Windows · Windows Utilities
Autoruns for Windows
Sysinternals utility from Microsoft that lists every location Windows can auto-start software from, for diagnosing startup items and malware persistence.
Updated August 9, 2026 · Reviewed by SoftNexi Editorial Team, Software research and documentation
Overview
Autoruns is part of the Sysinternals suite, a set of advanced Windows diagnostic utilities originally created by Mark Russinovich and now published by Microsoft on Microsoft Learn. It shows every location Windows checks when deciding what to launch automatically — far beyond the Startup folder or Task Manager's Startup tab — including services, scheduled tasks, drivers, browser helper objects, and dozens of registry auto-start points.
Like other Sysinternals tools, Autoruns is a portable, no-install utility: you download a ZIP file, extract it, and run the executable directly, with no setup wizard and no persistent installation footprint. This makes it easy to run on a machine you are diagnosing without leaving software behind afterward.
It is primarily used by IT professionals and advanced users to find and disable unwanted or suspicious startup entries, including malware persistence mechanisms that hide in less obvious auto-start locations that Task Manager does not show. Autoruns can also flag unsigned entries and, with an internet connection, check entries against VirusTotal.
It is not a beginner tool — disabling the wrong entry can affect system stability or security software — but for anyone comfortable reviewing what is configured to run automatically, it is far more thorough than any built-in Windows startup view.
Key features
- Lists auto-start entries from logon, services, scheduled tasks, drivers, and browser add-ons
- Portable, no-install executable distributed as a ZIP
- Optional VirusTotal check for listed entries when connected to the internet
- Highlights unsigned or unverified entries
- Command-line version (Autorunsc) for scripting and scheduled audits
- Ability to disable or delete individual auto-start entries directly
System requirements
- Operating system
- Windows 11 and Windows 10 (also supports older Windows releases)
- Distribution
- Portable, no-install ZIP download from Microsoft Learn's Sysinternals pages
- Permissions
- Administrator rights required to view and modify most auto-start locations
How to install Autoruns
1. Download from Microsoft Learn
Open the Autoruns page on learn.microsoft.com/sysinternals and download the ZIP archive.
2. Extract the ZIP
Unzip the archive to a folder of your choice; no installer runs, and nothing is added to Program Files.
3. Run as administrator
Right-click Autoruns.exe (or Autoruns64.exe) and choose Run as administrator to see the full picture of auto-start locations.
How to use it
1. Review startup entries
Browse the tabbed categories (Logon, Services, Scheduled Tasks, and more) to see what launches automatically and from where.
2. Investigate an unfamiliar entry
Right-click an entry and search online for its name and publisher before deciding whether to disable it.
3. Disable rather than delete
Uncheck an entry to disable it without permanently deleting it, so it can be re-enabled easily if something breaks.
4. Check entries against VirusTotal
Enable the VirusTotal check option (Options menu) to see detection results for signed and unsigned entries, useful when investigating suspected malware persistence.
Safety and privacy
- We link only to Microsoft Learn's official Sysinternals page, the authoritative source for this tool.
- As a portable, no-install tool, Autoruns leaves no persistent installation on the system once you delete the extracted files.
- Bundled software
- None; it is distributed directly by Microsoft with no third-party bundling.
- Privacy
- Runs locally by default; the optional VirusTotal check submits file hashes (and, if you opt in, files) to VirusTotal, which is a separate Google-owned service with its own privacy terms.
Known risks
- Disabling an auto-start entry you don't recognize can break a legitimate program or security tool — research an entry before disabling it, rather than removing entries indiscriminately.
- Because it requires administrator rights and can modify auto-start configuration, only run copies obtained directly from Microsoft Learn.
What's new
Current Sysinternals release
Microsoft updates Sysinternals tools periodically. Check the Autoruns page on Microsoft Learn for the current version and release history.
Pros and cons
Pros
- Far more thorough than Task Manager's Startup tab or msconfig
- Free, official, and maintained by Microsoft
- Portable — no installation, no persistent footprint
- VirusTotal integration helps triage suspicious entries
Cons
- Not beginner-friendly; disabling the wrong entry can cause problems
- Requires administrator rights for full visibility
- Interface is dense and technical rather than simplified
Verdict
Autoruns is the definitive tool for seeing everything Windows is configured to auto-start, and it is free and official. It rewards careful, informed use — research entries before disabling them rather than removing anything unfamiliar on sight.
Frequently asked questions
Is Autoruns free?
Yes, it is a free Microsoft Sysinternals tool with no license fee.
Do I need to install Autoruns?
No, it is a portable tool distributed as a ZIP file; extract it and run the executable directly.
Is Autoruns safe to use?
It is an official Microsoft diagnostic tool, but disabling auto-start entries you don't understand can affect other software, so review entries carefully before changing them.
What is the difference between Autoruns and Task Manager's Startup tab?
Task Manager's Startup tab only shows logon-related startup items. Autoruns covers dozens of additional auto-start locations, including services, scheduled tasks, drivers, and browser add-ons.