Starp up sequence

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Is there any way of making my norton firwall to startup before everything
else? Basicly modify the startup sequence?

Cheers
Liam
 
Depends on where the programs start from.

Execution Order for starting programs

With Windows XP, There are 13+ places that programs can start from and
they are executed in the following order:

Before Logon
1)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
2) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

After Logon
3)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
5) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run
8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup
11) C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup
12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
13) As a Scheduled Task set to run at startup.

[[Startups in groups 6 to 11 all run at the same time (more or less).
However, the groups themselves are triggered in the order shown above. In
other words, the next group can begin launching while the previous group is
still loading its startups. Due to timing issues it is impossible to say
what order these items will finish loading, thus it is impossible to
predict the exact order of execution for individual startups. For instance,
you may notice two or more system tray icons changing position with each
boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order, as
some programs take longer than others to load, and synchronous groups can
overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order in 10
and 11 by moving the items from 11 to 10. Also, you can rename the
shortcuts in 10 and/or 11.

For example; dfg.exe, fgh.exe and ghj.exe would start in that order. To
change the order rename to aghj.exe, bdfg.exe and cfgh.exe. They would then
start in that order. Or 1fgh.exe, 2ghj.exe and 3dfg.exe, et cetera.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
Wesley, that is some useful information I copied and saved for future
reference. I realize your list was not meant to be all-inclusive and neither
is mine, but here are a few other places I found. This brings the total
number of places where program start up can occur to 23 and counting. Curt

All Users Startup Folder
C:\windows\start menu\programs\startup
C:\WINNT\Profiles\All Users\Start Menu\Programs\Startup

Registry Local Machine RunOnceEx
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Registry Current User RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Registry Local Machine Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Registry Current User Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

UserInitKey
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\Userinit

Load Key
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

Win.ini
C:\windows\win.ini

System.ini
C:\windows\system.ini

Wesley Vogel said:
Depends on where the programs start from.

Execution Order for starting programs

With Windows XP, There are 13+ places that programs can start from and
they are executed in the following order:

Before Logon
1)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
2) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

After Logon
3)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
5) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run
8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup
11) C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup
12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
13) As a Scheduled Task set to run at startup.

[[Startups in groups 6 to 11 all run at the same time (more or less).
However, the groups themselves are triggered in the order shown above. In
other words, the next group can begin launching while the previous group is
still loading its startups. Due to timing issues it is impossible to say
what order these items will finish loading, thus it is impossible to
predict the exact order of execution for individual startups. For instance,
you may notice two or more system tray icons changing position with each
boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order, as
some programs take longer than others to load, and synchronous groups can
overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order in 10
and 11 by moving the items from 11 to 10. Also, you can rename the
shortcuts in 10 and/or 11.

For example; dfg.exe, fgh.exe and ghj.exe would start in that order. To
change the order rename to aghj.exe, bdfg.exe and cfgh.exe. They would then
start in that order. Or 1fgh.exe, 2ghj.exe and 3dfg.exe, et cetera.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Liam said:
Is there any way of making my norton firwall to startup before everything
else? Basicly modify the startup sequence?

Cheers
Liam
Click to expand...
Click to expand...
 
Curt,

No such place as
C:\windows\start menu\programs\startup
(windows 95 or 98 maybe?)

It is either
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or
%homepath%\Start Menu\Programs\Startup
which is the same as
C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup

Win.ini
C:\windows\win.ini
I addressed this:
6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run

If the following list isn't long enough for you...
Download and install Autoruns.
Select Include Empty Locations in the Options menu to see all the locations.

Sysinternals Freeware - Autoruns
http://www.sysinternals.com/Utilities/Autoruns.html

Here is my longer version, which is not all inclusive either...

Execution Order for starting programs

From various sources.

Before Logon

RunServicesOnce
1) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunServicesOnce

RunServices
2) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

<Logon Prompt>

RunOnce Local Machine Key
[[With the exception of the HKEY_LOCAL_MACHINE\...\RunOnce key, all keys and
their entries are loaded asynchronously. Therefore, all entries in the
RunServices and RunServicesOnce keys can potentially run at the same time.

Entries in the HKEY_LOCAL_MACHINE\...\RunOnce key are loaded synchronously
in an undefined order.

Because the HKEY_LOCAL_MACHINE\...\RunOnce key is
loaded synchronously, all of its entries must finish loading before the
HKEY_LOCAL_MACHINE\...\Run, HKEY_CURRENT_USER\...\Run,
HKEY_CURRENT_USER\...\RunOnce, and Startup Folder entries can be loaded.

Because of different system configurations (such as a computer that is
configured to automatically log on), any application that is dependant upon
other applications that are executed under these keys having completed must
be prepared to wait until these applications are complete.]]

[[The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe
Mode.]]
3) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunOnce\Setup
4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
5) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run

Run keys. By default these keys are not executed in Safe mode. If you
prefix a value in these keys with an asterisk, *, it will run in Safe Mode.
8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

All Users Startup Folder
10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup

User Profile Startup Folder
11) C:\Documents and Settings\Your user name\Start Menu\Programs\Startup

RunOnce Current User Key
[[The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe
Mode.]]
12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Explorer Run
From Group Policy
Local Computer Policy\Computer Configuration\Administrative
Templates\System\Logon\
Run these programs at user logon
[[Note: This setting appears in the Computer Configuration and User
Configuration folders. If both settings are configured, the system starts
the programs specified in the Computer Configuration setting just before it
starts the programs specified in the User Configuration setting.]]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\Run

From Group Policy
Local Computer Policy\User Configuration\Administrative
Templates\System\Logon\
Run these programs at user logon
[[Note: This setting appears in the Computer Configuration and User
Configuration folders. If both settings are configured, the system starts
the programs specified in the Computer Configuration setting just before it
starts the programs specified in the User Configuration setting.]]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\Run

UserInit Key This key specifies what program should be launched right after
a user logs into Windows. The default program for this key is
C:\windows\system32\userinit.exe. Userinit.exe is a program that restores
your profile, fonts, colors, etc for your username.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit

Load Key - This key is not commonly used anymore, but can be used to auto
start programs.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

Notify - This key is used to add a program that will run when a particular
event occurs. Events include logon, logoff, startup, shutdown,
startscreensaver, and stopscreensaver. When Winlogon.exe generates an event
such as the ones listed, Windows will look in the Notify registry key for a
DLL that will handle this event.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

Also Load, Run & Shell

AppInit_DLLs - This value corresponds to files being loaded through the
AppInit_DLLs Registry value.

The AppInit_DLLs registry value contains a list of dlls that will be loaded
when user32.dll is loaded. As most Windows executables use the user32.dll,
that means that any DLL that is listed in the AppInit_DLLs registry key will
be loaded also. This makes it very difficult to remove the DLL as it will be
loaded within multiple processes, some of which can not be stopped without
causing system instability. The user32.dll file is also used by processes
that are automatically started by the system when you log on. This means
that the files loaded in the AppInit_DLLs value will be loaded very early in
the Windows startup routine allowing the DLL to hide itself or protect
itself before we have access to the system.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

ShellServiceObjectDelayLoad This Registry contains values in a similar way
as the Run key does. The difference is that instead of pointing to the file
itself, it points to the CLSID's InProcServer, which contains the
information about the particular DLL file that is being used.

The files under this key are loaded automatically by Explorer.exe when your
computer starts. Because Explorer.exe is the shell for your computer, it
will always start, thus always loading the files under this key. These files
are therefore loaded early in the startup process before any human
intervention occurs.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad

13) SharedTaskScheduler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler

[[Startups in groups 6 to 11 all run at the same time (more or less).
However, the groups themselves are triggered in the order shown above. In
other words, the next group can begin launching while the previous group is
still loading its startups. Due to timing issues it is impossible to say
what order these items will finish loading, thus it is impossible to
predict the exact order of execution for individual startups. For instance,
you may notice two or more system tray icons changing position with each
boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order, as
some programs take longer than others to load, and synchronous groups can
overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order in 10
and 11 by moving the items from 11 to 10. Also, you can rename the
shortcuts in 10 and/or 11.

For example; dfg.exe, fgh.exe and ghj.exe would start in that order. To
change the order rename to aghj.exe,bdfg.exe and cfgh.exe. They would then
start in that order.

The following are files that programs can autostart from on bootup:

1. c:\autoexec.bat
2. c:\config.sys
3 . windir\wininit.ini - Usually used by setup programs to have a file run
once and then get deleted.
4. windir\winstart.bat
5. windir\win.ini - [windows] "load"
6. windir\win.ini - [windows] "run"
7. windir\system.ini - [boot] "shell"
8 . windir\system.ini - [boot] "scrnsave.exe"
9. windir\dosstart.bat - Used in Win95 or 98 when you select the "Restart in
MS-DOS mode" in the shutdown menu.
10. windir\system\autoexec.nt
11. windir\system\config.nt
========================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
bootini
services
startup
system.ini
win.ini

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\system.ini\boot
Shell
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini
Winlogon
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini\Windows
AppInit_DLLs
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
CurtB said:
Wesley, that is some useful information I copied and saved for future
reference. I realize your list was not meant to be all-inclusive and
neither is mine, but here are a few other places I found. This brings
the total number of places where program start up can occur to 23 and
counting. Curt

All Users Startup Folder
C:\windows\start menu\programs\startup
C:\WINNT\Profiles\All Users\Start Menu\Programs\Startup

Registry Local Machine RunOnceEx
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Registry Current User RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Registry Local Machine Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er\Run

Registry Current User Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explore
r\Run
UserInitKey
Click to expand...
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\User
init

Load Key
HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Windows\load

Win.ini
C:\windows\win.ini

System.ini
C:\windows\system.ini

Wesley Vogel said:
Depends on where the programs start from.

Execution Order for starting programs

With Windows XP, There are 13+ places that programs can start from and
they are executed in the following order:

Before Logon
1)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
2)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

After Logon
3)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
5)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
6) WIN.INI [Windows] Load 7) WIN.INI [Windows] Run
8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup
11) C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup
12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
13) As a Scheduled Task set to run at startup.

[[Startups in groups 6 to 11 all run at the same time (more or less).
However, the groups themselves are triggered in the order shown above. In
other words, the next group can begin launching while the previous group
is still loading its startups. Due to timing issues it is impossible to
say what order these items will finish loading, thus it is impossible to
predict the exact order of execution for individual startups. For
instance, you may notice two or more system tray icons changing position
with each boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order,
as some programs take longer than others to load, and synchronous groups
can overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order
in 10 and 11 by moving the items from 11 to 10. Also, you can rename the
shortcuts in 10 and/or 11.

For example; dfg.exe, fgh.exe and ghj.exe would start in that order. To
change the order rename to aghj.exe, bdfg.exe and cfgh.exe. They would
then start in that order. Or 1fgh.exe, 2ghj.exe and 3dfg.exe, et cetera.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
Liam said:
Is there any way of making my norton firwall to startup before
everything else? Basicly modify the startup sequence?

Cheers
Liam
Click to expand...
Click to expand...
Click to expand...
 
Wesley, whether the original poster figured out a solution to his problem or
not, I found your post to be informative. It will provide a helpful research
reference in the future. Thanks for the information. Curt

Wesley Vogel said:
Curt,

No such place as
C:\windows\start menu\programs\startup
(windows 95 or 98 maybe?)

It is either
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or
%homepath%\Start Menu\Programs\Startup
which is the same as
C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup

Win.ini
C:\windows\win.ini
I addressed this:
6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run

If the following list isn't long enough for you...
Download and install Autoruns.
Select Include Empty Locations in the Options menu to see all the locations.

Sysinternals Freeware - Autoruns
http://www.sysinternals.com/Utilities/Autoruns.html

Here is my longer version, which is not all inclusive either...

Execution Order for starting programs

From various sources.

Before Logon

RunServicesOnce
1) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunServicesOnce

RunServices
2) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

<Logon Prompt>

RunOnce Local Machine Key
[[With the exception of the HKEY_LOCAL_MACHINE\...\RunOnce key, all keys and
their entries are loaded asynchronously. Therefore, all entries in the
RunServices and RunServicesOnce keys can potentially run at the same time.

Entries in the HKEY_LOCAL_MACHINE\...\RunOnce key are loaded synchronously
in an undefined order.

Because the HKEY_LOCAL_MACHINE\...\RunOnce key is
loaded synchronously, all of its entries must finish loading before the
HKEY_LOCAL_MACHINE\...\Run, HKEY_CURRENT_USER\...\Run,
HKEY_CURRENT_USER\...\RunOnce, and Startup Folder entries can be loaded.

Because of different system configurations (such as a computer that is
configured to automatically log on), any application that is dependant upon
other applications that are executed under these keys having completed must
be prepared to wait until these applications are complete.]]

[[The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe
Mode.]]
3) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunOnce\Setup
4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
5) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run

Run keys. By default these keys are not executed in Safe mode. If you
prefix a value in these keys with an asterisk, *, it will run in Safe Mode.
8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

All Users Startup Folder
10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup

User Profile Startup Folder
11) C:\Documents and Settings\Your user name\Start Menu\Programs\Startup

RunOnce Current User Key
[[The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe
Mode.]]
12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Explorer Run
From Group Policy
Local Computer Policy\Computer Configuration\Administrative
Templates\System\Logon\
Run these programs at user logon
[[Note: This setting appears in the Computer Configuration and User
Configuration folders. If both settings are configured, the system starts
the programs specified in the Computer Configuration setting just before it
starts the programs specified in the User Configuration setting.]]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\Run

From Group Policy
Local Computer Policy\User Configuration\Administrative
Templates\System\Logon\
Run these programs at user logon
[[Note: This setting appears in the Computer Configuration and User
Configuration folders. If both settings are configured, the system starts
the programs specified in the Computer Configuration setting just before it
starts the programs specified in the User Configuration setting.]]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\Run

UserInit Key This key specifies what program should be launched right after
a user logs into Windows. The default program for this key is
C:\windows\system32\userinit.exe. Userinit.exe is a program that restores
your profile, fonts, colors, etc for your username.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit

Load Key - This key is not commonly used anymore, but can be used to auto
start programs.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

Notify - This key is used to add a program that will run when a particular
event occurs. Events include logon, logoff, startup, shutdown,
startscreensaver, and stopscreensaver. When Winlogon.exe generates an event
such as the ones listed, Windows will look in the Notify registry key for a
DLL that will handle this event.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

Also Load, Run & Shell

AppInit_DLLs - This value corresponds to files being loaded through the
AppInit_DLLs Registry value.

The AppInit_DLLs registry value contains a list of dlls that will be loaded
when user32.dll is loaded. As most Windows executables use the user32.dll,
that means that any DLL that is listed in the AppInit_DLLs registry key will
be loaded also. This makes it very difficult to remove the DLL as it will be
loaded within multiple processes, some of which can not be stopped without
causing system instability. The user32.dll file is also used by processes
that are automatically started by the system when you log on. This means
that the files loaded in the AppInit_DLLs value will be loaded very early in
the Windows startup routine allowing the DLL to hide itself or protect
itself before we have access to the system.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

ShellServiceObjectDelayLoad This Registry contains values in a similar way
as the Run key does. The difference is that instead of pointing to the file
itself, it points to the CLSID's InProcServer, which contains the
information about the particular DLL file that is being used.

The files under this key are loaded automatically by Explorer.exe when your
computer starts. Because Explorer.exe is the shell for your computer, it
will always start, thus always loading the files under this key. These files
are therefore loaded early in the startup process before any human
intervention occurs.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad

13) SharedTaskScheduler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler

[[Startups in groups 6 to 11 all run at the same time (more or less).
However, the groups themselves are triggered in the order shown above. In
other words, the next group can begin launching while the previous group is
still loading its startups. Due to timing issues it is impossible to say
what order these items will finish loading, thus it is impossible to
predict the exact order of execution for individual startups. For instance,
you may notice two or more system tray icons changing position with each
boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order, as
some programs take longer than others to load, and synchronous groups can
overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order in 10
and 11 by moving the items from 11 to 10. Also, you can rename the
shortcuts in 10 and/or 11.

For example; dfg.exe, fgh.exe and ghj.exe would start in that order. To
change the order rename to aghj.exe,bdfg.exe and cfgh.exe. They would then
start in that order.

The following are files that programs can autostart from on bootup:

1. c:\autoexec.bat
2. c:\config.sys
3 . windir\wininit.ini - Usually used by setup programs to have a file run
once and then get deleted.
4. windir\winstart.bat
5. windir\win.ini - [windows] "load"
6. windir\win.ini - [windows] "run"
7. windir\system.ini - [boot] "shell"
8 . windir\system.ini - [boot] "scrnsave.exe"
9. windir\dosstart.bat - Used in Win95 or 98 when you select the "Restart in
MS-DOS mode" in the shutdown menu.
10. windir\system\autoexec.nt
11. windir\system\config.nt
========================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
bootini
services
startup
system.ini
win.ini

