Autoruns is a Windows Sysinternals utility for inspecting and managing automatic startup entries, helping administrators investigate logon programs, services, drivers, scheduled tasks, and other persistent launch configurations.
Autoruns is a Windows Sysinternals utility that identifies software configured to start automatically and lets you inspect or change those startup entries. It examines more than the familiar startup folder, covering services, drivers, scheduled tasks, Explorer extensions, and other launch mechanisms. Administrators and experienced users can investigate recurring background applications, unwanted logon behavior, or components left behind by software changes. Results connect each entry with its configuration location and associated executable, giving an investigation a concrete starting point. The graphical interface supports interactive review, while the included Autorunsc command-line tool produces structured output for reporting and repeatable checks.
Autoruns distinguishes startup configuration from live process activity, so an entry can appear even when its associated program is not currently running. Extract the downloaded ZIP and run the appropriate executable to begin reviewing entries. Windows Terminal can host a PowerShell session running Autorunsc, making startup reports easier to collect alongside other administrative commands. Signature verification and optional VirusTotal queries add context, but neither replaces investigation of a file's purpose and origin. Online reputation checks require connectivity, and file submission is a separate consideration from hash lookup. Disabling an entry changes its launch configuration; deleting that entry does not uninstall the associated application.
Autoruns helps you narrow startup troubleshooting to identifiable components instead of changing unrelated Windows settings. Reviewing a program's launch location, publisher information, and executable path gives you evidence to connect unwanted behavior with a specific entry. Temporarily disabling a known nonessential component supports a controlled test, with a clearer recovery path than immediately deleting its configuration. Filtering familiar Microsoft entries can reduce the amount of information to review when investigating third-party additions, while retaining the option to inspect the full inventory. Exported reports also give support staff a concrete record to discuss and compare during an investigation. For shared computers, account-specific inspection helps explain why one person experiences a logon issue that another does not. The practical outcome is more deliberate maintenance: fewer speculative changes, better documentation of what was examined, and a clearer distinction between removing an automatic launch point and removing the software itself.
Key capabilities and highlights.
Autoruns examines multiple automatic launch mechanisms, including logon entries, services, drivers, scheduled tasks, and Explorer extensions. Category tabs help you focus on the type of component under investigation. This broader inventory is useful when an application starts through a mechanism that is not visible in a basic startup-app list.
Entry checkboxes let you disable automatic launch configurations without immediately deleting them. This supports testing whether a particular component contributes to unwanted logon behavior. Change one understood entry at a time and verify the result; disabling essential services or drivers can affect functionality and should not be treated as routine cleanup.
Display filters in Autoruns can hide Microsoft entries so third-party additions are easier to examine. This reduces visual clutter during an investigation of recently installed software or unfamiliar startup components. Filtering changes what you see, not what runs, and a hidden or signed entry should not automatically be considered harmless.
Signature verification checks signing information for executables associated with startup entries. Use the result alongside file paths, publisher details, and expected application behavior when deciding what to investigate. A missing signature is a reason to examine context, while a valid signature alone does not establish that a component is appropriate.
Optional VirusTotal integration queries file hashes for available detection results, helping prioritize unfamiliar entries for further review. Autoruns also offers file submission options for additional analysis. Distinguish reputation lookup from uploading a file, and interpret detections in context because an isolated result or an unknown file is not conclusive.
Navigation commands take you from a selected entry to its configuration location or associated executable. Inspecting the underlying Registry entry, file location, and executable properties helps establish how a component starts. This is useful when a display name is unclear or you need supporting details before documenting a change.
The User menu lets you inspect startup entries associated with other accounts on the computer. This helps investigate software that launches for one person but not another. Account-specific review provides context for shared workstations, where different user configurations can produce different logon behavior even though the installed operating system is shared.
Autorunsc, included with Autoruns, produces startup inventories from the command line and supports CSV, tab-delimited, and XML output. Options select entry categories and include details such as hashes or signature verification. Structured reports can be reviewed in other tools or collected consistently during repeated administrative checks and support investigations.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about Autoruns.
It is available without a purchase charge, but it is proprietary Sysinternals software. Free availability does not make it open source; use is governed by Microsoft's applicable software license terms.
No. It exposes startup configurations and provides investigation tools, including optional reputation checks. Disabling a malicious launch entry does not establish that all related files, processes, or persistence mechanisms have been removed.
For troubleshooting an understood, nonessential component, disabling generally provides an easier way to reverse the change. Deleting removes the startup configuration entry. Neither action should be applied indiscriminately to unfamiliar drivers, services, or Windows components.
No. Disabling changes the selected automatic launch configuration. The program's files remain, and it may still run manually or through another startup mechanism. Use the application's uninstall method when you intend to remove the software.
Local startup enumeration can be performed without internet access. VirusTotal queries and file submissions require an online connection. Those optional checks add external reputation information rather than supplying the underlying local startup inventory.
Autoruns is a Windows Sysinternals utility for inspecting and managing automatic startup entries, helping administrators investigate logon programs, services, drivers, scheduled tasks, and other persistent launch configurations.
TreeSize is a disk space analyzer that scans drives, folders, and network shares, then shows exactly which subfolders and files are consuming storage so you can decide what to delete, archive, or move.
Microsoft .NET Windows Desktop Runtime 8.0 provides the shared components required to run compatible Windows Forms and WPF desktop applications without installing the complete .NET software development kit.
Microsoft .NET Runtime 8.0 provides the execution engine and core libraries needed to run compatible .NET applications, especially framework-dependent console programs, without installing the complete software development kit.
Adobe Acrobat Reader (32-bit) is a PDF viewing application for opening, reading, searching, printing, commenting on, completing, and signing compatible documents without advanced PDF authoring tools.
Comments