Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just logged in (Windows 7 x64) and saw RunOnce run with this command line:

C:\Windows\system32\runonce.exe /Explorer

... huh? What's going on?


I know what RunOnce does, but I'm confused as to what /Explorer does; sorry if that was unclear.

share|improve this question
This is a really interesting question. I tried runonce /? and it doesn't offer any documentation. Does it run this every time you log in? – jcrawfordor May 22 '11 at 21:51
@jcrawfordor: Nope, hadn't seen it before; I just saw it run today. – Mehrdad May 22 '11 at 21:53
Did your computer install updates on the previous shutdown? I wonder if this is related to the installation/configuration of updates. – jcrawfordor May 22 '11 at 21:54
@jcrawfordor: Not that I know of... Installed Updates is telling me my last update was on the 13th. No new programs installed either. – Mehrdad May 22 '11 at 21:57
up vote 2 down vote accepted

That is Windows running things listed in your RunOnce key(s) in the registry.

One of them probably just took longer than expected, so you got to see the actual RunOnce.exe window.

EDIT: A little more info:

From here (Bing-translated to English):

Perhaps the most important moment of this phase is the automatic execution of programs present in the key of registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. These programmes are implemented, as its name suggests, only once: at the time that a user with administrative privileges, log on to the machine. There is a programme responsible for carrying out this process: C:\Windows\system32\Runonce.exe. Called the "Runonce.exe /Explorer" command, which, if the user is Administrator of the computer, is responsible for executing the contents of the key RunOnce (which usually are downstream of the installation of a program).

From what I can tell (there's not much info on it), the "/Explorer" switch is what causes RunOnce.exe to be run against each entry in the keys.

share|improve this answer
Yeah I know, but the thing is, why /Explorer? What does that flag do? – Mehrdad May 22 '11 at 21:30
@Mehrdad - There's a bit more info on it for you. but there's really not a lot of info out there about it -- especially the switches; my guess as to why the lack of information is because we, as users, really don't have a reason to run/use the switches (but Windows itself does). – Ƭᴇcʜιᴇ007 May 22 '11 at 22:10
Interesting, so it seems like it's not as interesting as I thought, haha. Thanks for the info! – Mehrdad May 22 '11 at 23:17

In Windows Vista and later, you must use the command RunOnce.exe /explorer to process commands and launch applications which are entered in the registry under


The /Explorer switch is probably intended to prevent you processing these entries at the wrong time - i.e. when a user is already logged on - but this can easily be circumvented by using the switch.

In Windows XP and earlier, RunOnce.exe would process the contents of keys in


when launched without command line switches (which were ignored by the program anyway - unless somebody knows of a valid switch for those versions of RunOnce.exe).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .