Autoruns in Sysinternals does not track "disabled" startup items (in Task Manager)

An Autoruns check mark represents whether the underlying autostart entry is enabled through Autoruns, not the effective Enabled/Disabled state that Task Manager maintains for that startup app.

Task Manager’s Disable command prevents a registered startup app from running when the user signs in ^1^. Autoruns separately documents its checkbox as its own editing operation: clear the checkbox to disable an autostart entry ^2^.

Consequently, the Autoruns check mark should not be interpreted as “this application will definitely run.” The official documentation does not state that Autoruns reads or displays Task Manager’s startup approval state, nor that the two interfaces synchronize their enabled/disabled indicators.

Verify that both tools refer to the same registration

1. Run Autoruns and locate the item under Logon.
2. Select it and choose Entry → Jump to Entry. Autoruns will open the Registry or file-system location represented by that row ^2^.
3. Check the Image Path, Publisher, and target executable rather than relying only on the display name.
4. Confirm in Task Manager that the corresponding application remains Disabled, then sign out and back in or restart Windows.
5. Verify that its process did not start.

Autoruns covers substantially more startup mechanisms than Task Manager, including logon entries, services, scheduled tasks, Winlogon items, Explorer extensions, drivers, and other locations. Two similarly named rows can therefore be separate startup hooks rather than the same record ^2^.

Which control to use

• To preserve and manage the state shown by Task Manager, continue using Task Manager → Startup apps → Disable.
• To disable the underlying entry through Autoruns, clear its checkbox. This changes Autoruns’ represented autostart configuration and may be a different operation from Task Manager’s disable action.
• Avoid deleting the Autoruns entry merely to make the displays agree. Deletion removes the autostart configuration; unchecking is reversible and is the documented disable operation.

If the confirmed process does run after Task Manager shows it as disabled, inspect Autoruns’ Scheduled Tasks, Services, and other relevant tabs for an additional launch mechanism. That would be a separate startup path, not evidence that the Task Manager-disabled record itself ran.

In short, this is a display/semantic limitation: Autoruns documents configured autostart locations and its own checkbox state, while Task Manager reports its startup-app state. Cross-tool synchronization of those indicators is not a documented Autoruns capability.

References

1. Configure Startup applications in Windows | Microsoft Support
2. Autoruns - Sysinternals | Microsoft Learn