How Windows 98 Handled Registry Run Startup Keys

In Microsoft Windows 98, automatic program execution at boot was primarily managed through specific Run keys located in the Windows Registry. During the startup sequence, the operating system systematically evaluated these keys across both machine-wide and user-specific configurations, executing hardware utilities, network components, background tasks, and user applications before and during the initialization of the desktop shell.

Windows 98 organized registry startup programs into distinct keys located within the HKEY_LOCAL_MACHINE (HKLM) and HKEY_CURRENT_USER (HKCU) hives under the subkey \Software\Microsoft\Windows\CurrentVersion\. These were categorized into four primary types: RunServices, RunServicesOnce, Run, and RunOnce. Each entry inside these keys was structured as a named value where the value name served as an identifier and the value data contained the executable path and any command-line parameters.

The startup process followed a strict chronological sequence:

  1. RunServicesOnce (HKLM): Executed first, before user authentication or the network login dialog appeared. These programs ran synchronously or asynchronously depending on implementation, and each entry was removed from the registry before or immediately upon execution to prevent recurring runs.
  2. RunServices (HKLM): Executed immediately after RunServicesOnce, also prior to the user logging in. This key was designed for background system utilities, hardware agents, and processes intended to act like services in Windows 98, which lacked the native NT Services architecture.
  3. RunOnce (HKLM): Processed after the user logged in, but before the main Windows shell (Explorer.exe) loaded. Windows 98 ran these programs sequentially, pausing the startup flow until each program launched or terminated, depending on flag prefixes (such as an asterisk to run in Safe Mode).
  4. Run (HKLM): Executed as the shell initialized. Programs listed here ran asynchronously with standard user privileges, providing a common location for hardware drivers, audio panels, and anti-virus scanners.
  5. RunOnce (HKCU): Executed for the specific logged-in user profile before the user's desktop became interactive, deleting entries upon execution.
  6. Run (HKCU): Executed in parallel with HKLM Run entries or shortly after, specifically launching programs assigned only to the active user account.

Unlike modern operating systems that execute background tasks in isolated sessions, Windows 98 ran all registry startup entries in the same single-user context. Most applications launched via standard Run keys executed simultaneously in parallel, which often caused disk thrashing on older hardware as multiple programs competed for input/output resources.

To manage the frequent software bloat caused by programs adding themselves to these keys, Windows 98 introduced the System Configuration Utility (msconfig.exe). This tool allowed users to disable startup items without manually modifying the registry by transferring disabled entries to temporary subkeys, such as Run- or RunOnce-, so they would be ignored during subsequent boots.