Are Windows 10 startup programs initiated in a specific sequence, such as alphabetical or CPU impact order, or are they all initiated simultaneously?

Are there special cases in which programs are given preference from others, such as Windows Defender loading first for security purposes?

  • The order is unspecified (except defined by dependence - for example, none programs can start from HKCU/Soft/MS/Win/CurVer/Run or from Autostart menu folder until explorer.exe is started). And no preferences. – Akina Dec 7 at 6:55
  • Security software often includes system drivers which are loaded before regular applications. It's a broad field so you likely would need to be more specific. What's the order of Windows startup on StackOverflow might be interesting. The part about the logon phase especially. – Seth Dec 7 at 7:22
up vote 1 down vote accepted

Windows launches on startup the programs in parallel, but in groups, as follows:

  • Windows Boot Device Drivers, having a Start value equal to 0
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  • Windows Auto-start Services & Drivers, having a Start value equal to 2
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  • Windows delayed Auto-start Services & Drivers, having a Start value equal to 2 and DelayedAutostart equal to 1:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

  • Run Services Once only:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

  • Run Services permanently:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

After the user logs on, the order is as follows :

  • Notify of the logon event:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

  • User Initialization:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

  • Shell:
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

  • ShellServiceObjectDelayLoad pointing to CLSID InProcServer:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

  • RunOnce Local Machine Key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

  • Run permanently:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

  • RunOnce Current User Key (mostly for installations):
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

  • Explorer Run:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

  • Load Key (deprecated):
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

  • SharedTaskScheduler:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

  • AppInit_DLLs:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

  • All Users Startup Folder:

    C:\Users\All Users\Start Menu\Programs\Startup
    
  • User Profile Startup Folder :

    C:\Users\username\Start Menu\Programs\Startup
    

Sources :

  • Good answer. I also want to note that some services can have a delayed start to ensure other services start first (hopefully), or to lessen startup time impact. With so many services and applications starting, there completion times can vary heavily under load. And to address the OPs question, Windows Defender is a service, the application seen in the task tray loads later. – Keltari Dec 7 at 16:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.