You've disabled everything in Task Manager's startup tab. Turned off half the services in msconfig. Windows still takes three minutes to boot. Something is running, and Task Manager isn't showing you what.

That's because Task Manager only shows programs that register themselves as startup items in the places Microsoft expects. It misses scheduled tasks that trigger at login, registry keys that silently launch processes, shell extensions loading inside Explorer, and drivers initializing before you even see the desktop. msconfig shows a bit more, but not much.

Autoruns shows all of it. Every startup entry, from every location Windows uses to launch things. If something runs when your computer starts, Autoruns lists it.

What it is

Autoruns is a free tool from Microsoft's Sysinternals suite, built by Mark Russinovich (now CTO of Azure). It's portable, so there's nothing to install. Just download, extract, and run.

When you open it, you'll see a wall of tabs. Don't panic. The ones that matter for troubleshooting slow boots are Logon (startup programs), Scheduled Tasks, Services, and Drivers. There's also an "Everything" tab that shows every auto-start entry across all categories at once, which is usually the best place to start.

The other tabs cover more specialized territory: Explorer shell extensions, Internet Explorer add-ons (legacy), Boot Execute programs that run before Windows loads. You can explore those when you need them, but for most startup troubleshooting, the four main tabs are enough.

Why Task Manager and msconfig fall short

Task Manager shows some startup programs. That's about it. It doesn't show services, doesn't show scheduled tasks, doesn't know about registry auto-run keys, and has no idea what drivers are loading. It also can't tell you if something is malware.

msconfig adds services to the picture, which helps. But it still has no visibility into scheduled tasks, registry entries, or drivers.

Autoruns covers all of it, plus it integrates with VirusTotal for malware checking. And since it's portable, you can run it from a USB drive on a machine you're troubleshooting without installing anything.

Finding what's slowing you down

Click Options, then check "Hide Windows Entries" and "Hide Microsoft Entries." This filters out OS components you shouldn't touch and leaves you with third-party software.

Now look through what's left. Programs you don't recognize. Programs you haven't used in months. Multiple entries from the same vendor. Anything with no publisher listed, or a publisher that looks suspicious.

Right-click an entry and choose "Search Online" if you're not sure what it does. Or click "Check VirusTotal" to see if anyone's flagged it as malicious.

When you find something you want to disable, just uncheck it. Autoruns doesn't delete anything. It disables the auto-start entry. If something breaks after a reboot, come back and re-enable it.

When it's worth pulling out

Slow boot where Task Manager shows three startup items but you know something else is going on? Autoruns will probably show 40+, including scheduled tasks that fire 30 seconds after login and services set to delayed start.

Process in Task Manager that you can't figure out how it launched? Autoruns reveals every mechanism Windows uses to start programs. Whatever triggered that process, Autoruns will show the entry.

After cleaning malware, it's nearly essential. Antivirus might remove the main payload, but malware often leaves behind registry keys or scheduled tasks designed to re-download itself. Autoruns catches those.

And if you're chasing crashes or conflicts caused by a bad shell extension or misbehaving driver, Autoruns lets you disable suspects one at a time without booting into Safe Mode.

Autoruns vs Process Explorer

People confuse these because they're both Sysinternals tools. They do different things. Process Explorer shows what's running right now: live processes, CPU usage, open file handles. Autoruns shows what will run when Windows starts. Use Process Explorer for live diagnostics, Autoruns for controlling what loads at boot.

Download

Grab it from Microsoft's Sysinternals site. Extract the ZIP, right-click Autoruns64.exe (or Autoruns.exe on 32-bit), and run as administrator. Some entries won't appear without admin rights.

Need help cleaning up startup problems across a fleet of workstations? We can help.