7
Are Windows 10 startup programs initiated in a specific sequence, such as alphabetical or CPU impact order, or are they all initiated simultaneously?
Are there special cases in which programs are given preference from others, such as Windows Defender loading first for security purposes?
enriquejr99
Posted 2018-12-07T05:40:16.437
Reputation: 175
7
Windows launches on startup the programs in parallel, but in groups, as follows:
Windows Boot Device Drivers, having a Start value equal to 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Windows Auto-start Services & Drivers, having a Start value equal to 2
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Windows delayed Auto-start Services & Drivers, having a Start value equal to 2
and DelayedAutostart equal to 1:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Run Services Once only:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
Run Services permanently:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
After the user logs on, the order is as follows :
Notify of the logon event:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
User Initialization:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Shell:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
ShellServiceObjectDelayLoad pointing to CLSID InProcServer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
RunOnce Local Machine Key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
Run permanently:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
RunOnce Current User Key (mostly for installations):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Explorer Run:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Load Key (deprecated):
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
SharedTaskScheduler:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
AppInit_DLLs:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
All Users Startup Folder:
C:\Users\All Users\Start Menu\Programs\Startup
User Profile Startup Folder :
C:\Users\username\Start Menu\Programs\Startup
Sources :
harrymc
Posted 2018-12-07T05:40:16.437
Reputation: 306 093
Good answer. I also want to note that some services can have a delayed start to ensure other services start first (hopefully), or to lessen startup time impact. With so many services and applications starting, there completion times can vary heavily under load. And to address the OPs question, Windows Defender is a service, the application seen in the task tray loads later. – Keltari – 2018-12-07T16:39:45.883
Note that some of the above don't exist any more in modern Windows versions. – harrymc – 2019-09-06T10:10:24.957
The order is unspecified (except defined by dependence - for example, none programs can start from HKCU/Soft/MS/Win/CurVer/Run or from Autostart menu folder until explorer.exe is started). And no preferences. – Akina – 2018-12-07T06:55:30.230
Security software often includes system drivers which are loaded before regular applications. It's a broad field so you likely would need to be more specific. What's the order of Windows startup on StackOverflow might be interesting. The part about the logon phase especially.
– Seth – 2018-12-07T07:22:09.640