# wscript.exe

Windows Process: Microsoft Corporation

Also called wscript, windows script host, wsh gui

Windows, System Component

Windows Script Host GUI host. It runs .vbs and .js with dialogs and no console window. cscript.exe is the console host. powershell.exe is PowerShell.

## What you need to know

wscript is GUI WSH, not cscript and not powershell.

wscript.exe is Windows Script Host with a GUI. Double-clicked .vbs and .js files often start here. cscript.exe writes to a console. powershell.exe is a different language host.

- **Safe?**: Yes, in System32, if you meant to run the script

  **Same as cscript?**: No. cscript is the console host

  **Same as PowerShell?**: No

Feex says

If a .vbs popped a box and the name is wscript, I read the script path. I do not end powershell.exe for that dialog, and I do not treat cscript as the same window.

## What is wscript.exe?

wscript.exe is GUI Windows Script Host. It is not cscript.exe and it is not powershell.exe. The file is System32\wscript.exe.

## What does it do?

It loads a script and can show MsgBox-style UI. cscript.exe prints to stdout instead. PowerShell does not use this host.

## Why is it running?

You double-clicked a .vbs or .js, a logon script called wscript, or an installer still uses WSH. A wscript that stays with a weird script path needs a path check.

## Is it safe?

Check the script path

System32 wscript.exe is Microsoft. The script it launched is the risk. A wscript.exe in Temp is not WSH.

A legitimate copy normally runs from:

`C:\Windows\System32\wscript.exe`

- GUI WSH host
- Console sibling: cscript.exe
- Not powershell.exe

## Can I end it?

Stops that script

Ending wscript.exe kills the running script and its dialogs. cscript.exe and powershell.exe can stay.

## Can I remove it?

No

Do not delete wscript.exe. Change file associations or use AppLocker / WDAC if you need to block scripts. That is policy, not Explorer.

## Should it start with Windows?

A script or a Run key can start it. It should not be a permanent tray app.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the script

  **Memory**: Small unless the script leaks

  **Disk**: Whatever the script writes

  **Network**: Only if the script talks to the network

## File information

| Executable name        | wscript.exe                     |
| ---------------------- | ------------------------------- |
| Common legitimate path | C:\Windows\System32\wscript.exe |
| Publisher              | Microsoft Corporation           |
| Signature expectation  | Signed by Microsoft Windows     |

## Common problems

### Email .vbs opens wscript

That is WSH running the attachment. End this process, then quarantine the script. It is not PowerShell by default.

### People disable PowerShell to stop VBS

Wrong host. .vbs is wscript or cscript unless someone wrapped it.

## Troubleshooting

Diagnose before you change anything destructive.

### Read the command line for the .vbs or .js path

That file is the question. wscript.exe is only the host.

### Do not replace wscript from a "WSH fix" zip

Servicing owns System32.

## Technical details

Technical details

| Image name | wscript.exe             |
| ---------- | ----------------------- |
| Role       | Windows Script Host GUI |

## Related

These entities connect to this article. Type is shown on every link.

[cscript.exe: Windows Process](https://feex.it/wiki/process/cscript.exe)[powershell.exe: Application Process](https://feex.it/wiki/process/powershell.exe)[cmd.exe: Application Process](https://feex.it/wiki/process/cmd.exe)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: wscript ](https://learn.microsoft.com/windows-server/administration/windows-commands/wscript)· GUI Windows Script Host
- [Microsoft Learn: Windows Script Host ](https://learn.microsoft.com/windows/win32/lwef/windows-script-host)· WSH hosts .vbs and .js
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: wscript.exe

  **Typical path**: C:\Windows\System32\wscript.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [cscript.exe](https://feex.it/wiki/process/cscript.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/wscript.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)