Technology Support — MCFL

Running Programs and Services at Windows Startup

Jan.-Feb. 2004

On Windows computers, after the operating system starts up, other programs and tasks that are not parts of the operating system can be set to start as well. There are four distinct ways in which services and tasks can start automatically after Windows boots. These are:

  1. The Start menu's "Startup" folder
  2. The Windows Registry's "Run" entries
  3. Logon batch files (NT, 2000, XP)
  4. The Control Panel's Services Manager (NT, 2000, XP)

1. The Startup Folder

The simplest method of starting a program on Windows startup is to put a shortcut to that program into the start menu's "Startup" folder. This method has been used since Windows 95 debuted, and still works with Windows 2000 and XP. The startup folder is inside of the start menu, and its contents can be viewed easily.

This folder is located on the C: drive in one of two places:
In Windows 95/98/ME, it is in C:\Windows\Start Menu\Programs\Startup.

In NT/2000/XP, there are two different folders that combine to produce the Startup list, one for everyone who logs on to the computer, and one for the specific account of the user who is logged in.

These two folders are at:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup and
C:\Documents and Settings\[current user]\Start Menu\Programs\Startup.

All User's folder — Win2000
Current User's folder (danielm) — Win2000

In Windows 2000/XP, items can be added to or deleted from this folder by right clicking on the start menu itself. Not many programs utilize this method of startup, though examples would include AdsGone and Webshots. We use this method for starting up OPACs and WebPACs with the appropriate program automatically.

WebPAC startup of Public Browser — Win98

In Windows 95 and 98, the quickest way to access the startup folder is to:

  1. Right click on the Start button
  2. Left click on "Explore"
  3. The C:\Windows\Start Menu\ folder will open in an Explorer window
  4. Double click on "Programs" in the left pane, and then double click on "Startup," and you'll be in the folder
Return to Top of Page  

2. The Registry's Run Entries

The Windows "Registry" is a large database of program settings which Windows uses to store all kinds of information about how it is set up. Information as diverse as the name of the registered user of the copy of Windows to the size of window and position of Word when it was last closed are stored in the registry.

Important Disclaimer: We do not recommend editing the Registry directly without consulting with Technical Support personnel. Deleting or modifying the wrong entry can destroy your Windows installation. Changes made to the Registry are instant, there is no "save" and no "undo" facility. That said, there are some repairs and adjustments that can only be made to a machine by accessing the Registry.

To view or modify the Registry, click on Start, then Run, and type "regedit." The Registry Editor will open up.

When the Registry opens, it will probably have all of the folders compacted, as is shown below. Clicking on a plus symbol next to a folder opens that folder.

There are two specific places in 2000/XP where Microsoft stores startup entries. As with the Start Menu, there is one place that will run commands for everyone that uses the computer, and another that will run commands for just the current logged in user. These entries are at:
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current Version/Run and HKEY_CURRENT_USER/Software/Microsoft/Windows/Current Version/Run.

The second (current user) entry does not exist until it's created by a software program, usually Yahoo Instant Messenger. But the first Run folder exists on every machine. Below is an example from a new machine, with only virus scanning added. The Synchronization Manager is present in every new Windows installation, but notice that OfficeScanNT shows the name of the file that actually runs OfficeScan (pccntmon.exe). If you were to look in the task manager at the list of running processes, this would be exactly the name that you would see for this process.

These registry Run folders are where many programs write their startup instructions to. The Palm Pilot software, most instant messengers, Music Match Jukebox, our VPN software and VNC all use entries in these folders to start. Many viruses and parasites also use these folders to launch their processes whenever a computer starts, and deleting such entries is a common cleanup technique.

There is no "save" command for the registry, so changes made are instantly written to it, and one just closes the Registry Editor when done. Most changes made to the registry require that the computer be restarted in order to take effect.

Return to Top of Page  

3. Logon Batch Files

Under Windows NT, 2000 and XP, each time a user logs in to the computer, it is possible to run a "logon&qout; batch file. This file executes a list of commands to prepare the computer for the user, by setting up network resources, running certain programs or cleaning out temp files. We began to use logon batch files on Windows NT public computers to secure Netscape and clean out the temporary cache files. We've expanded use of the logon batch file to set the system time, to set up the temporary space on each drive for the public user, and most recently to clean out anything added to the start menu by the user "All."

Logon batch files are like the old DOS batch files, they're just text files full of commands. They execute in a "DOS Window" or as it's now called, the Command Prompt, which flashes by briefly at logon.

The logon batch file we're currently using today looks like this:

Logon batch files are stored in the directory c:\winnt\system32\repl\import\scripts, though this directory has to be created in Windows 2000 and XP. The connection between the batch file and the user account is made in the "Users and Passwords" (User Manager) of Windows, under the Advanced settings.

Windows 95/98/ME didn't use logon batch files, but they did have something similar. When a Win9x machine is started up, two files (autoexec.bat and config.sys) are run. These were generally used for enabling drivers for software, such as sound cards and CD-ROM drives, but could also be used for some of the same things that a logon batch file can be used for. They were really left over from the old DOS and Windows versions that preceded Windows 95.

Return to Top of Page  

4. The Control Panel's Services Manager

The final way in which Windows NT computers govern what processes and programs are running on startup is the list of "Services." Services are like programs that are "registered" to run with Windows, and can be part of Windows itself (such as the Messenger) or can be other programs (such as VNC).

Some services will run as soon as the computer boots up, without someone having logging in to the machine. This is necessary for services such as web servers, but most of the services do run after a user logs in.

Very few parasites or viruses will install themselves as a service, but it is possible. Also, the Messenger service (not the same as Microsoft Messenger) can be used for spamming your computer, if you don't have a firewall, in which case it's common to set the service to "Manual" startup so that it's not running unless requested by the computer user.

To view the Services Manager, select Administrative Tools from the menu, and then select Services.

The list of services will show which services are currently running (Started), and you'll also see that some of the services are very esoteric, and are really intended for servers, or for very complicated network configurations.

Return to Top of Page

Tech Serv Info Home
Last modified Feb. 11, 2004