Service Startup Types and Binary Paths in Regedit

This article outlines the specific Windows Registry locations where system-wide service configurations are stored. It details the exact registry keys responsible for managing individual services, how to locate their binary executable paths, and how the system defines their startup types using numeric values.

The Registry Location for Windows Services

All system-wide Windows services are defined individually under the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Under this key, each service has its own dedicated subkey named after the service’s short name (for example, wuauserv for Windows Update or Spooler for the Print Spooler).

Binary Path Configuration (ImagePath)

The path to the executable file that runs the service is defined by the ImagePath value located inside the specific service subkey.

• Value Name: ImagePath
• Data Type: REG_EXPAND_SZ or REG_SZ
• Description: Contains the fully qualified path to the binary executable, often including command-line arguments and environment variables (such as %SystemRoot%\System32\svchost.exe -k netsvcs).

Service Startup Type Configuration (Start)

The startup behavior of a service is controlled by the Start value inside the service subkey.

• Value Name: Start
• Data Type: REG_DWORD

The numeric data assigned to the Start value corresponds to the following startup types:

• 0 (Boot): Loaded by the operating system kernel loader during the initial boot phase. This is reserved for core drivers.
• 1 (System): Loaded during the operating system initialization phase by the I/O subsystem.
• 2 (Automatic): Started automatically by the Service Control Manager (SCM) during normal system startup.
• 3 (Manual): Configured to start only when requested by a user, application, or dependent service.
• 4 (Disabled): Prevented from starting under any circumstances until re-enabled.

Automatic (Delayed Start)

For services configured with an Automatic (Delayed Start) startup type, the Start value remains set to 2, and an additional DWORD value named DelayedAutoStart is present with a value of 1. If DelayedAutoStart is set to 0 or absent, the service starts immediately at boot.