Skip go content

cscript.exe

Windows ProcessMicrosoft Corporation

Catalog search terms cscript, windows script host console, wsh console

WindowsSystem Component

Windows Script Host console host. E dey run .vbs and .js and e dey write go Command Prompt window. wscript.exe na the GUI host.

Wetin you need know

cscript na console WSH, no be wscript.

cscript.exe na the console Windows Script Host. Scheduled task dem and admin script dem prefer am so that output go enter console. wscript.exe na the windowed host.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
Same thing as wscript?
No. wscript na the GUI host
Same thing as cmd?
No. cmd.exe na the shell wey dey round am
Feex tok say
If black window dey print script text and the image na cscript, I go read that script path. I no dey end wscript for console job, and I no dey blame powershell unless the command line talk am.

Wetin be cscript.exe?

cscript.exe na console Windows Script Host, no be wscript.exe. Both of dem dey host .vbs and .js. Na only this one dem build for stdout and scheduled task dem.

Wetin e dey do?

E dey run the script come show the result for console. E no dey draw MsgBox the way wscript dey do unless the script force UI.

Wetin make am dey run?

Na task, logon script, or admin command call cscript //nologo. Any copy wey dey run non-stop need the script path, no be to guess say na cmd.exe.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'cscript.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Check the script path

System32 cscript.exe na from Microsoft. The .vbs wey e open na the risk. Any cscript.exe for AppData no be WSH.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\Windows\System32\cscript.exe

  • Console WSH host
  • GUI brother: wscript.exe
  • No be powershell.exe

I fit end am?

E dey stop that script

If you end cscript.exe e go kill the console script. The cmd.exe window wey open am fit remain. wscript.exe na different host.

I fit comot am?

No

No delete cscript.exe. Use AppLocker or WDAC block scripts if you need that kind control. wscript.exe na the GUI host, no be this console host.

E suppose start with Windows?

Na scheduled task or script dey start am. E no be chat Startup row.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

cscript.exe file information
Executable name cscript.exe
Recorded installation path C:\Windows\System32\cscript.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

Console flash when you logon

Leftover cscript task fit flash one window comot quickly. Check Task Scheduler. That one no be wscript and e no be PowerShell unless the action talk so.

People dey end cmd.exe and the script go still dey run

The host na cscript.exe. cmd.exe fit just be wetin start am.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Match the command line to one task

Look for cscript.exe and one .vbs path. wscript.exe na the wrong row for console job.

No replace cscript from forum zip file

Na Servicing get System32.

Technical details

Technical details
cscript.exe technical details
Image name cscript.exe
Role Windows Script Host console

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?