Autoruns

by Sysinternalsv14.3

Last updated Jul 27, 2026

This utility shows you what programs are configured to run during system bootup or login.

Install with winget

$ winget install --id Microsoft.Sysinternals.Autoruns --exact --version 14.3

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Built by Pckgr

For IT teams

Deploy this app to your whole fleet with Pckgr RMM.

App deployment, patching, and remote support in one place. Push this app to every device you manage, keep it patched automatically, and see new CVEs the moment they land. Works with Intune or fully standalone.

Free for up to 5 devices.

About

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys. Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond other autostart utilities.

Autoruns' Hide Signed Microsoft Entries option helps you to zoom in on third-party auto-starting images that have been added to your system and it has support for looking at the auto-starting images configured for other accounts configured on a system. Also included in the download package is a command-line equivalent that can output in CSV format, Autorunsc.

You'll probably be surprised at how many executables are launched automatically!

Installers · v14.3

Architecture	Type	Scope	Download
x86	ZIP archive	-	Direct
x64	ZIP archive	-	Direct
arm64	ZIP archive	-	Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

1 known CVE via NVD

medium5.5Fix in v2023.6CVE-2023-29353affects before 2023.6Jun 13, 2023
Sysinternals Process Monitor for Windows Denial of Service Vulnerability
Patch Vendor advisory

Source: NVD, updated 2h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Pckgr RMM flags vulnerable devices and pushes the patched version automatically.

Related apps

HandleSysinternals
Microsoft.Sysinternals.Handlev5.0
Handle is a utility that displays information about open handles for any process in the system.
SDeleteSysinternals
Microsoft.Sysinternals.SDeletev2.06
Securely overwrite sensitive files and cleanse free space.
Sysinternals SuiteSysinternals
Microsoft.Sysinternals.Suitev2026-07-09
Sysinternals Suite is a bundle of the Sysinternals utilities including Process Explorer, Process Monitor, Sysmon, Autoruns, ProcDump, all of the PsTools, and many more.
SysmonSysinternals
Microsoft.Sysinternals.Sysmonv15.21
System activity monitor
StringsSysinternals
Microsoft.Sysinternals.Stringsv2.54
Strings scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters.
Remote Desktop Connection ManagerSysinternals
Microsoft.Sysinternals.RDCManv3.12
RDCMan manages multiple remote desktop connections. It is useful for managing server labs where you need regular access to each machine such as automated checkin systems and data centers.

More from Sysinternals or browse sysinternals.

Frequently asked questions

How do I install Autoruns on Windows?

Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id Microsoft.Sysinternals.Autoruns --exact --version 14.3. winget downloads the installer from Sysinternals and runs it. Requires Windows 10 (1809+) or Windows 11.

How do I install Autoruns silently for unattended deployment?

Add --silent and accept the agreements upfront: winget install --id Microsoft.Sysinternals.Autoruns --exact 14.3 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.

How do I uninstall Autoruns via winget?

Run: winget uninstall --id Microsoft.Sysinternals.Autoruns --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from Autoruns's Apps & Features entry.

Is Autoruns free?

Autoruns is distributed under Proprietary. Refer to the publisher (https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns) for the full license terms - Wingetly itself does not charge for installation.

Does Autoruns work on Windows 10?

Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls Autoruns directly from the publisher.

How do I keep Autoruns up to date?

Run winget upgrade --id Microsoft.Sysinternals.Autoruns --exact, or winget upgrade --all to update everything winget tracks. We index 1 version of Autoruns from microsoft/winget-pkgs.