AutoRun and the companion feature AutoPlay are components of the Microsoft Windows operating system that dictate what actions the system takes when a drive is mounted.
AutoRun was introduced in Windows 95 to ease application installation for non-technical users and reduce the cost of software support calls. When an appropriately configured CD-ROM is inserted into a CD-ROM drive, Windows detects the arrival and checks the contents for a special file containing a set of instructions. For a CD containing software, these instructions normally initiate installation of the software from the CD-ROM onto the hard drive. To maximise the likelihood of installation success, AutoRun also acts when the drive is accessed ("double-clicked") in Windows Explorer (or "My Computer").
Until the introduction of Windows XP, the terms AutoRun and AutoPlay were used interchangeably, developers often using the former term and end users the latter. This tendency is reflected in Windows Policy settings named AutoPlay that change Windows Registry entries named AutoRun, and in the file which causes "AutoPlay" to be added to drives’ context menus. The terminology was of little importance until the arrival of Windows XP and its addition of a new feature to assist users in selecting appropriate actions when new media and devices were detected. This new feature was called AutoPlay and a differentiation between the two terms was created.What's the difference between AutoPlay and AutoRun?, Microsoft, Windows Vista Help
AutoRun, a feature of Windows Explorer (actually of the shell32 dll) introduced in Windows 95, enables media and devices to launch programs by use of command listed in a file called , stored in the root directory of the medium.
Primarily used on installation CD-ROMs, the applications called are usually application installers. The autorun.inf file can also specify an icon which will represent the device visually in Explorer along with other advanced features.
The terms AutoRun and AutoPlay tend to be interchangeably used when referring to the initiating action, the action that detects and starts reading from discovered volumes. AutoRun is positioned as a layer between AutoPlay and the Shell Hardware Detection service which may help in understanding the terminology. However, to avoid confusion, this article uses the term AutoRun when referring to the initiating action.
AutoPlay
AutoPlay is a feature introduced in Windows XP which examines removable media and devices and, based on content such as pictures, music or video files, launches an appropriate application to play or display the content. If available, settings in an autorun.inf file can add to the options presented to the user.
AutoPlay is based on a set of handler applications registered with the AutoPlay system. Each media type (Pictures, Music, Video) can have a set of registered handlers which can deal with playing or display that type of media.
Each hardware device can have a default action occurring on discovery of a particular media type, or the AutoPlay dialog can prompt the user what action to take.
AutoRun activation
The AutoRun sequence starts with the initial discovery of a new device or new piece of media. Following this, notification of interested parties occurs, of which the Windows Explorer shell is of primary interest. After checking certain Registry settings to see if AutoRun can proceed, parsing of an optional autorun.inf may occur and any necessary actions are taken.
The initial sequence is handled much the same in every version of Windows from Windows 95. However, the way the autorun.inf file is read and acted upon and the level of integration of AutoRun with AutoPlay has changed significantly from the time AutoPlay was introduced in Windows XP until the present handling in Windows 7. In Windows 10, Microsoft has added the option to enable autorun in its settings. Not only users can turn it on but also they can choose specific external devices for autoplay.
Initiation and notification
When a device with AutoRun-compatible drivers receives new media, a "Media Change Notification" event occurs. The Windows OS then notifies interested applications that a device change has occurred. The notification method used can change depending on the device type.
If the device changed is a volume (like a CD) or a port (like a serial port) Windows broadcasts a notification to all top-level windows.How to receive notification of CD-ROM insertion or removal, Microsoft, Knowledge BaseDetecting media insertion or removal, Microsoft, MSDN Library Windows calls this a "basic" notification. A top-level window is one which is a descendant of the desktop.
However, if the device changed is not one of these types an application can use the RegisterDeviceNotification function, Microsoft, MSDN Library function to register to receive device notifications.
An article on the CodeProject website, "Detecting Hardware Insertion and/or Removal", with clarifications from a blog by Doran Holan is of particular technical interest here.
Non-volume devices are those devices that do not appear as drive letters in "My Computer". These are not handled by any part of AutoRun - any actions taken for these devices are taken either by device specific software or by AutoPlay. See AutoPlay#Devices that are not drives.
