To check startup programs, open Task Manager > Startup apps on Windows or System Settings > General > Login Items & Extensions on a Mac. For a full picture, including scheduled tasks and services, use Microsoft's free Autoruns tool.
To check startup programs on Windows, press Ctrl + Shift + Esc to open Task Manager and select the Startup apps tab, or go to Settings > Apps > Startup. On a Mac, open System Settings > General > Login Items & Extensions. Those lists only show part of the picture, so for a complete check on Windows use Microsoft's free Autoruns tool, which also lists scheduled tasks, services and registry entries. Anything unsigned, from a publisher you don't recognise, or running from a user or temp folder deserves a closer look.
Startup lists are where slowdowns and malware tend to live. A program that wants to keep running after a restart has to register itself somewhere, and once you know where to look, it's surprisingly hard for it to hide.
I'll start with the built-in lists, move on to the places they don't show, then cover the red flags and what to do if something looks wrong. If you're doing a wider health check, my guide on how to check open ports pairs well with this one.
In this guide:
Most items in your startup list are perfectly ordinary: cloud sync, chat apps, printer helpers, graphics drivers. They start automatically because you'd be annoyed if they didn't.
Malware wants the same thing. Security researchers call it persistence: making sure the malicious program runs again after every reboot. MITRE ATT&CK, the industry's reference list of attacker techniques, documents registry Run keys and the Startup folder as a common way to do it, alongside scheduled tasks, services and, on Macs, login items and launch agents.
So checking your startup entries does two jobs at once. It can speed up boot time, and it's one of the most effective quick checks for something that shouldn't be there.
Windows 10 and 11 show the same list in two places. Task Manager gives more detail.
The Startup impact column is measured, not guessed. Microsoft's support page on configuring startup applications defines it like this:
| Impact | What it means |
|---|---|
| None | The item is disabled |
| Not measured | Enabled, but there's no data yet |
| Low | Under 300 milliseconds of CPU and under 292 KB of disk |
| Medium | Up to 1 second of CPU or up to 3 MB of disk |
| High | More than 1 second of CPU or more than 3 MB of disk |
Settings > Apps > Startup has the same on/off switches in a simpler layout.
Many entries in that list come from a few specific places. It's worth looking at them directly, because the folder paths and command lines tell you more than an app name.
| Location | Who it applies to | How to open it |
|---|---|---|
| Startup folder | Current user | Windows + R, then shell:startup |
| Common Startup folder | All users | Windows + R, then shell:common startup |
| HKCU\Software\Microsoft\Windows\CurrentVersion\Run | Current user | Registry Editor (regedit) |
| HKLM\Software\Microsoft\Windows\CurrentVersion\Run | All users | Registry Editor (regedit) |
| HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run | All users, 32-bit apps | Registry Editor (regedit) |
Rather than clicking through the registry, you can list the folders and Run keys in one go from PowerShell:
Get-CimInstance Win32_StartupCommand |
Select-Object Name, Command, Location, User |
Format-ListRead the Command line for each entry. It shows exactly which file runs and with which options. If you remember the old msconfig Startup tab, it now just points you to Task Manager, as I explain in what msconfig is and what it still does.
Task Manager doesn't show scheduled tasks or services, and both can start a program at boot or sign-in. Many legitimate updaters use them, and so does malware.
For scheduled tasks, open PowerShell and list everything that isn't one of Windows' own tasks:
Get-ScheduledTask |
Where-Object { $_.State -ne 'Disabled' -and $_.TaskPath -notlike '\Microsoft\*' } |
Select-Object TaskName, TaskPath, State
(Get-ScheduledTask -TaskName 'NameFromTheList').ActionsThe second command shows what a task actually runs. You can do the same in the Task Scheduler app by clicking a task and opening its Actions tab. Microsoft's Get-ScheduledTask reference covers the other properties.
For services that start automatically, this lists the name and the program behind each one:
Get-CimInstance Win32_Service |
Where-Object StartMode -eq 'Auto' |
Select-Object Name, DisplayName, PathNameAlmost every path should be under C:\Windows or C:\Program Files. A service running a file from your user folder is unusual.
Autoruns is a free Sysinternals tool published by Microsoft. It checks far more autostart locations than Task Manager, including logon entries, scheduled tasks, services, drivers and Explorer add-ons, in a single window.
With signature checking on, the Publisher column shows (Verified) or (Not verified) next to each name. Leave Submit Unknown Images unticked unless you understand that it uploads the actual file to VirusTotal.
On macOS, startup programs are called login items. You'll find them in one place.
Background items can keep a helper running even when the app's window is closed, which is why they're worth reviewing. Apple's guide to Login Items & Extensions settings explains each option. Turning off an app's background activity can stop it updating or syncing, so if something breaks, switch it back on.
