A free, open-source educational knowledge base for system administrators and security analysts. Learn how to audit, interpret, and safely manage every autostart location on a Windows machine.
100% free to read. No sign-up, no email, no downloads hosted on this site.
Understanding why a full-spectrum autostart auditor beats checking Task Manager's limited startup tab alone.
Enumerates registry Run keys, services, scheduled tasks, drivers, shell extensions, and dozens of other autostart hooks that Task Manager never surfaces.
Cross-references every entry against its publisher's code signature, instantly flagging unsigned or unverifiable binaries that deserve closer inspection.
Optionally submits file hashes to VirusTotal directly from the interface, surfacing detection ratios for every startup binary without leaving the tool.
Follow this sequence to go from an unaudited machine to a fully reviewed, hardened startup configuration.
Autoruns is developed and distributed exclusively by Microsoft as part of the Sysinternals suite. For the actual executable, always use the official Microsoft Learn Sysinternals page: learn.microsoft.com/sysinternals/downloads/autoruns. This website never hosts or mirrors the executable itself.
Autoruns is part of the Microsoft Sysinternals suite. To ensure you receive a clean, unmodified, and up-to-date build, only obtain it from the official Microsoft Learn / Sysinternals domain. Avoid third-party mirrors, forum attachments, or unofficial archive sites, which may bundle outdated or altered binaries.
Launch Autoruns as an administrator and let it enumerate all categories across the tab bar — Logon, Explorer, Services, Scheduled Tasks, Drivers, and more. Enable Options → Hide Microsoft Entries to strip out signed OS components and focus purely on third-party additions.
Enable Options → Verify Code Signatures and Check VirusTotal.com. Sort the entry list by the Publisher column: anything showing (Not verified) or a blank publisher deserves closer inspection before you trust it to run at boot.
Uncheck the checkbox next to a suspicious entry instead of using Delete. This disables the autostart hook non-destructively, letting you reboot and confirm system stability before permanently removing anything — a reversible first step that reduces the risk of breaking a legitimate dependency.
Autoruns walks dozens of registry hives and file-system locations to build a single unified view — understanding its sources helps you know exactly where an entry lives before you touch it.
Each tab — Logon, Explorer, Internet Explorer, Scheduled Tasks, Services, Drivers, Codecs, Boot Execute — represents a distinct persistence mechanism scanned independently.
Each entry's on-disk image is hashed and checked against Authenticode signatures, then optionally submitted to VirusTotal to surface community detection ratios.
The bundled autorunsc.exe exposes the same scan engine for scripted, unattended, or remote fleet-wide auditing via CSV or XML export.
Plain-language definitions of the terminology you'll encounter throughout this manual.
A quick-reference table of the most frequently encountered Autoruns scenarios and their documented remedies.
| Issue | Likely Cause | Recommended Fix |
|---|---|---|
| Scan takes an unusually long time to complete | VirusTotal lookups or hash verification enabled on a machine with hundreds of drivers and services. | Temporarily disable "Check VirusTotal.com" and scan a narrower set of tabs first, then re-enable it for a final targeted pass. |
| Legitimate entry disappeared after disabling | Some ASEPs (notably services) require the checkbox to remain unchecked and a reboot to fully apply the change. | Re-check the entry to restore it immediately, or reboot once to confirm whether the disable was intentional before deciding. |
| Entry shows blank or "(Verified)" incorrectly | Local certificate store cache is stale, or the machine has no internet access to validate the certificate chain. | Refresh the scan with F5 after confirming network/DNS connectivity, or manually inspect the file's Properties → Digital Signatures tab. |
| Removed entry reappears after next reboot | A parent scheduled task, service, or group policy is silently re-creating the autostart hook on startup. | Search Task Scheduler and Group Policy for the associated binary name, and disable the recreating mechanism at its source. |
| "Access is denied" when deleting an entry | Autoruns was not launched with administrative privileges, or the key is protected by a security product. | Relaunch Autoruns via "Run as administrator" and temporarily pause endpoint protection if it is actively blocking the registry write. |
Transparency about what this resource is, and what it deliberately is not.
No. This website does not host, distribute, or sell any installer, .msi, or .exe file. We only provide educational documentation and point readers toward the official Microsoft Sysinternals deployment channels for the actual software.
No. This is a 100% independent, unofficial knowledge base created by system administrators for educational purposes. We have no affiliation, sponsorship, or endorsement from Microsoft Corporation or the Sysinternals team.
Never. Every module on this page is freely readable with no registration, paywall, or email capture of any kind. There is nothing to purchase and no premium tier.
We cover autostart location taxonomy, signature and reputation verification, safe disable-versus-delete practice, autorunsc scripting, and common troubleshooting scenarios encountered by administrators auditing endpoint fleets.