Are Windows 10 startup programs initiated in a specific sequence, such as alphabetical or CPU impact order, or are they all initiated simultaneously?

Are there special cases in which programs are given preference from others, such as Windows Defender loading first for security purposes?

  • The order is unspecified (except defined by dependence - for example, none programs can start from HKCU/Soft/MS/Win/CurVer/Run or from Autostart menu folder until explorer.exe is started). And no preferences. – Akina Dec 7 '18 at 6:55
  • Security software often includes system drivers which are loaded before regular applications. It's a broad field so you likely would need to be more specific. What's the order of Windows startup on StackOverflow might be interesting. The part about the logon phase especially. – Seth Dec 7 '18 at 7:22

Windows launches on startup the programs in parallel, but in groups, as follows:

  • Windows Boot Device Drivers, having a Start value equal to 0

  • Windows Auto-start Services & Drivers, having a Start value equal to 2

  • Windows delayed Auto-start Services & Drivers, having a Start value equal to 2 and DelayedAutostart equal to 1:

  • Run Services Once only:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

  • Run Services permanently:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

After the user logs on, the order is as follows :

  • Notify of the logon event:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

  • User Initialization:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit

  • Shell:
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

  • ShellServiceObjectDelayLoad pointing to CLSID InProcServer:

  • RunOnce Local Machine Key:

  • Run permanently:

  • RunOnce Current User Key (mostly for installations):

  • Explorer Run:

  • Load Key (deprecated):
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

  • SharedTaskScheduler:

  • AppInit_DLLs:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

  • All Users Startup Folder:

    C:\Users\All Users\Start Menu\Programs\Startup
  • User Profile Startup Folder :

    C:\Users\username\Start Menu\Programs\Startup

Sources :

  • Good answer. I also want to note that some services can have a delayed start to ensure other services start first (hopefully), or to lessen startup time impact. With so many services and applications starting, there completion times can vary heavily under load. And to address the OPs question, Windows Defender is a service, the application seen in the task tray loads later. – Keltari Dec 7 '18 at 16:39
  • Note that some of the above don't exist any more in modern Windows versions. – harrymc Sep 6 '19 at 10:10
  • What's not listed here are logon and startup scripts, both GPO and AD profile versions. I know they are before the Startup folders, but not sure where in this list exactly. – Keith Davis Apr 8 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.