Autoruns for Windows v13.98

By Mark Russinovich

Published: June 24, 2020

Download Autoruns and Autorunsc (2.5 MB)
Run now from Sysinternals Live.

Introduction

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys. AutorunsВ reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more.В Autoruns goes way beyond other autostart utilities.

Autoruns‘В Hide Signed Microsoft EntriesВ option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.

You’ll probably be surprised at how many executables are launched automatically!

Screenshot

Usage

Simply runВ AutorunsВ and it shows you the currently configured auto-start applications as well as the full list of Registry and file system locations available for auto-start configuration. Autostart locations displayed by Autoruns include logon entries, Explorer add-ons, Internet Explorer add-ons including Browser Helper Objects (BHOs), Appinit DLLs, image hijacks, boot execute images, Winlogon notification DLLs, Windows Services and Winsock Layered Service Providers, media codecs, and more. Switch tabs to view autostarts from different categories.

To view the properties of an executable configured to run automatically, select it and use theВ PropertiesВ menu item or toolbar button. If Process ExplorerВ is running and there is an active process executing the selected executable then theВ Process ExplorerВ menu item in theВ EntryВ menu will open the process properties dialog box for the process executing the selected image.

Navigate to the Registry or file system location displayed or the configuration of an auto-start item by selecting the item and using theВ JumpВ to Entry menu item or toolbar button, and navigate to the location of an autostart image.

To disable an auto-start entry uncheck its check box. To delete an auto-start configuration entry use theВ DeleteВ menu item or toolbar button.

The Options menu includes several display filtering options, such as only showing non-Windows entries, as well as access to a scan options dialog from where you can enable signature verification and Virus Total hash and file submission.

Select entries in theВ UserВ menu to view auto-starting images for different user accounts.

More information on display options and additional information is available in the on-line help.

Autorunsc Usage

Autorunsc is the command-line version of Autoruns. Its usage syntax is:

Usage: autorunsc [-a ] [-c|-ct] [-h] [-m] [-s] [-u] [-vt] [[-z ] | [user]]]

Parameter	Description
-a	Autostart entry selection:
*	All.
b	Boot execute.
d	Appinit DLLs.
e	Explorer addons.
g	Sidebar gadgets (Vista and higher)
h	Image hijacks.
i	Internet Explorer addons.
k	Known DLLs.
l	Logon startups (this is the default).
m	WMI entries.
n	Winsock protocol and network providers.
o	Codecs.
p	Printer monitor DLLs.
r	LSA security providers.
s	Autostart services and non-disabled drivers.
t	Scheduled tasks.
w	Winlogon entries.
-c	Print output as CSV.
-ct	Print output as tab-delimited values.
-h	Show file hashes.
-m	Hide Microsoft entries (signed entries if used with -v).
-s	Verify digital signatures.
-t	Show timestamps in normalized UTC (YYYYMMDD-hhmmss).
-u	If VirusTotal check is enabled, show files that are unknown by VirusTotal or have non-zero detection, otherwise show only unsigned files.
-x	Print output as XML.
-v[rs]	Query VirusTotal for malware based on file hash. Add ‘r’ to open reports for files with non-zero detection. Files reported as not previously scanned will be uploaded to VirusTotal if the ‘s’ option is specified. Note scan results may not be available for five or more minutes.
-vt	Before using VirusTotal features, you must accept the VirusTotal terms of service. If you haven’t accepted the terms and you omit this option, you will be interactively prompted.
-z	Specifies the offline Windows system to scan.
user	Specifies the name of the user account for which autorun items will be shown. Specify ‘*’ to scan all user profiles.

Related Links

• Windows Internals Book The official updates and errata page for the definitive book on Windows internals, by Mark Russinovich and David Solomon.
• Windows Sysinternals Administrator’s Reference The official guide to the Sysinternals utilities by Mark Russinovich and Aaron Margosis, including descriptions of all the tools, their features, how to use them for troubleshooting, and example real-world cases of their use.

Download

Download Autoruns and Autorunsc (2.5 MB)
Run now from Sysinternals Live.

Location of the Startup folder in Windows 10

The Startup folder in Windows 10 contains a list of shortcuts of those applications that start when your Windows start. Earlier, you could easily access the Windows 7 startup folder from Start Menu > Startup. But where is the Startup folder in Windows 10/8?

