You open Task Manager, head to the Startup tab, disable a handful of apps, and feel pretty good about yourself. It’s a logical way to make your Windows machine start up faster by trimming the low-hanging fruit. But I’m sorry to tell you that what you just did was the equivalent of weeding your garden while ignoring the roots growing three feet underground.
The roots, the ones chewing through your RAM and stretching your boot time like taffy, are hiding somewhere you’ve probably never looked. To find them, you need a different approach. There’s a free tool from Microsoft’s own Sysinternals suite called Autoruns, and once you run it, you’ll never trust Task Manager’s startup list again.
Task Manager only shows you a fraction of what’s actually launching at startup
Autoruns exposes the rest
Think of Task Manager’s Startup tab as the lobby of a nice hotel. It’s clean, organized, and designed to make a good impression. What you don’t see is the activity happening in the service corridors behind the walls. According to Microsoft’s own documentation for Autoruns, Windows actually contains more than 200 Autostart Extensibility Points (ASEPs). We’re talking registry keys, scheduled tasks, services, shell extensions, browser helper objects, Winlogon notifications, AppInit DLLs, Winsock providers, and a long list of other hooks. Task Manager only surfaces the very top layer of that iceberg.
The practical impact of that blind spot is quite significant. A program can completely bypass the standard Run registry key, the one Task Manager watches, and instead hook itself into a scheduled task set to trigger at logon. Or a shell extension that loads every time File Explorer opens. Or even a Winsock layered service provider that piggybacks on your network stack. None of these shows up in Task Manager, and all of them can drag down your system.
And so, to really dig out all of them, you need Autoruns. It requires no installation; extract the ZIP file, right-click Autoruns64.exe, and run the program as an administrator. That last part matters because, without elevated privileges, certain ASEP locations remain hidden, and some entries can’t be modified.
Autoruns maps every shadowy corner of your system
Where programs burrow in to survive a reboot
After you load Autoruns, the sheer density of the interface can feel like stepping into a cockpit. There are 19 category tabs across the top: Logon, Explorer, Internet Explorer, Scheduled Tasks, Services, Drivers, Codecs, to name a few, and each one is a different hiding spot.
By default, you’ll land on the Everything tab. It’s exactly what it sounds like. One long, scrollable list of every autostart entry on your system, arranged in roughly the same order as Windows processes them during boot. At first glance, it looks overwhelming, but Autoruns does a few clever things to help you make sense of it.
One of the most helpful is the color-coding. Entries highlighted in yellow usually point to files that no longer exist, basically leftover registrations from programs that were uninstalled but didn’t clean up after themselves. Pink or red entries indicate items without a valid digital signature, which doesn’t automatically mean trouble, but it’s usually worth a closer look. Green usually appears when comparing two different Autoruns scans to show new entries added since the previous save, while purple highlights the specific path/location of an entry, such as in the Task Scheduler.
There’s also a setting that makes this even more useful. If you enable Options -> Scan Options -> Verify Code Signatures, Autoruns checks each entry’s cryptographic signature against its listed publisher. It’s a quick way to spot anything that might have been tampered with or masquerading as something legitimate.
Once you move beyond the Everything tab, the other categories start to make more sense. Each one corresponds to a different kind of autostart location:
- Logon covers the familiar territory: the Windows startup folder, Run, and RunOnce registry keys. This is roughly what Task Manager shows you, and even here Autoruns goes deeper by listing the exact registry paths and file locations for every entry.
- Scheduled Tasks is where you’ll find apps that register scheduled tasks that trigger at logon or at boot, and are entirely invisible to Task Manager. You’ll likely find cloud sync services, update managers, and occasionally software you thought you’d uninstalled months ago, still clocking in every morning.
- Services and Drivers expose the lower-level machinery: Windows services configured to launch automatically, and kernel-mode drivers that load before your desktop even appears. This is territory you want to tread carefully, but it’s invaluable for fixing slow boot times or tracking down persistent software issues.
- Explorer reveals shell extensions, which are the little additions that software installs into File Explorer for right-click menus and preview pane features. These load every time Explorer opens, which, on a cluttered system, can add up to a meaningful performance cost.
- Winsock Providers is one of the more obscure tabs, and one of the more telling. As Sysinternals notes, malware has historically favored this location because so few tools can detect or remove entries there. Autoruns can at least disable them, which gives you a foothold.
Right-clicking any entry brings up options to jump directly to the registry key behind it, open the file’s location in Explorer, search for it online, or submit it to VirusTotal for a multi-engine malware scan. All without leaving the app.
You don’t need to understand all of Autoruns to benefit from most of it
Don’t panic, just filter
The trick to not getting overwhelmed in Autoruns is learning to filter things down before you start investigating. Head to the Options menu and enable both Hide Windows Entries and Hide Microsoft Entries. That trims out the verified Windows components and Microsoft-signed software, leaving you with just the third-party items. The list then becomes much more manageable.
That said, it’s worth doing one thing first. Take a quick pass through the Everything tab with the filters turned off. Just once. It gives you a sense of how much activity Windows is juggling behind the curtain every time you sign in. Scroll through it, take in the scale of it all, then flip the filters back on and start focusing on the entries that actually matter.
When you run into something unfamiliar, try not to nuke it on sight. Autoruns is built around reversible decisions. If you uncheck an entry, it is simply disabled without being removed. If something odd happens after a reboot, you can check the box again, and everything snaps back to normal. Deleting an entry, on the other hand, is final. The safer approach is to disable it first, restart the system, and only remove it once you’re sure nothing important depends on it.
5 things you should never disable at Windows startup (unless you want a broken PC)
Keep Windows working nicely.
Task Manager had one job
Treat Autoruns like occasional housekeeping. Run it every few months, or whenever you install software that seems a little too eager to stick around. Over time, you start to see a much clearer picture of what your machine is actually doing when you’re not paying attention.
- OS
-
Windows
- Developer
-
Microsoft (Sysinternals)
- Price model
-
Free
Autoruns reveals every program configured to start automatically on your Windows system, far beyond what Task Manager shows. It helps you track down hidden startup entries, troubleshoot slow boots, and keep unwanted software from launching.
