Two registry keys sit one folder apart and behave like opposites. Confusing them is behind most “why did that app come back / disappear” startup puzzles.
The persistent one
HKCU\Software\Microsoft\Windows\CurrentVersion\Run is evaluated every sign-in. A value there means: launch this command, every time, until somebody removes it or the approval blob disables it.
The one-shot one
HKCU\…\CurrentVersion\RunOnce is also evaluated at sign-in — and then Windows deletes the value it just ran. Installers use it for “finish setup after reboot” steps. A value that survives a sign-in in RunOnce usually means the machine didn't actually restart, or the entry was re-written.
App launched once after install, never again? RunOnce behaving correctly. App launched once after install and again forever? The installer wrote to Run, not RunOnce — and now it's your call, not the installer's.
The audit view
- RunOnce with a build date: installers timestamp via the approval FILETIME only in Run; RunOnce values have none — check the file's own timestamp instead.
- Per-user vs machine: both keys have HKLM twins that need admin. Per-user tools (and Task Manager's disable) stick to HKCU for exactly this reason.
- 32-bit variants: on x64, 32-bit installers can land under
Wow6432Node— a separate list to check before concluding anything.
The model: Run is a subscription, RunOnce is a sticky note. Treating them as one list hides information you need for support calls.
