Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The process conhost.exe started showing up on Windows 7, and searching Google doesn't reveal an explanation of what this process is and why it shows up.

What is the conhost.exe process?

share|improve this question

5 Answers 5

up vote 23 down vote accepted

conhost.exe is the new host process for console windows. Previously those were handled by csrss.exe which is the “Client Server Runtime Process”, a process running with system-level privileges.

Starting with Windows Vista, Microsoft made some very substantial improvements and changes in regard to security. One of those changes was that applications running in different “levels” or as different users weren't allowed to exchange data freely.

Since console windows were handled by csrss.exe this had the side-effect that you could no longer drag files onto a console window and have the full path and file name inserted. Drag & drop is such a case of data exchange which was ruled out. People cried out even though most Windows users probably didn't even know of that feature.

I doubt, though, that the missing drag & drop functionality was the reason behind pulling console windows out of csrss. The more pragmatic reason would be that there is absolutely no reason to have such functionality sitting that close to the core of the OS. Granted, it's not as much functionality as there could be if Windows would implement terminal emulators as usual on UNIX-like OSes (and much less than there would be if UNIX-likes fully adhered to ECMA-48). But nevertheless, anything going wrong with a single console window could tear a core part of the operating system down.

Making changes to how console windows work gets much harder due to that since you have to consider pretty dire consequences if anything goes wrong. Another change you'll see, except drag & drop working again, is that characters are no longer confined to their cell. Especially with ClearType enabled some glyphs would go beyond their cell boundaries and leave trails and other artifacts behind. This is almost (but not quite) fixed by now.

share|improve this answer
1  
And all of a sudden, my rage against some weird console behavior fly away, thanks for this response. –  SuperBloup Dec 31 '09 at 11:49
    
They were previously hosted by csrss because of the fullscreen functionality. –  kinokijuf Dec 25 '11 at 8:52
    
They were previously hosted by csrss because of the fullscreen functionality. @kinokijuf, which is a sorely missed feature in Vista+. –  Synetech Jul 25 '13 at 19:50

I just wrote up an article attempting to explain the purpose of the process. It's geared towards regular people, but there's lots of screenshots to illustrate.

What is conhost.exe and Why Is It Running?

The bottom line is that conhost.exe sits between the CSRSS process and cmd.exe, so you can use drag & drop again.

alt text

share|improve this answer

It is the console window host on Windows 7. A couple programs (Spybot comes to mind) will detect it as a false positive, but it is made by Microsoft and it's not malicious.

share|improve this answer

Conhost.exe is a new binary on Win7. It hosts the command prompt window that cmd.exe runs in.

Source here

share|improve this answer

I used "what is conhost.exe?" with Google, including the quotes, and received one answer: http://www.fileinspect.com/fileinfo/conhost-exe/

It says: The conhost.exe is a Console Window Host. This file is part of Microsoft® Windows® Operating System. Conhost.exe is developed by Microsoft Corporation. It’s a system and hidden file. Conhost.exe is usually located in the %SYSTEM% folder and its usual size is 270,848 bytes. The conhost.exe process is safe and disabling it can be dangerous, because programs on your computer need it to work correctly.

It's still a new application so it's logical that it's not very well-known at Google. It helps when you make your queries more specific...

share|improve this answer

protected by Community Aug 24 '11 at 4:09

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.