Windows 10 startup folder location

To open the Startup folder in Windows 10, open Run box and:

• Type shell:startup and hit Enter to open the Current Users Startup folder
• Type shell:common startup and hit Enter to open the All Users Startup folder.

The Current Users Startup folder in Windows 10 is located at:

These programs start up for the current logged in user only. To directly access this folder, open Run, type shell:startup and hit Enter.

Or to quickly open the folder, press WinKey, type shell:startup and hit Enter.

Startup folder in Windows 10

The All Users Windows 10 startup folder is located at:

These programs start up for all users. To open this folder, bring up the Run box, type shell:common startup and hit Enter.

Or to open the folder quickly, you can press WinKey, type shell:common startup and hit Enter.

You can add shortcuts of the programs you want to start with your Windows in this folder.

You may use msconfig in Windows 7 or Task Manager in Windows 10 to manage startup programs. You can also delay Startup Programs or control the order in which they load when Windows boots.

This post on Windows Registry Startup Paths may also interest you.

TIP: You might want to check out our TWC Video Hub which offers a lot of interesting videos, including How-Tos and Tutorials.

Windows all users autostart

This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.

Asked by:

Question

I need to disable the auto-start of Teams for all users.

I know it can be done manually within the app but I need to do it remotely to stop Teams from hogging all the CPU and RAM resource in every login. They can use the app in a browser and it is much less hungry then so until MS sort out the performance problems with Teams it can only be used on mediocre machines in a web browser.

If I remove the registry key that launches Teams under HKCU\Software\Microsoft\Windows\CurrentVersion\Run it is recreated the next time Teams launches so that’s no good.

Has anyone else managed to do this?

All replies

Based on my test, when open Teams client, it will generate the following registry:

If modified the registry key, after restarting the Teams, it will generate the registry key automatically, so in my opinion, it may be not achieved by the group policy.

If you don’t want to use desktop client, you can uninstall it like Vasil L mentioned.

Best Regards,
Alice Wang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

I have same issue and nothing seemed to work.

Still Testing, but this seems to work so far.

GPO loggoff script

$path = ‘C:\users\’+$env:USERNAME+’\appdata\roaming\microsoft\teams\desktop-config.json’
$config = Get-Content -Path $path
$config.Replace(‘»openAtLogin»:true’,'»openAtLogin»:false’)|out-file $path

might need a few reboots.

It took me all morning but I finally figured out a way to disable the auto-start of Teams for all users during install.

Hopefully this helps someone else.

It’s so annoying that we have to go through this rigmarole to perform a simple task like disabling teams on startup. We’ve been getting VB script errors with teams on login, but simply didn’t have the time to troubleshoot the error. This resulted in a lot of extremely annoyed staff and students who were presented with a window they didn’t know how to / couldn’t close, right at the time when our department are under the usual pressures at the start of a school year. We couldn’t find a simple method to disable it, and there weren’t any admx templates to offer any kind of control over it in our domain, unlike onedrive (thank goodness).
I realise we can just block it at startup, but with the latest W10 version, fresh installs across the site, and a rather costly MS licensing package, I’m amazed at how poorly implemented the development of this, and onedrive have been. Rather than releasing some half-finished app, or coming to the conclusion that consolidation of business and single user onedrive versions are better, and (most annoyingly) trying to find documentation for the relevant versions, whilst frantically dealing with annoyed users. How about just not releasing it until it’s suitable for use in a domain environment, (or at least just stating it’s not ready for domains yet)?

p.s. it’s not aimed at you Alice, I just felt the need to vent about this!

It’s so annoying that we have to go through this rigmarole to perform a simple task like disabling teams on startup. We’ve been getting VB script errors with teams on login, but simply didn’t have the time to troubleshoot the error. This resulted in a lot of extremely annoyed staff and students who were presented with a window they didn’t know how to / couldn’t close, right at the time when our department are under the usual pressures at the start of a school year. We couldn’t find a simple method to disable it, and there weren’t any admx templates to offer any kind of control over it in our domain, unlike onedrive (thank goodness).
I realise we can just block it at startup, but with the latest W10 version, fresh installs across the site, and a rather costly MS licensing package, I’m amazed at how poorly implemented the development of this, and onedrive have been. Rather than releasing some half-finished app, or coming to the conclusion that consolidation of business and single user onedrive versions are better, and (most annoyingly) trying to find documentation for the relevant versions, whilst frantically dealing with annoyed users. How about just not releasing it until it’s suitable for use in a domain environment, (or at least just stating it’s not ready for domains yet)?