# conhost.exe

Windows Process: Microsoft Corporation

Catalog search terms conhost, console window host

Windows, System Component

Console Window Host. Na im dey draw the window for Command Prompt, PowerShell, and other console app dem.

## Wetin you need know

Na this window dey round Command Prompt, no be hidden virus by default.

conhost.exe dey host the console UI. You dey see am when cmd, PowerShell, or another console app dey run. Close that app instead of to end conhost first.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **I suppose close am?**: Close the console app instead

  **Wetin make am dey here?**: One console app open or just run finish

Feex tok say

I dey treat conhost like photo frame. The process wey get mouth na usually the command wey dey run inside am.

## Wetin be conhost.exe?

conhost.exe na Console Window Host. Na the Windows window and input path for console application dem.

## Wetin e dey do?

E dey render text, handle resize, and connect console app go desktop. Windows Terminal fit dey front of the same idea.

## Wetin make am dey run?

Console app don start. Installer dem, script dem, and developer tool dem dey do this one normal.

## Wetin make many copies dey?

Each console session fit get im own host. Plenty copy mean plenty console, no be plenty infection by default.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'conhost.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check dis running file

The original host dey inside System32. Any conhost.exe from random folder no be the Windows console host.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\conhost.exe`

- Expected publisher: Microsoft Corporation
- Path wey we expect: System32

## I fit end am?

Close the console app first

To end conhost fit kill the console session. Close Command Prompt or PowerShell if you wan stop the work.

## I fit comot am?

No

No delete conhost.exe. Console app dem need host.

## E suppose start with Windows?

E dey start with console app. No be startup leftover wey you suppose remove.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | conhost.exe                                                                        |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\conhost.exe                                                    |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### E dey stay after script finish

One script window fit still dey open. Close that window. If host remain without window, sign out and sign back in before you delete any file.

### High CPU

Look the child command. Script wey dey loop na better suspect pass the host name.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Confirm the path and signature

Open the process properties make you check say conhost.exe dey run from the correct folder and say the correct publisher sign am. Na this check you suppose do first, no be Registry edit.

### See wetin di process dey do

Task Manager fit show CPU, memory, disk, and GPU. High use during work wey dey clear dey normal. High use when PC dey idle need closer look for di related app or service.

### Avoid first steps wey fit scatter things

No delete conhost.exe, no disable critical service dem without knowing wetin go happen, or edit Registry as your first move.

## Technical details

Technical details

| Image name    | conhost.exe         |
| ------------- | ------------------- |
| Friendly name | Console Window Host |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[Wetin bi Windows process: Guide](https://feex.it/wiki/l/pcm/software/system/what-is-a-windows-process/)[How to read Task Manager: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Windows processes: Category](https://feex.it/wiki/process/windows/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: Console host ](https://learn.microsoft.com/windows/console/console-host)· Console host documentation
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: conhost.exe

  **Typical path**: C:\Windows\System32\conhost.exe

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/conhost.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)