When Explorer receives notification of a volume change, it performs a number of actions:Creating an AutoRun-Enabled Application, Microsoft, MSDN LibraryEnabling and Disabling AutoRun, Microsoft, MSDN Library
Checks to see if AutoRun has been disabled through the Registry. If AutoRun is disabled for that drive or drive type, Explorer does not proceed further. There have been bugs in this area. Checks that the root directory of the inserted media contains an autorun.inf file, which might be read. See below. Sends a message to the foreground window. An application which has registered its interest in receiving this message using can respond to this message to halt AutoRun (and thus AutoPlay) at this point. Any application, foreground or not, can also be notified by using the COM interfaceIQueryCancelAutoPlay Interface, Microsoft, MSDN Library available in Windows XP and later. Alters double-click and contextual menu behaviours. When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens is fully programmable by settings in the autorun.inf file. Adds an autorun.inf controllable icon and descriptive text to the drive icon. Checks to see if the key is held down. If it is then Windows Vista (and later Windows versions) will invoke the AutoPlay dialog regardless of settings to the contrary.AutoPlay: frequently asked questions, Microsoft, Windows Vista Help Previous versions of Windows will not continue with the process. Finally, if this point has been reached, either: takes no further action. executes the "AutoRun task", the application optionally specified in the open or shellexecute keys in an autorun.inf's [autorun] section. invokes AutoPlay. Which choice is made depends on the version of Windows in use, instructions from the autorun.inf if available and the type of the media discovered.
Changing behaviour
Before AutoPlay
On Windows versions prior to Windows XP, an autorun.inf file on any drive type will be read and its instructions followed. The AutoRun task, if specified, is executed immediately without user interaction.How to Test autorun.inf Files, Microsoft, Knowledge Base This includes DRIVE_REMOVABLE, DRIVE_FIXED and DRIVE_REMOTE drive types.
AutoRun will work with network drives (the DRIVE_REMOTE drive type) that are mapped to a drive letter. AutoRun will also work with floppy drives that are provided with autorun-compatible drivers.
The default Registry settings on Windows versions prior to Windows XP (See NoDriveTypeAutoRun), disable Remote and Removable drives from AutoRun initiation, leaving Fixed and CDROM drive types active by default.
Introducing AutoPlay
With the introduction of AutoPlay in Windows XP, the final stage action (stage 7 above) for some drive types changed from executing an application to invoking AutoPlay. From Windows Vista, the AutoPlay system is integrated into every aspect of media handling and there is no automatic execution of the AutoRun task.
The default Registry settings add Removable drives to those that initiated AutoRun. In Windows XP and higher, except Windows Server 2003, only the Unknown and Remote drive types are not active for AutoRun.
The handling of the autorun.inf file changes very significantly between each Windows version. The details can be found in the autorun.inf article. The current handling in Windows 7 is that only drives of type DRIVE_CDROM may specify an AutoRun task, alter double-click behaviour or change context menus.
Registry settings
AutoRun consults Windows Registry values to decide whether to initiate actions for any particular drive or drive type. These values can be changed using several methods, one of which is using Group Policy.
The primary relevant Registry entry names are and . These exist in both per-machine and per-user settings and their location and priority in the Registry are described in further detail below.
Drive types
The drive types are distinguished by Type Name as follows:GetDriveType Function, Microsoft, MSDN Library
Type name value Description DRIVE_UNKNOWN 0x00000000 The drive-type could not be determined (generic drive) DRIVE_NO_ROOT_DIR 0x00000001 The drive is currently invalid (no mounted volumes) DRIVE_REMOVABLE 0x00000002 The drive has removable media (floppy drive, USB flash drive) DRIVE_FIXED 0x00000003 The disk cannot be removed from the drive (hard disk/solid state drive) DRIVE_REMOTE 0x00000004 The drive is a remote (network) drive DRIVE_CDROM 0x00000005 The drive is a CD-ROM, DVD-ROM or BD-ROM drive DRIVE_RAMDISK 0x00000006 The drive is a RAM disk DRIVE_NOT_DETERMINED 0x00000007 The drive has not yet been determined DRIVE_NOT_FOUND 0x00000008 The drive currently can't be accessed (detached drives) [RESERVED] 0x00000009 This value reserved for future-technologies
Registry terminology
The Windows Registry is a hierarchical database that stores configuration settings and options for the operating system. The terminology is somewhat misleading so it is briefly summarised here.
A Registry key is similar to a folder that, in addition to values, each key can contain subkeys which in turn may contain subkeys, and so on.
A Registry value consists of a name-data pair. Microsoft documentation commonly uses the term "entry" as an equivalent term. It also uses "value" for "data" when it is obvious what is meant. To avoid confusion, this article always uses the term "entry" when referring to the name-data pair.
Two Registry keys that are very commonly referred to are which contains per-machine settings, and which contains settings for the currently logged-on user. These are almost always abbreviated as and respectively. There may be many users of a machine; their settings are stored in , is actually just a link to the appropriate place in .
Changing Registry settings
Registry settings may be changed directly by using the GUI tool or the command line utility. Settings can also be placed in a text file,How to use a registration entries file, Microsoft, Knowledge Base named with a .reg extension type. For example, "". When the file is double clicked, the settings in the file are entered into the Registry, permissions allowing.
They can be changed indirectly by using Group Policy, applied locally to a single computer with or to a domain with .
It may be necessary to either logout or restart the computer in order for any Registry changes to take effect.
Evaluation order