# pwsh.exe

Application Process: Microsoft Corporation

Also called pwsh, powershell 7, powershell core

Windows, Application

PowerShell 7. It is the cross-platform pwsh host, often under Program Files\PowerShell\7. It is not Windows PowerShell 5.1 (powershell.exe).

## What you need to know

pwsh is PowerShell 7, not Windows PowerShell 5.1.

pwsh.exe is PowerShell 7, installed from Microsoft as a side-by-side host. powershell.exe is still Windows PowerShell 5.1 in System32\WindowsPowerShell. Windows Terminal and OpenConsole only draw the window. Ending pwsh does not remove 5.1.

- **Safe?**: The host is. The script may not be

  **Same as powershell.exe?**: No. That is Windows PowerShell 5.1

  **Can I end it?**: That PowerShell 7 session stops

Feex says

If I see pwsh, I read the command line as PowerShell 7. I do not treat powershell.exe as the same host, and I do not blame conhost for a 7-only module.

## What is pwsh.exe?

pwsh is PowerShell 7, not Windows PowerShell 5.1. The 5.1 host stays powershell.exe. This file is the newer runtime you install. It is not Windows Terminal.

## What does it do?

It runs PowerShell 7 scripts and modules. Some 5.1 snap-ins will not load here. It does not draw the tab UI (WindowsTerminal.exe) and it is not cmd.exe.

## Why is it running?

You opened PowerShell 7, a VS Code terminal set to pwsh, or a task called this host. A PC with only 5.1 will not show a Program Files\PowerShell\7 copy.

## Is it safe?

Host is legitimate. Script is the question

A Microsoft-signed pwsh under Program Files\PowerShell is PowerShell 7. A pwsh.exe in Temp is not. Safety is still the parent and the -Command line. This is still not powershell.exe.

A legitimate copy normally runs from:

`C:\Program Files\PowerShell\7\pwsh.exe`

- PowerShell 7 side-by-side install
- Windows PowerShell 5.1 is System32\WindowsPowerShell\v1.0\powershell.exe
- Window may be Windows Terminal or OpenConsole

## Can I end it?

Stops that 7 session

Ending pwsh.exe kills PowerShell 7. powershell.exe 5.1 can stay. Ending WindowsTerminal.exe only closes the tab UI, not every 7 host started by a task.

## Can I remove it?

Uninstall PowerShell 7, keep 5.1

Uninstall PowerShell from Apps if you want pwsh gone. Do not delete System32\powershell.exe. Do not delete System32.

## Should it start with Windows?

A scheduled task or profile can start pwsh. That is not the 5.1 host and not a Windows default named powershell.exe.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the 7 script

  **Memory**: Can grow on large object pipelines

  **Disk**: Follows the script

  **Network**: Follows the script

## File information

| Executable name        | pwsh.exe                               |
| ---------------------- | -------------------------------------- |
| Common legitimate path | C:\Program Files\PowerShell\7\pwsh.exe |
| Publisher              | Microsoft Corporation                  |
| Signature expectation  | Signed by Microsoft Windows            |

## Common problems

### A 5.1-only snap-in fails and they repair powershell.exe

This host is 7. Install the 7 module or run Windows PowerShell 5.1. Different exe, different gallery story.

### Hidden pwsh from a random task

Read -File / -Command. The 7 host is still Microsoft. The payload is the line. That is not "Terminal is malware."

## Troubleshooting

Diagnose before you change anything destructive.

### pwsh -v versus $PSVersionTable in powershell.exe

7 prints from this file. 5.1 prints from Windows PowerShell. Do not mix the upgrade docs.

### Inspect parent PID the same way you would for 5.1

explorer plus a shortcut is you. Office launching pwsh is a macro story. Do not delete the 7 install folder as the first move.

## Technical details

Technical details

| Image name | pwsh.exe                                |
| ---------- | --------------------------------------- |
| Sibling    | powershell.exe (Windows PowerShell 5.1) |

## Related

These entities connect to this article. Type is shown on every link.

[powershell.exe: Application Process](https://feex.it/wiki/process/powershell.exe)[cmd.exe: Application Process](https://feex.it/wiki/process/cmd.exe)[WindowsTerminal.exe: Application Process](https://feex.it/wiki/process/windowsterminal.exe)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: PowerShell 7 vs Windows PowerShell ](https://learn.microsoft.com/powershell/scripting/whats-new/differences-from-windows-powershell)· pwsh.exe is PowerShell 7, powershell.exe is 5.1
- [Microsoft Learn: install PowerShell on Windows ](https://learn.microsoft.com/powershell/scripting/install/installing-powershell-on-windows)· Typical path is Program Files\PowerShell\7
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Application Process

  **Publisher**: Microsoft Corporation

  **Executable**: pwsh.exe

  **Typical path**: C:\Program Files\PowerShell\7\pwsh.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/pwsh.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)