Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
"Fae" Grace Meadows
Windows has five places a program can register itself to run at sign-in, and Task Manager shows two of them. This guide maps all five, shows how to see them at once with Autoruns, and covers the policy and script that keep a fleet clean.
A user's laptop takes four minutes to become usable, Task Manager shows six startup apps, and disabling all six changes nothing. The programs that slow a Windows sign-in rarely sit in the one list Windows shows you. This guide maps every place startup programs on Windows 10 and Windows 11 can live, shows how to see all of them at once, and covers how to control them across a fleet instead of one desk at a time.
Windows has no single startup list. It has at least five mechanisms that run something when the machine boots or a user signs in, and each one was added in a different decade for a different reason. When a technician says "I disabled it in startup and it still runs", the item is in one of the places they did not look.
| Location | Runs when | Where it is | Shown in Task Manager |
|---|---|---|---|
| Startup folder, per user | User signs in | shell:startup under the user's AppData\Roaming | Yes |
| Startup folder, all users | Any user signs in | shell:common startup under ProgramData | Yes |
| Run and RunOnce keys | User signs in | HKCU and HKLM ...\CurrentVersion\Run, plus the Wow6432Node copy | Yes, Run only |
| Scheduled task | At logon, at startup, or on an event | Task Scheduler library, taskschd.msc | No |
| Service | At boot, before anyone signs in | services.msc, startup type Automatic | No |
| Winlogon keys | At sign-in, as part of the shell | Shell and Userinit under Winlogon | No |
The first two are the oldest and the simplest: a shortcut in a folder. Microsoft's startup apps guide gives the two paths, %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup for the signed-in user and %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup for everyone. Typing shell:startup or shell:common startup into the Run box opens them.
The Run keys are where installers put themselves. Microsoft's page lists three: HKLM\Software\Microsoft\Windows\CurrentVersion\Run and its Wow6432Node twin for every user, and HKCU\Software\Microsoft\Windows\CurrentVersion\Run for the current one. RunOnce sits beside each and fires a single time, which is how an installer finishes its own setup after a reboot.
The other three are the ones that get missed. A scheduled task with an "At log on" trigger behaves exactly like a Run key entry, except it can run elevated, run with a delay, and run as a different account. Microsoft Teams, OneDrive, Adobe and every GPU vendor use tasks for at least part of their startup. A service starts before anyone signs in, which is why antivirus, backup agents and your own RMM live there. And the Winlogon Shell and Userinit values name the programs that build the desktop itself, which is why malware likes to append itself to them.
Task Manager's Startup apps tab, and the matching list under Settings, Apps, Startup, read the two folders and the Run keys. That covers the programs a user installed last month and nothing a vendor registered as a task or a service. Microsoft's own page says as much: apps that are not in the list "can be configured in File Explorer", which is a polite way of saying the list is partial.
The tab does add one thing nothing else gives you: an impact rating. Windows records a boot trace, and Task Manager reads each app's CPU time and disk activity from it. Microsoft's compatibility guidance sets the thresholds. Low impact means under 300 milliseconds of CPU and under 300 KB of disk. High impact means more than one second of CPU or more than 3 MB of disk. Medium is the band between. Not measured means the app is enabled but has not run at startup since the trace was last taken, and None means it is disabled.
Two things make the rating less useful than it looks. The thresholds are joined by "or", so a program that reads 4 MB from disk in a tenth of a second is High, the same as one that pins a core for ten seconds. And the rating covers the first seconds after sign-in only. The agent that polls a server every minute all day rates Low.
The toggle in Task Manager also does less than it looks. Disabling an item does not delete the Run value or the shortcut. Windows writes a flag under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved (and the HKLM twin for all-users entries), and Explorer checks that key before it launches anything from the Run keys or the folders. The entry is still there, the installer's next update can flip it back, and nothing outside those two mechanisms honors the flag at all. The elevenforum tutorial on startup apps walks the registry side of the toggle if you want to see the values change.
The r/sysadmin thread below is the common shape of the ticket: the program is running, it is not in the Startup tab, and the admin wants it off for one user, not the machine. The answer is always the same first step. Find out which of the five places it is in.
Autoruns is the Sysinternals tool for this job and it has been for twenty years. Microsoft's Autoruns page describes it as having "the most comprehensive knowledge of auto-starting locations of any startup monitor", and the tab row across the top is the proof: Logon, Explorer, Scheduled Tasks, Services, Drivers, Winlogon, WMI, Codecs and more. The Everything tab lists all of it in one scroll.
Three options make it readable. Hide Microsoft Entries, under Options, drops everything signed by Microsoft so the third-party items stand out. Verify Code Signatures marks entries whose signature does not check out. And the VirusTotal scan option, once you accept its terms, sends file hashes and shows a detection count beside each entry. On a healthy office machine the list after those three filters is a few dozen rows.
The workflow for a slow sign-in is short. Run Autoruns elevated, so it can read the HKLM and service entries. Apply the Microsoft filter. Sort by the Image Path column and read the ones living in AppData, Temp or ProgramData rather than Program Files. Untick anything you want to stop, which disables it in place without deleting it, and use Jump to Entry to open the registry key or task if you want to see how it got there. Reboot and repeat.
The video below walks the same ground on a live machine, including the locations Task Manager never mentions, and is the one to send a junior technician before their first Autoruns session.
The command-line version, autorunsc, is what turns this into fleet work. autorunsc -a * -c -m -s -nobanner prints every category as CSV, hides Microsoft-signed entries and verifies signatures. Add -h for file hashes and -vt after accepting the VirusTotal terms. Run it once and you have a baseline you can diff against next month.
With the location known, the fix is a short list, and the right tool depends on which of the five places you found the entry in.
