use it alongside Windows Task Manager or other appropriate diagnostic tools.

If your computer has high memory usage after startup, follow this general workflow:

1. Open Task Manager and examine the Processes and Startup apps views to identify obvious resource-intensive applications.
2. Open Autoruns and review relevant third-party logon entries and scheduled tasks.
3. Identify the publisher and executable associated with an entry before changing it.
4. Disable only a known, nonessential entry that is reasonably linked to the behavior you are investigating.
5. Restart Windows and compare the observed memory or CPU usage with your baseline.
6. If the problem persists, investigate running processes, services, drivers, and other possible causes rather than assuming a startup entry is responsible.

High memory use can result from many factors, including applications, drivers, kernel pools, caching, security software, or memory leaks. Autoruns is a useful part of the investigation, but it cannot independently identify every cause of high RAM usage.

How to Identify Suspicious Startup Entries

Autoruns is useful for examining possible malware persistence, which is the ability of unwanted software to remain configured to run again after a restart or sign-in. However, the presence of an unfamiliar entry does not prove infection.

Investigate entries that have several concerning characteristics, such as:

• An unexpected executable path or a file in a temporary or unusual user-writable directory.
• A random-looking filename with no recognizable application association.
• A missing or invalid digital signature combined with other suspicious evidence.
• An unfamiliar scheduled task, service, or startup entry that appeared around the time a problem began.
• A file or publisher that does not match the software supposedly responsible for the entry.
• Reappearance of an entry after it was disabled, which may indicate another component is recreating it.

None of these observations is conclusive on its own. Some legitimate applications use unusual paths, and some legitimate files are unsigned. Investigate the full context, verify file information, and use Microsoft Defender or your organization's approved security tools when malware is suspected.

Do not delete a file or disable a security-related component solely because VirusTotal reports a detection or Autoruns marks an entry as unfamiliar. Confirm the finding before taking remediation action.

Important Safety Precautions

• Prefer disabling over deleting: Unchecking an entry is generally a better first test because its configuration remains available to restore.
• Do not disable all non-Microsoft entries: Third-party security products, touchpad utilities, audio components, cloud clients, and hardware drivers may be essential to normal operation.
• Keep security protection enabled: Do not disable antivirus, endpoint detection, firewall, or authentication components merely to improve startup speed.
• Record every change: Note the entry name, category, publisher, and original state before making changes.
• Use an appropriate backup: Before modifying critical system components, ensure important data is backed up and that you understand your recovery options.
• Use trusted downloads: Obtain Autoruns from the official Microsoft Sysinternals page.

How to Restore a Disabled Entry

If a program or Windows feature stops working after you change an entry, reopen Autoruns with the appropriate permissions and locate the entry you disabled.

1. Open the relevant category and search for the recorded entry name or executable.
2. Inspect the entry to make sure it is the same configuration you changed.
3. Select its checkbox again to re-enable it.
4. Restart Windows or sign out and back in if required.
5. Verify that the affected feature works again.

If you deleted an entry rather than disabling it, simply checking a box may not restore it. The configuration might need to be recreated by repairing or reinstalling the associated application, using its own configuration tool, or following the vendor's recovery procedure.

If Windows no longer starts normally after a change, use an appropriate Windows recovery environment or your organization's established recovery process. Avoid making further changes to unrelated entries while troubleshooting.

Common Misunderstandings About Autoruns

Does Autoruns automatically optimize Windows?

No. Autoruns displays and manages automatic-start configurations. It does not independently determine which entries are safe to remove or guarantee better startup performance. Users must investigate and choose which entries, if any, to disable.

Does hiding Microsoft entries disable them?

No. Hiding Microsoft-signed entries changes the displayed list only. It does not stop those components from running.

Does an unsigned entry mean malware?

No. A missing or invalid signature is one piece of evidence. Check the file path, publisher, application ownership, reputation, and behavior before drawing a conclusion.

Can Autoruns stop every background process?

No. Autoruns focuses on supported automatic-start configurations. It is not a complete inventory of every running process, nor does it provide comprehensive real-time monitoring of process activity.

Can Autoruns replace Task Manager or Services?

No. These tools serve different purposes. Task Manager is useful for observing running processes and resource consumption; the Services console is designed for service management; Autoruns offers broader visibility into automatic-start locations.

Frequently Asked Questions

Is Microsoft Sysinternals Autoruns free?

Microsoft provides Autoruns as part of its Sysinternals utilities. Download the tool from the official Microsoft Sysinternals website and review the applicable software license terms.

Does Autoruns need administrator rights?

Administrator privileges are recommended when examining machine-wide startup entries, services, drivers, and other protected locations. Without sufficient permissions, some entries may be unavailable or incompletely displayed.

Can I use Autoruns to stop an application from starting after every reboot?

Yes, if the application uses an automatic-start entry that Autoruns can identify and manage. Find the responsible entry, verify its purpose, and uncheck it. If the application continues to launch, investigate whether another entry or component is starting it.

Is Autoruns a malware removal tool?

Autoruns helps investigate automatic-start mechanisms and possible malware persistence. It is not a substitute for a dedicated antivirus or endpoint security product and does not guarantee malware detection or removal.

What is the difference between Autoruns and Autorunsc?

Autoruns provides a graphical interface for inspecting and managing entries. Autorunsc is its command-line counterpart, intended for tasks such as inventory collection, filtering, verification, and exporting results for further analysis.

Can Autoruns improve Windows startup speed?

It can help you identify unnecessary automatic-start components, and disabling a confirmed nonessential entry may reduce startup activity. The improvement depends on what is causing the delay; Autoruns cannot guarantee a performance increase.

Should I delete every entry I do not recognize?

No. An unfamiliar entry may belong to legitimate software, a hardware driver, a security product, or a Windows component. Identify the entry and assess its purpose before changing or removing it.

Conclusion

Microsoft Sysinternals Autoruns is a powerful utility for understanding what Windows is configured to launch automatically. Its broad coverage of startup folders, registry entries, scheduled tasks, services, drivers, and other mechanisms makes it valuable for Windows troubleshooting, IT administration, performance investigations, and security analysis.

For everyday startup management, begin with Windows Settings or Task Manager. Use Autoruns when you need deeper visibility, and make changes methodically: identify the entry, verify its purpose, disable only what you understand, and test the result. This approach helps you investigate unwanted startup activity while reducing the risk of disrupting essential Windows functionality.

Sources

• Microsoft Learn: Autoruns for Windows — official documentation, features, usage, and Autorunsc command-line options
• Microsoft Learn: Windows Sysinternals Utilities — official utility collection
• Microsoft Learn: Process Explorer — process inspection and troubleshooting