01Compare the routes
Filter by startup phase. The table works without JavaScript; filters only narrow visible records.
| Mechanism | Phase | Scope | Inspect with | Record |
|---|---|---|---|---|
| Startup applications | Sign-in | Current user / package | Settings or Task Manager | Read record |
| Startup folders | Sign-in | Current user / all users | File Explorer or Run | Read record |
| Run and RunOnce keys | Sign-in | Current user / machine | Registry Editor or Autoruns | Read record |
| Packaged startup tasks | Application activation | Package / user consent | Settings and app controls | Read record |
| Scheduled task triggers | Boot or sign-in | User or machine | Task Scheduler or schtasks | Read record |
| Automatic services | Service startup | Machine / service account | Services | Read record |
| Extended Autoruns locations | Several phases | Varies by location | Microsoft Autoruns | Read record |
| Permanent WMI consumers | Event-driven | Machine | Autoruns and WMI inspection | Read record |
02Read the fields in order
Phase tells you when a mechanism is meant to run. Scope tells you who or what it affects. The inspection tool is the least intrusive place to begin. The last field is a practical boundary, not a safety rating.
03Mechanism records
Sign-in
Startup applications
- Scope
- Current user / package
- Inspect
- Settings or Task Manager
- Least destructive move
- Disable first
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Configure Startup applications in Windows.
Sign-in
Startup folders
- Scope
- Current user / all users
- Inspect
- File Explorer or Run
- Least destructive move
- Restore shortcut
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Configure Startup applications in Windows.
Sign-in
Run and RunOnce keys
- Scope
- Current user / machine
- Inspect
- Registry Editor or Autoruns
- Least destructive move
- Document before change
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Run and RunOnce Registry Keys.
Application activation
Packaged startup tasks
- Scope
- Package / user consent
- Inspect
- Settings and app controls
- Least destructive move
- Change permission
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Configure Startup applications in Windows.
Boot or sign-in
Scheduled task triggers
- Scope
- User or machine
- Inspect
- Task Scheduler or schtasks
- Least destructive move
- Disable before delete
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: schtasks commands.
Service startup
Automatic services
- Scope
- Machine / service account
- Inspect
- Services
- Least destructive move
- Change configuration carefully
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Database of Installed Services.
Several phases
Extended Autoruns locations
- Scope
- Varies by location
- Inspect
- Microsoft Autoruns
- Least destructive move
- Inspect selectively
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Autoruns.
Event-driven
Permanent WMI consumers
- Scope
- Machine
- Inspect
- Autoruns and WMI inspection
- Least destructive move
- Observe first
- Source checked
- August 23, 2026
CautionA documented location is not a safety verdict. Identify its purpose before a change.
Primary basis: Monitoring Events.
04Coverage and limits
This launch version normalizes mechanisms documented in the cited Microsoft pages. It does not claim every configuration, executable, timing outcome, or security verdict. A field without an explicit source is left out rather than inferred.
Continue from here
Sources for this page
- Configure Startup applications in WindowsMicrosoft Support
- Run and RunOnce Registry KeysMicrosoft Learn
- schtasks commandsMicrosoft Learn
- AutorunsMicrosoft Learn, Sysinternals
- Monitoring EventsMicrosoft Learn