A: There are several registry keys that allow an application to launch once, normally for some kind of initial setup process:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunonceEx

These keys are frequently used by malware. To increase security, commands set to execute in these keys don't run when a normal user logs on—only when an administrator logs on, per this Microsoft Article. If you want a process to run for a normal user, consider using a scheduled task.