What is the 'conhost.exe' process that shows up in Task Manager?

Question

The process conhost.exe started showing up on Windows 7, and searching Google doesn't reveal an explanation of what this process is and why it shows up.

What is the conhost.exe process?

Answer 1

conhost.exe is the new host process for console windows. Previously those were handled by csrss.exe which is the “Client Server Runtime Process”, a process running with system-level privileges.

Starting with Windows Vista, Microsoft made some very substantial improvements and changes in regard to security. One of those changes was that applications running in different “levels” or as different users weren't allowed to exchange data freely.

Since console windows were handled by csrss.exe this had the side-effect that you could no longer drag files onto a console window and have the full path and file name inserted. Drag & drop is such a case of data exchange which was ruled out. People cried out even though most Windows users probably didn't even know of that feature.

I doubt, though, that the missing drag & drop functionality was the reason behind pulling console windows out of csrss. The more pragmatic reason would be that there is absolutely no reason to have such functionality sitting that close to the core of the OS. Granted, it's not as much functionality as there could be if Windows would implement terminal emulators as usual on UNIX-like OSes (and much less than there would be if UNIX-likes fully adhered to ECMA-48). But nevertheless, anything going wrong with a single console window could tear a core part of the operating system down.

Making changes to how console windows work gets much harder due to that since you have to consider pretty dire consequences if anything goes wrong. Another change you'll see, except drag & drop working again, is that characters are no longer confined to their cell. Especially with ClearType enabled some glyphs would go beyond their cell boundaries and leave trails and other artifacts behind. This is almost (but not quite) fixed by now.

Answer 2

It is the console window host on Windows 7. A couple programs (Spybot comes to mind) will detect it as a false positive, but it is made by Microsoft and it's not malicious.

Answer 3

Conhost.exe is a new binary on Win7. It hosts the command prompt window that cmd.exe runs in.

Source here

Answer 4

I used "what is conhost.exe?" with Google, including the quotes, and received one answer: http://www.fileinspect.com/fileinfo/conhost-exe/

It says: The conhost.exe is a Console Window Host. This file is part of Microsoft® Windows® Operating System. Conhost.exe is developed by Microsoft Corporation. It’s a system and hidden file. Conhost.exe is usually located in the %SYSTEM% folder and its usual size is 270,848 bytes. The conhost.exe process is safe and disabling it can be dangerous, because programs on your computer need it to work correctly.

It's still a new application so it's logical that it's not very well-known at Google. It helps when you make your queries more specific...

Answer 5

I just wrote up an article attempting to explain the purpose of the process. It's geared towards regular people, but there's lots of screenshots to illustrate.

What is conhost.exe and Why Is It Running?

The bottom line is that conhost.exe sits between the CSRSS process and cmd.exe, so you can use drag & drop again.