# userinit.exe

Windows Process: Microsoft Corporation

Also called userinit, userinit logon application

Windows, System Component

Userinit Logon Application. After you sign in, winlogon starts this file so it can launch the shell, usually explorer.exe.

## What you need to know

This starts Explorer after logon, then should go away. A userinit that never exits needs a path check.

userinit.exe is the documented logon helper. winlogon launches it. It starts the Userinit value, normally explorer.exe, then exits. Persistence malware loves the same Run key name.

- **Safe?**: Yes, in System32

  **Should it stay running?**: It usually exits after the shell starts

  **Malware name?**: The filename is also abused in Run keys

Feex says

I always open the folder on userinit. System32 plus a short life is logon. A userinit.exe that stays all day from AppData is a different story.

## What is userinit.exe?

userinit.exe is Userinit Logon Application. It is the official next hop after winlogon authenticates you.

## What does it do?

It restores network connections and starts the shell listed in the Userinit registry value. On a healthy PC that shell is explorer.exe and userinit then exits.

## Why is it running?

You just signed in. A copy still running an hour later is either a custom shell replacement or a fake path.

## Is it safe?

Check the path and how long it lives

System32 userinit that exits is Windows. A second userinit in a user folder, or a Userinit registry value that points at something else, is the classic persistence trick.

A legitimate copy normally runs from:

`C:\Windows\System32\userinit.exe`

- Started by winlogon
- Should launch explorer.exe and exit
- Path first, then publisher

## Can I end it?

Only a leftover fake

Do not end the System32 copy during logon. You can interrupt the desktop start. A long-lived copy from the wrong folder is a malware step after you confirm the path.

## Can I remove it?

Only a fake copy

Do not delete System32\userinit.exe. Repair the Userinit registry value if the shell will not start. That is an advanced repair.

## Should it start with Windows?

Logon starts it once. It should not be a Startup Apps row of its own.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: A brief spike at logon

  **Memory**: Small, then gone

  **Disk**: Low

  **Network**: Mapped drives at logon

## File information

| Executable name        | userinit.exe                     |
| ---------------------- | -------------------------------- |
| Common legitimate path | C:\Windows\System32\userinit.exe |
| Publisher              | Microsoft Corporation            |
| Signature expectation  | Signed by Microsoft Windows      |

## Common problems

### Desktop never appears

If Userinit was rewritten to skip explorer.exe, you get a blank shell. That is a registry investigation, not a missing wallpaper.

### Two userinit.exe rows

One in System32 during logon is normal. One from Temp that stays is not.

## Troubleshooting

Diagnose before you change anything destructive.

### Open file location immediately

System32 is the only expected answer for the real helper.

### Do not "fix" Userinit from a random .reg

Those files are a favorite payload.

## Technical details

Technical details

| Image name | userinit.exe         |
| ---------- | -------------------- |
| Role       | Logon shell launcher |

## Related

These entities connect to this article. Type is shown on every link.

[winlogon.exe: Windows Process](https://feex.it/wiki/process/winlogon.exe)[explorer.exe: Windows Process](https://feex.it/wiki/process/explorer.exe)[What is a Windows process: Guide](https://feex.it/wiki/software/system/what-is-a-windows-process)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Winlogon ](https://learn.microsoft.com/windows/win32/secauthn/winlogon)· userinit after authentication
- [Microsoft Learn: Run and RunOnce ](https://learn.microsoft.com/windows/win32/setupapi/run-and-runonce-registry-keys)· Userinit related persistence
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: userinit.exe

  **Typical path**: C:\Windows\System32\userinit.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/userinit.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)