# userinit.exe

Windows Process: Microsoft Corporation

Catalog search terms userinit, userinit logon application

Windows, System Component

Userinit Logon Application. After you sign in, winlogon dey start this file make e fit launch the shell, wey usually be explorer.exe.

## Wetin you need know

This one dey start Explorer after logon, then e suppose commot. Any userinit wey never exit need make you check the path.

userinit.exe na the documented logon helper. winlogon dey launch am. E dey start the Userinit value, normally explorer.exe, then e go exit. Persistence malware like this same Run key name well-well.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **E suppose continue to run?**: E usually dey exit after shell start

  **Malware name?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

Feex tok say

I dey always open the folder for userinit. System32 plus short life na logon. Any userinit.exe wey dey stay all day from AppData na different matter.

## Wetin be userinit.exe?

userinit.exe na Userinit Logon Application. Na im be the official next hop after winlogon authenticate you.

## Wetin e dey do?

E dey restore network connections and e dey start the shell wey dem list inside Userinit registry value. On healthy PC that shell na explorer.exe and userinit go come exit.

## Wetin make am dey run?

You just sign in now-now. Copy wey still dey run one hour later na either custom shell replacement or fake path.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'userinit.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check the path and how long e dey run

System32 userinit wey dey exit na Windows. Second userinit inside user folder, or Userinit registry value wey dey point to another thing, na the classic persistence trick.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\userinit.exe`

- winlogon na im start am
- Suppose launch explorer.exe and exit
- Path first, then publisher

## I fit end am?

Only fake one wey remain

No end the System32 copy during logon. You fit disrupt the desktop start. Long-lived copy from wrong folder na malware action after you don confirm the path.

## I fit comot am?

Only fake copy

No delete System32\userinit.exe. Repair the Userinit registry value if the shell no gree start. That one na advanced repair.

## E suppose start with Windows?

Logon dey start am once. E no suppose get im own row for Startup Apps.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | userinit.exe                                                                       |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\userinit.exe                                                   |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### Desktop no ever appear

If dem rewrite Userinit make e skip explorer.exe, you go get empty shell. That one na registry check, no be missing wallpaper.

### Two userinit.exe rows

One inside System32 during logon dey normal. One from Temp wey dey stay no normal at all.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Open file location immediately

System32 na the only expected answer for the real helper.

### No "fix" Userinit from random .reg

Those files na favorite payload.

## Technical details

Technical details

| Image name | userinit.exe         |
| ---------- | -------------------- |
| Role       | Logon shell launcher |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[winlogon.exe: Windows Process](https://feex.it/wiki/l/pcm/process/winlogon.exe/)[explorer.exe: Windows Process](https://feex.it/wiki/l/pcm/process/explorer.exe/)[Wetin bi Windows process: Guide](https://feex.it/wiki/l/pcm/software/system/what-is-a-windows-process/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Windows processes: Category](https://feex.it/wiki/process/windows/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: Winlogon ](https://learn.microsoft.com/windows/win32/secauthn/winlogon)· userinit after authentication
- [Microsoft Learn: Run and RunOnce ](https://learn.microsoft.com/windows/win32/setupapi/run-and-runonce-registry-keys)· Userinit related persistence
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: userinit.exe

  **Typical path**: C:\Windows\System32\userinit.exe

  **Record context**: Feex Wiki reference entry

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/userinit.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)