# cscript.exe

Windows Process: Microsoft Corporation

Also called cscript, windows script host console, wsh console

Windows, System Component

Windows Script Host console host. It runs .vbs and .js and writes to a Command Prompt window. wscript.exe is the GUI host.

## What you need to know

cscript is console WSH, not wscript.

cscript.exe is the console Windows Script Host. Scheduled tasks and admin scripts prefer it so output lands in a console. wscript.exe is the windowed host.

- **Safe?**: Yes, in System32, if you meant the script

  **Same as wscript?**: No. wscript is the GUI host

  **Same as cmd?**: No. cmd.exe is the shell around it

Feex says

If a black window is printing script text and the image is cscript, I read that script path. I do not end wscript for a console job, and I do not blame powershell unless the command line says so.

## What is cscript.exe?

cscript.exe is console Windows Script Host, not wscript.exe. Both host .vbs and .js. Only this one is built for stdout and scheduled tasks.

## What does it do?

It runs the script and prints to the console. It does not draw MsgBox the way wscript does unless the script forces UI.

## Why is it running?

A task, a logon script, or an admin command called cscript //nologo. A forever-running copy needs the script path, not a guess that it is cmd.exe.

## Is it safe?

Check the script path

System32 cscript.exe is Microsoft. The .vbs it launched is the risk. A cscript.exe in AppData is not WSH.

A legitimate copy normally runs from:

`C:\Windows\System32\cscript.exe`

- Console WSH host
- GUI sibling: wscript.exe
- Not powershell.exe

## Can I end it?

Stops that script

Ending cscript.exe kills the console script. The cmd.exe window that launched it may stay. wscript.exe is a different host.

## Can I remove it?

No

Do not delete cscript.exe. Block scripts with AppLocker or WDAC if you need that control. wscript.exe is the GUI host, not this console host.

## Should it start with Windows?

A scheduled task or a script starts it. It is not a chat Startup row.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the script

  **Memory**: Small unless the script leaks

  **Disk**: Script output

  **Network**: Only if the script uses the network

## File information

| Executable name        | cscript.exe                     |
| ---------------------- | ------------------------------- |
| Common legitimate path | C:\Windows\System32\cscript.exe |
| Publisher              | Microsoft Corporation           |
| Signature expectation  | Signed by Microsoft Windows     |

## Common problems

### Console flash at logon

A leftover cscript task can flash a window. Read Task Scheduler. That is not wscript and not PowerShell unless the action says so.

### People end cmd.exe and the script keeps going

The host is cscript.exe. cmd.exe may only have started it.

## Troubleshooting

Diagnose before you change anything destructive.

### Match the command line to a task

Look for cscript.exe and a .vbs path. wscript.exe is the wrong row for a console job.

### Do not replace cscript from a forum zip

Servicing owns System32.

## Technical details

Technical details

| Image name | cscript.exe                 |
| ---------- | --------------------------- |
| Role       | Windows Script Host console |

## Related

These entities connect to this article. Type is shown on every link.

[wscript.exe: Windows Process](https://feex.it/wiki/process/wscript.exe)[cmd.exe: Application Process](https://feex.it/wiki/process/cmd.exe)[powershell.exe: Application Process](https://feex.it/wiki/process/powershell.exe)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: cscript ](https://learn.microsoft.com/windows-server/administration/windows-commands/cscript)· Console Windows Script Host
- [Microsoft Learn: wscript ](https://learn.microsoft.com/windows-server/administration/windows-commands/wscript)· GUI sibling
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: cscript.exe

  **Typical path**: C:\Windows\System32\cscript.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [wscript.exe](https://feex.it/wiki/process/wscript.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/cscript.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)