Program startup order in Windows NT

The order of which applications are loaded and where they are loaded from:

  1. BootExecute
    [HKEY_LOCAL_MACHINE \System \CurrentControlSet \Control \Session Manager]
    BootExecute=
  2. Services
    • Task Scheduler will look in the Scheduled Tasks folder for jobs to execute.
  3. User enters username and password and performs logon
  4. UserInit (Login script is performed - More Info MS KB198642)
    [HKEY_LOCAL_MACHINE \Software \Microsoft \Windows NT \CurrentVersion \Winlogon]
    UserInit=userinit.exe
  5. Shell (Started by Userinit.exe)
    [HKEY_LOCAL_MACHINE \Software \Microsoft \Windows NT \CurrentVersion \Winlogon]
    Shell=explorer.exe
  6. All Users-RunOnce
    [HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \RunOnce]
  7. All Users-Run
    [HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \Run]
  8. All Users-RunOnceEx
    [HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \RunOnceEx]
  9. All Users-RunEx
    [HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \RunEx]
  10. Current User-RunOnce
    [HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \RunOnce]
  11. Current User-Run
    [HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Run]
  12. Current User-RunOnceEx
    [HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \RunOnceEx]
  13. Current User-RunEx
    [HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \RunEx]
  14. Common Startup Folder in the Start-Menu for All Users
  15. Startup Folder in the Start-Menu for Current User

More Info MS KB170086
More Info MS KB232509
More Info MS KB284193
More Info MS KB310593
More Info MS KB314488
More Info MS KB314866
More Info MS KB321707

Note if one of the Run-sections includes an invalid entry (Uses a path that doesn’t exist), then Windows might open at folder at startup. Use Msconfig or Startup.CPL to check the entries.

Note the group policies are by default applied to machine before the user is allowed to perform login. Though it can introduce a delay before the logon window is shown, as it first has to wait for the network to initialize and then contact the domain controller. It possible to configure whether it should wait for the domain controller:

[HKEY_LOCAL_MACHINE \Software \Policies \Microsoft \Windows NT \CurrentVersion \Winlogon]
SyncForegroundPolicy = 1 (0 = Do not wait for network to be initialized; WinXP+)

[HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \Policies \System]
SynchronousMachineGroupPolicy = 1 (0 = Do not wait for domain controller to apply machine policies)

More Info MS KB304970
More Info MS KB305293

Note Winlogon.exe controls the login process, by loading user registry, applying user group policies, and the launch of UserInit.exe. The UserInit.exe performs login scripts and executes program specified in Shell=. One can configure the behavior of Winlogon.exe:

[HKEY_LOCAL_MACHINE \Software \Microsoft \Windows \CurrentVersion \Policies \System]
SynchronousUserGroupPolicy = 1 (0 = Do not wait for domain controller to apply user policies)

[HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \Policies \System]
RunLogonScriptSync = 1 (0 = Do not wait for script to finish before starting shell)

More Info MS KB265016
More Info MS KB258286
More Info MS KB315245

Note during boot Windows might display one or more popup messsages, if using the EventLog to monitor these popup messages and the popup messages are unwanted, then they can be disabled:

[HKEY_LOCAL_MACHINE \System \CurrentControlSet \Control\ Windows]
NoPopUpsOnBoot = 1 (0 = Show popup messages during bootup)

More Info MS KB924690

Related Use SHIFT-key to prevent launch of 6-15

Credits Greatis.com