Guide

# How to investigate Windows startup entries with Autoruns

Inspect the program, launch location and publisher behind a startup entry before disabling it. Keep a record so the change can be reversed.

In this guide

1. [Define the startup problem](https://feex.it/wiki/software/system/audit-windows-startup-autoruns/#baseline)
2. [Read the entry before changing it](https://feex.it/wiki/software/system/audit-windows-startup-autoruns/#inspect)
3. [Disable one optional entry and test](https://feex.it/wiki/software/system/audit-windows-startup-autoruns/#change)
4. [Restore or remove through the supported owner](https://feex.it/wiki/software/system/audit-windows-startup-autoruns/#restore)

## Define the startup problem

Decide whether the symptom is a slow sign-in, an unwanted application window, recurring background work or an unknown executable. These are different problems. Record when it starts and whether it happens for every account or only yours. Save work before signing out or rebooting for a comparison.

Use the ordinary Windows startup-app controls for a familiar optional application. Autoruns is useful when the launch comes from a less obvious location. It exposes more than the Startup folder, including services, scheduled tasks and other autostart mechanisms.

## Read the entry before changing it

Download Autoruns from Microsoft Sysinternals. Record the entry name, category, full image path, command line and publisher. Use the tool's location and image navigation to inspect where it is configured and which file it launches. A missing file can be an orphaned entry, but confirm the expected installation first.

Enable the relevant signature verification options when investigating publisher identity. A filename alone cannot establish safety. Hiding Microsoft entries can narrow a troubleshooting view, but it is a convenience filter and does not certify the remaining entries as malicious or the hidden entries as faultless.

## Disable one optional entry and test

Prefer unchecking a clearly identified optional entry to deleting it. Record its exact original state. Reboot or sign in again using the same workload and compare the symptom. If the application no longer starts automatically but the slowdown remains, you have learned that the entry was not the whole cause.

Do not disable security software, storage or network drivers, sign-in components, or services needed by a managed device without the responsible administrator's guidance. The fact that an entry can be disabled is not evidence that disabling it is safe.

## Restore or remove through the supported owner

If the change causes a problem or fails to help, re-enable the same entry and confirm normal operation. If you decide to remove the application, use its supported uninstall flow so its services and tasks can be removed together.

For recurring unknown entries, retain the configuration location, command line, signer and file hash. Use Windows Security or your security team for suspicious files. Do not repeatedly delete a Registry value while ignoring the program or policy that recreates it.

## Keep reading

[How to read Task Manager: Related reference](https://feex.it/wiki/software/system/how-to-read-task-manager/)

## Sources

Editorial ownership: Feex. No independent review date is recorded. [How we research](https://feex.it/wiki/research/).

- [Microsoft Sysinternals: Autoruns ](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)· Primary documentation. The diagnostic sequence is Feex editorial guidance; it is not a measured diagnosis of your PC.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Primary documentation. The diagnostic sequence is Feex editorial guidance; it is not a measured diagnosis of your PC.

[Report a correction to Feex](https://feex.it/contact/)

## Was this guide useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/software/system/audit-windows-startup-autoruns/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)