Sixty-four-bit Windows runs a registry redirector: when a 32-bit process opens certain HKLM paths, it silently lands in the Wow6432Node subtree instead. Two parallel worlds share one machine, and startup entries live in both.
Where the duplicate lists are
HKLM\…\CurrentVersion\Run
native 64-bit machine startup (needs admin to change)
HKLM\…\Wow6432Node\…\Run
32-bit view of the same machine startup
HKCU\…\CurrentVersion\Run
your per-user list — no Wow6432 split for HKCU
That last row is the useful surprise: because HKCU isn't redirected, the per-user startup list is already the whole per-user story on both architectures. The split only complicates machine-scope audits.
Practical consequences
- Autoruns (official Sysinternals) merges both views and marks each entry's architecture — that's why its list is longer than a naive
reg query. - A “hidden” startup entry that reappears at boot but is absent from your usual key listing is the classic sign you read one view only.
- Per-account tuning intentionally avoids the whole mess: the HKCU list is one list, readable and writable without elevation, on both 32- and 64-bit apps alike.
Takeaway: scope first, view second. Account-scope audits are exempt from redirection; machine-scope audits are twice as wide as they look.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.