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\system.ini\boot
Shell
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini
Winlogon
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini\Windows
AppInit_DLLs
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
CurtB said:
Wesley, that is some useful information I copied and saved for future
reference. I realize your list was not meant to be all-inclusive and
neither is mine, but here are a few other places I found. This brings
the total number of places where program start up can occur to 23 and
counting. Curt

All Users Startup Folder
C:\windows\start menu\programs\startup
C:\WINNT\Profiles\All Users\Start Menu\Programs\Startup

Registry Local Machine RunOnceEx
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Registry Current User RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Registry Local Machine Policies\Explorer\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er\Run

Registry Current User Policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explore
r\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\User
init

Load Key
HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Windows\load

Win.ini
C:\windows\win.ini

System.ini
C:\windows\system.ini
Click to expand...
Click to expand...
 
Keep having fun, Curt.

The OP was a CDO poster, they probably can't find their way back here.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
CurtB said:
Wesley, whether the original poster figured out a solution to his problem
or not, I found your post to be informative. It will provide a helpful
research reference in the future. Thanks for the information. Curt

Wesley Vogel said:
Curt,

No such place as
C:\windows\start menu\programs\startup
(windows 95 or 98 maybe?)

It is either
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
or
%homepath%\Start Menu\Programs\Startup
which is the same as
C:\Documents and Settings\Your Name Here\Start Menu\Programs\Startup

Win.ini
C:\windows\win.ini
I addressed this:
6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run

If the following list isn't long enough for you...
Download and install Autoruns.
Select Include Empty Locations in the Options menu to see all the
locations.

Sysinternals Freeware - Autoruns
http://www.sysinternals.com/Utilities/Autoruns.html

Here is my longer version, which is not all inclusive either...

Execution Order for starting programs

From various sources.

Before Logon

RunServicesOnce
1) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunServicesOnce

RunServices
2)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

<Logon Prompt>

RunOnce Local Machine Key
[[With the exception of the HKEY_LOCAL_MACHINE\...\RunOnce key, all keys
and their entries are loaded asynchronously. Therefore, all entries in
the RunServices and RunServicesOnce keys can potentially run at the same
time.

Entries in the HKEY_LOCAL_MACHINE\...\RunOnce key are loaded
synchronously in an undefined order.

Because the HKEY_LOCAL_MACHINE\...\RunOnce key is
loaded synchronously, all of its entries must finish loading before the
HKEY_LOCAL_MACHINE\...\Run, HKEY_CURRENT_USER\...\Run,
HKEY_CURRENT_USER\...\RunOnce, and Startup Folder entries can be loaded.

Because of different system configurations (such as a computer that is
configured to automatically log on), any application that is dependant
upon other applications that are executed under these keys having
completed must be prepared to wait until these applications are
complete.]]

[[The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe
Mode.]]
3) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunOnce\Setup
4) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
5)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

6) WIN.INI [Windows] Load
7) WIN.INI [Windows] Run

Run keys. By default these keys are not executed in Safe mode. If you
prefix a value in these keys with an asterisk, *, it will run in Safe
Mode. 8) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
9) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

All Users Startup Folder
10) C:\Documents and Settings\All Users\Start Menu\Programs\Startup

User Profile Startup Folder
11) C:\Documents and Settings\Your user name\Start Menu\Programs\Startup

RunOnce Current User Key
[[The RunOnce keys are ignored under Windows 2000 and Windows XP in Safe
Mode.]]
12) HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Explorer Run
From Group Policy
Local Computer Policy\Computer Configuration\Administrative
Templates\System\Logon\
Run these programs at user logon
[[Note: This setting appears in the Computer Configuration and User
Configuration folders. If both settings are configured, the system starts
the programs specified in the Computer Configuration setting just before
it starts the programs specified in the User Configuration setting.]]
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\Run

From Group Policy
Local Computer Policy\User Configuration\Administrative
Templates\System\Logon\
Run these programs at user logon
[[Note: This setting appears in the Computer Configuration and User
Configuration folders. If both settings are configured, the system starts
the programs specified in the Computer Configuration setting just before
it starts the programs specified in the User Configuration setting.]]
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
Explorer\Run

UserInit Key This key specifies what program should be launched right
after a user logs into Windows. The default program for this key is
C:\windows\system32\userinit.exe. Userinit.exe is a program that restores
your profile, fonts, colors, etc for your username.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit

Load Key - This key is not commonly used anymore, but can be used to auto
start programs.
HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Windows\load

Notify - This key is used to add a program that will run when a
particular event occurs. Events include logon, logoff, startup, shutdown,
startscreensaver, and stopscreensaver. When Winlogon.exe generates an
event such as the ones listed, Windows will look in the Notify registry
key for a DLL that will handle this event.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify

Also Load, Run & Shell

AppInit_DLLs - This value corresponds to files being loaded through the
AppInit_DLLs Registry value.