For a folder or Run key item, Task Manager or Settings is enough. Right-click Start, open Task Manager, select Startup apps, pick the row and choose Disable. To stop it for good, delete the shortcut from shell:startup or remove the value from the Run key, after the item is disabled, so the app's own settings do not re-register it on next launch. Chrome and Edge both have in-app switches for their background mode that are cleaner than editing the key; the Edge version is covered in our guide to Edge on startup.
For a scheduled task, open taskschd.msc, find the task in the library, and read its Triggers tab. A task with an "At log on" trigger can be disabled from the right-click menu, and a task that keeps coming back usually has a sibling task that recreates it, which Autoruns shows and Task Scheduler's flat view hides.
For a service, change the startup type in services.msc from Automatic to Manual rather than Disabled on the first pass. Manual lets the application start it on demand, so the user's workflow survives the change, and the service no longer loads at boot. The service host mapping that tells you which service a given svchost.exe is running is in our svchost guide.
For Winlogon, do not edit it on a production machine without a backup of the key and a second way in. The Shell value should read explorer.exe and Userinit should read the path to userinit.exe followed by a comma. Anything appended after either is a candidate for the security section below, not the performance one.
Windows 11 adds a switch worth turning on while you are there. Under Settings, System, Notifications, the Startup App Notification toggle, off by default, raises a notification whenever a new app registers itself to start at sign-in. PCWorld's write-up covers where it lives. It only watches the places Task Manager watches, so it is a tripwire for installers, not for tasks or services, but on a shared PC it is the cheapest early warning you will get.
One machine takes ten minutes. Two hundred machines need policy for the list you want, a script for the list you have, and a place to compare the two.
Policy sets the list you want. The Group Policy setting "Run these programs at user logon", under System, Logon in both the Computer and User configuration trees, adds programs to the start list, and Microsoft's ADMX_Logon reference exposes the same setting to Intune as ADMX_Logon/Run_1 and Run_2. Its neighbours, "Do not process the legacy run list" and "Do not process the run once list", make Windows ignore the Run and RunOnce keys entirely, which is the blunt way to stop installers adding themselves and the right one for a kiosk or a shared floor PC. Our Group Policy editor guide covers where those live and how to test one before it goes into a GPO.
The gap in policy is the app that registers a task or a service. For those, the control is the application's own switch, set by policy. Teams is the common case: the Intune settings catalog carries "Prevent Microsoft Teams from starting automatically after installation", and a PowerShell remediation handles users who already opened the app once. The r/sysadmin thread below is the mirror image, an admin trying to turn Teams autostart on for everyone after the checkbox stopped working, and the answer is the same StartupApproved key from earlier, set per user through a logon script or a remediation.
A script reports the list you have. The short version reads the two places Task Manager reads, for every profile on the machine, in one pass:
powershell$keys = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' foreach ($k in $keys) { Get-ItemProperty $k -ErrorAction SilentlyContinue | Select-Object * -ExcludeProperty PS* } Get-ScheduledTask | Where-Object { $_.Triggers.CimClass.CimClassName -match 'Logon|Boot' } | Select-Object TaskName, TaskPath, State
The full version is autorunsc with -c -m -s -a *, dropped on each machine and run as a scheduled task or through your RMM, with the CSV collected centrally. If you run OpenFrame, that is a script run across a client's devices with the output collected in one place, so the question "which machines picked up the new Adobe updater" has an answer without opening twenty remote sessions.
Then the loop. Baseline every machine once. Diff monthly, or on every "it's slow since Tuesday" ticket. Anything new goes through the decision gates below. Anything that keeps reappearing after a disable gets its installer's own switch set by policy rather than another manual toggle. For the wider cleanup of what ships on a new Windows 11 image, the debloat guide covers the apps worth removing before the first user signs in.
The same five places are the persistence list in every incident report. Run keys, scheduled tasks, services and the Winlogon values are how malware survives a reboot, and a startup audit is a cheap persistence hunt if you read it that way.
Four checks separate a noisy updater from something worse. Where the executable lives: Program Files and System32 are expected, AppData, Temp, ProgramData and Public are not. Whether the name is spelled right: a second svchost.exe outside System32 is a classic. Whether the signature verifies: Autoruns marks unverified entries, and an unsigned binary in a Run key on a managed machine is rare enough to open a ticket. And what it does once running: Resource Monitor's Network tab shows which process is talking to the internet, and a startup item that beacons every minute is not an updater.
If two of those fail, stop treating it as a slow-boot ticket. Isolate the machine, let the EDR do its work, and only then remove the entry, because deleting the Run value while the process is alive leaves the process alive. The order that works is in our guide to removing malware.
The opposite mistake costs more tickets. Disabling the antivirus service, the backup agent, the VPN client or your own RMM because they rated High impact buys a faster sign-in and a machine nobody can manage. Those stay. The decision for everything else comes down to four gates.
Run Autoruns elevated on the three slowest machines in the fleet with Microsoft entries hidden, and write down what is in the Scheduled Tasks and Services tabs that Task Manager never showed. That list is usually the whole answer. Then put autorunsc on a monthly schedule with its CSV collected somewhere you will read it, set the Run-list policy for the machines that should not accept new startup items, and turn on the Windows 11 startup notification everywhere else.
If the sign-in is still slow after the startup list is clean, the next suspects are Fast Startup and the processes that stay busy after the desktop appears. Our Fast Startup guide covers the first, and the lower CPU usage guide covers the second.
Lead AI Fairy
Some things defy easy explanation: magic dust, the northern lights… and Flamingo’s AI Angels. Think Charlie’s Angels, reimagined with automation brains and serious RMM (Remote Monitoring & Management) chops. Weird? A little. Effective? Absolutely. That’s the job.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.