Under the hood, many background items are property list (.plist) files that tell macOS's launchd system what to run. Three folders hold the ones that aren't part of macOS itself:
| Folder | Runs as | Typical contents |
|---|---|---|
| ~/Library/LaunchAgents | You, when you log in | Updaters and helpers for your account only |
| /Library/LaunchAgents | Each user, when they log in | Helpers installed for everyone |
| /Library/LaunchDaemons | The system, at startup | Background services, often running as root |
List them in Terminal, then read any file you're unsure of:
ls -l ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/com.example.helper.plistThe ProgramArguments or Program key shows what actually runs. For a fuller report, sudo sfltool dumpbtm prints every login and background item macOS is tracking, which Apple describes in its guide to managing login items and background tasks. Don't run sfltool resetbtm unless you mean to reset that data. If you want a graphical scanner, KnockKnock from Objective-See lists persistent items and can check them against VirusTotal.
Linux desktops use a few different mechanisms, so check each one:
systemctl list-unit-files --type=service --state=enabled
systemctl --user list-unit-files --state=enabled
ls ~/.config/autostart /etc/xdg/autostart
crontab -lThe first two list system and per-user services that start automatically. The autostart folders hold .desktop files that desktop environments launch when you log in, as defined in the freedesktop.org Desktop Application Autostart Specification. The last command shows your scheduled cron jobs; look for @reboot lines in particular.
No single sign proves something is malicious, but several together should make you stop and investigate.
| Red flag | Why it matters |
|---|---|
| No verified publisher, or one you've never heard of | Reputable software is almost always code-signed |
| Runs from AppData, Temp, Downloads or ProgramData | Installed software normally lives in Program Files |
| Random or misspelt name, such as a8f3k2.exe or scvhost.exe | Malware often imitates Windows file names |
| A Windows name in the wrong place, such as svchost.exe outside System32 | The real file lives in C:\Windows\System32 (or SysWOW64) |
| The command starts powershell.exe, wscript.exe, mshta.exe or rundll32.exe with long or encoded arguments | Built-in tools are commonly abused to run scripts |
| A Mac .plist with a com.apple label outside /System | Apple's own items don't live in your Library folders |
| It came back after you disabled it | Something else, such as a scheduled task, is reinstating it |
Some red flags have innocent explanations. Several popular apps install per-user copies in AppData, for example. If folder shortcuts like %APPDATA% are new to you, see my explainer on Windows environment variables.
Some malware is hard to remove while Windows is running. Microsoft Defender Offline restarts the PC and scans from outside Windows. Microsoft says it takes about 15 minutes, and it isn't available on ARM-based Windows PCs.
If your antivirus can't clean the device, the UK's National Cyber Security Centre advises in its guide to recovering an infected device that you wipe it, reinstall everything starting with the operating system, and restore your data from a known good backup.
Disabling items in Task Manager or Login Items is safe in the sense that nothing is deleted and you can switch them back on. Some things will stop working until you open them manually, such as cloud sync, audio or touchpad utilities and security software, so disable items one at a time if you're unsure.
For your own account it's at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, which you can open quickly by typing shell:startup in the Run box. The folder for all users is %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup, opened with shell:common startup.
It can shorten the time between signing in and the desktop becoming usable, especially if you disable items Task Manager rates as High impact. It won't make the computer faster once those programs would have finished loading.
Many apps register in more than one place. An updater might run as a scheduled task or service and put the startup entry back each time. Autoruns shows all of these locations together, so you can find the one doing the reinstating.
Yes, if you download it from Microsoft's official Sysinternals page. It's a free Microsoft tool. Be careful with it, though: unticking or deleting core entries can stop drivers or Windows features working, which is why hiding Microsoft and Windows entries is a sensible first step.
Yes. Task Manager only shows a few locations, mainly the Startup folders and Run keys. Scheduled tasks, services, drivers and other autostart points don't appear there, which is why a full check uses Autoruns on Windows and the launch agent folders on a Mac.
Open System Settings, go to General, then Login Items & Extensions, select the app in the Open at Login list and click the minus button. Many apps also have their own Launch at login option in their settings, which you may need to turn off as well.
Last checked: 23 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.
To check Windows Firewall status, open Windows Security and select Firewall & network protection. Each profile (Domain, Private, Public) says whether the firewall is on, and the one you're using is marked active. netsh and PowerShell give the same answer in one line.
To check BitLocker status, search Start for Manage BitLocker, or run manage-bde -status in an admin Command Prompt. Look at Protection Status: Protection On means your drive is really protected. Fully Encrypted with Protection Off means it isn't, yet.
Step-by-step Windows security guides: check Defender, startup programs, failed logins, open ports, UAC, encryption, passwords and 2FA. Plain English, free tools.
Check if Microsoft Defender Antivirus is on, up to date and not in passive mode. Windows Security steps, Get-MpComputerStatus fields, tamper protection and fixes.