How to Inspect Startup Programs in Regedit

The Windows Registry Editor (Regedit) provides a direct method for identifying and managing applications configured to launch automatically when your computer boots or when a user logs in. By navigating specific Run and RunOnce registry keys, administrators and users can inspect startup paths, detect unauthorized persistence mechanisms, and optimize system startup performance.

Step 1: Open the Registry Editor

1. Press Windows Key + R to open the Run dialog box.
2. Type regedit and press Enter.
3. When prompted by the User Account Control (UAC), click Yes to launch the Registry Editor with administrative privileges.

Step 2: Navigate to the User-Specific Startup Keys

User-specific startup keys affect only the currently logged-in user account. In the Registry Editor address bar, navigate to the following paths:

• Current User Run Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Programs listed here run every time this specific user logs in.

• Current User RunOnce Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Programs listed here run once during the next login and are then automatically deleted from the registry.

Step 3: Navigate to the System-Wide Startup Keys

System-wide startup keys affect all users on the machine and run during system initialization or at any user login:

• Machine Run Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Standard 64-bit and system-wide startup applications.

• Machine RunOnce Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce System-wide single-execution tasks, commonly used by installers and updaters.

Step 4: Check 32-bit Applications on 64-bit Windows

On 64-bit versions of Windows, 32-bit programs store their startup entries in the WOW6432Node registry subkeys:

• 32-bit Machine Run Key: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

• 32-bit Machine RunOnce Key: HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce

Step 5: Inspecting and Managing the Values

When you select any of the Run or RunOnce keys, the right pane displays the configured startup items:

• Name: The label or identifier assigned to the startup item.
• Type: The data format (typically REG_SZ or REG_EXPAND_SZ).
• Data: The complete file path and command-line arguments executed at startup.

To modify or remove an entry: * Verify Path: Double-click an entry to view the Value data field and verify that the executable path points to a legitimate application. * Backup: Right-click the parent key (such as Run) and select Export before making changes. * Delete an Entry: Right-click the unwanted string value and select Delete to prevent the program from starting automatically.