The AppInit_DLLs registry value contains a list of dlls that will be
loaded when user32.dll is loaded. As most Windows executables use the
user32.dll, that means that any DLL that is listed in the AppInit_DLLs
registry key will be loaded also. This makes it very difficult to remove
the DLL as it will be loaded within multiple processes, some of which
can not be stopped without causing system instability. The user32.dll
file is also used by processes that are automatically started by the
system when you log on. This means that the files loaded in the
AppInit_DLLs value will be loaded very early in the Windows startup
routine allowing the DLL to hide itself or protect itself before we have
access to the system. HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Windows

ShellServiceObjectDelayLoad This Registry contains values in a similar
way as the Run key does. The difference is that instead of pointing to
the file itself, it points to the CLSID's InProcServer, which contains
the information about the particular DLL file that is being used.

The files under this key are loaded automatically by Explorer.exe when
your computer starts. Because Explorer.exe is the shell for your
computer, it will always start, thus always loading the files under this
key. These files are therefore loaded early in the startup process
before any human intervention occurs.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad

13) SharedTaskScheduler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler

[[Startups in groups 6 to 11 all run at the same time (more or less).
However, the groups themselves are triggered in the order shown above. In
other words, the next group can begin launching while the previous group
is still loading its startups. Due to timing issues it is impossible to
say what order these items will finish loading, thus it is impossible to
predict the exact order of execution for individual startups. For
instance, you may notice two or more system tray icons changing position
with each boot - even when no changes have been made to the order.]]

[[The order of items within a group is not necessarily the final order,
as some programs take longer than others to load, and synchronous groups
can overlap each other.]]

Items in 10 and 11 execute alphanumerically. You can change the order
in 10 and 11 by moving the items from 11 to 10. Also, you can rename the
shortcuts in 10 and/or 11.

For example; dfg.exe, fgh.exe and ghj.exe would start in that order. To
change the order rename to aghj.exe,bdfg.exe and cfgh.exe. They would
then start in that order.

The following are files that programs can autostart from on bootup:

1. c:\autoexec.bat
2. c:\config.sys
3 . windir\wininit.ini - Usually used by setup programs to have a file
run once and then get deleted.
4. windir\winstart.bat
5. windir\win.ini - [windows] "load"
6. windir\win.ini - [windows] "run"
7. windir\system.ini - [boot] "shell"
8 . windir\system.ini - [boot] "scrnsave.exe"
9. windir\dosstart.bat - Used in Win95 or 98 when you select the
"Restart in MS-DOS mode" in the shutdown menu.
10. windir\system\autoexec.nt
11. windir\system\config.nt
========================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
bootini
services
startup
system.ini
win.ini

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\system.ini\boot
Shell
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini
Winlogon
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\IniFileMapping\win.ini\Windows
AppInit_DLLs
REG_SZ
SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
CurtB said:
Wesley, that is some useful information I copied and saved for future
reference. I realize your list was not meant to be all-inclusive and
neither is mine, but here are a few other places I found. This brings
the total number of places where program start up can occur to 23 and
counting. Curt

All Users Startup Folder
C:\windows\start menu\programs\startup
C:\WINNT\Profiles\All Users\Start Menu\Programs\Startup

Registry Local Machine RunOnceEx
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Registry Current User RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Registry Local Machine Policies\Explorer\Run
Click to expand...
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er\Run
Registry Current User Policies\Explorer\Run
Click to expand...
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explore
r\Run
UserInitKey
Click to expand...
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\User
init
Load Key
HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Windows\load

Win.ini
C:\windows\win.ini

System.ini
C:\windows\system.ini

:

Depends on where the programs start from.

Execution Order for starting programs

With Windows XP, There are 13+ places that programs can start from and
they are executed in the following order:

Before Logon
1)
Click to expand...
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
2)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

After Logon
3)
Click to expand...
Click to expand...
Click to expand...
 
Back
Top