# cscript.exe

Windows Process: Microsoft Corporation

Catalog search terms cscript, windows script host console, wsh console

Windows, System Component

Windows Script Host console host. E dey run .vbs and .js and e dey write go Command Prompt window. wscript.exe na the GUI host.

## Wetin you need know

cscript na console WSH, no be wscript.

cscript.exe na the console Windows Script Host. Scheduled task dem and admin script dem prefer am so that output go enter console. wscript.exe na the windowed host.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **Same thing as wscript?**: No. wscript na the GUI host

  **Same thing as cmd?**: No. cmd.exe na the shell wey dey round am

Feex tok say

If black window dey print script text and the image na cscript, I go read that script path. I no dey end wscript for console job, and I no dey blame powershell unless the command line talk am.

## Wetin be cscript.exe?

cscript.exe na console Windows Script Host, no be wscript.exe. Both of dem dey host .vbs and .js. Na only this one dem build for stdout and scheduled task dem.

## Wetin e dey do?

E dey run the script come show the result for console. E no dey draw MsgBox the way wscript dey do unless the script force UI.

## Wetin make am dey run?

Na task, logon script, or admin command call cscript //nologo. Any copy wey dey run non-stop need the script path, no be to guess say na cmd.exe.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'cscript.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check the script path

System32 cscript.exe na from Microsoft. The .vbs wey e open na the risk. Any cscript.exe for AppData no be WSH.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\cscript.exe`

- Console WSH host
- GUI brother: wscript.exe
- No be powershell.exe

## I fit end am?

E dey stop that script

If you end cscript.exe e go kill the console script. The cmd.exe window wey open am fit remain. wscript.exe na different host.

## I fit comot am?

No

No delete cscript.exe. Use AppLocker or WDAC block scripts if you need that kind control. wscript.exe na the GUI host, no be this console host.

## E suppose start with Windows?

Na scheduled task or script dey start am. E no be chat Startup row.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | cscript.exe                                                                        |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\cscript.exe                                                    |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### Console flash when you logon

Leftover cscript task fit flash one window comot quickly. Check Task Scheduler. That one no be wscript and e no be PowerShell unless the action talk so.

### People dey end cmd.exe and the script go still dey run

The host na cscript.exe. cmd.exe fit just be wetin start am.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Match the command line to one task

Look for cscript.exe and one .vbs path. wscript.exe na the wrong row for console job.

### No replace cscript from forum zip file

Na Servicing get System32.

## Technical details

Technical details

| Image name | cscript.exe                 |
| ---------- | --------------------------- |
| Role       | Windows Script Host console |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[wscript.exe: Windows Process](https://feex.it/wiki/l/pcm/process/wscript.exe/)[cmd.exe: Application Process](https://feex.it/wiki/l/pcm/process/cmd.exe/)[powershell.exe: Application Process](https://feex.it/wiki/l/pcm/process/powershell.exe/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Windows processes: Category](https://feex.it/wiki/process/windows/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: cscript ](https://learn.microsoft.com/windows-server/administration/windows-commands/cscript)· Console Windows Script Host
- [Microsoft Learn: wscript ](https://learn.microsoft.com/windows-server/administration/windows-commands/wscript)· GUI brother
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: cscript.exe

  **Typical path**: C:\Windows\System32\cscript.exe

  **Record context**: Feex Wiki reference entry

  **Related process**: [wscript.exe](https://feex.it/wiki/l/pcm/process/wscript.exe/)

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/cscript.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)