How do I replace the system shell (explorer.exe) with another process in Windows 10?

Question

This is for Windows 10.

Is there a way to replace explorer.exe with, for example, a powershell script?

I'm looking to start a custom shell application without having to have explorer.exe run in the background or handle the startup of those items.

EDIT: Since I'm getting down voted... I was capable of doing something similar in Windows Embedded 7 Standard. I added a key called Shell to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The key added there had Powershell.exe with command line options to execute script silently. There I was able to execute my custom shell.

This does not work with Windows 10.

Answer 1

This is stored in the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Replace this with whatever you want, but the software it loads in place will then need to provide a way to log out/shut down/restart the machine, or you'll need to use Task Manager to do so.

Answer 2

This is how I've been doing it for years, from Windows NT4 on to Windows 10 and Server 2019.

It is best to change Windows Explorer's settings to show file extensions, so you don’t select ‘ntuser.dat.log’ or ‘ntuser.ini’ or another wrong file below.

1. Create a new user, let’s say ‘Test’.
2. Log on as that user, so the first logon agent is executed, creating the profile directory and registry hive.
   Log off again, and log back into your normal account (or any account that is member of the Administrators group).
3. Make sure the user account you just logged out of is not logged in – neither at the console, nor remote desktop, nor any scheduled tasks that may be active under this account, during the remainder of this procedure.
4. Open regedit, and select HKEY_USERS.
5. Menu File / Load Hive.
   Navigate to C:\Users\{new user name} -- C:\Users\Test in my example
   Select the file ‘NTUSER.DAT’ and load it.
6. You will be prompted to enter a key name. Just invent one, the user’s registry hive will be loaded under that name as a new branch in HKEY_USERS. I used ‘Test’ here.
7. Go to HKEY_USERS\Test\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
   Create a new String value, named Shell.
   Set it to the application you want to start instead of the normal Windows shell.
   Specify the full path, make no assumptions about PATH environment variables etc., as far as I could figure out there is no environment yet when Windows reads this key.
   I used ‘C:\Windows\system32\cmd.exe’ in the example below.
   This works with explorer.exe without path, so I think Windows will search the C:\Windows directory – but I’m not sure, because it will also launch explorer.exe if you leave the setting empty or specify a non-existing file.
8. Important
   Now go back to HKEY_USERS\Test, and unload that hive (menu File / Unload Hive, and confirm).
   If you skip this step and leave it loaded, the entire user profile including its registry hive will be re-created under a new name (C:\Users\Test.1 or similar) the next time you log on as that user, and your changes will be lost.
   Windows 10 and later Server systems seem to be more permissive here than older versions, but I would take no risk.
9. Now just log off, and log on as Test.

This is how the result looks in the Server 2019 VM under VMWare where I just ran through this procedure to make sure I skipped no steps:

Some things to keep in mind when you create your shell program:

• Your custom shell will start in C:\Windows\system32\ as working directory, even if your exe is located somewhere else.
  If you created a plain user account (non-admin), it will not have write access there, so best 'cd' to somewhere else early, if you expect your app to write log files or so in its working directory.
• When your application exits (or crashes), it will not log you out – you’ll be left with an empty black screen.
  In cmd.exe, for example, log off by issuing the ‘logoff’ command (C:\Windows\system32’\logoff.exe).
• Some functionality you may expect to be available in a custom app you wrote in C# or so, will not work because it is provided by explorer.exe.
  It may not work and just give an error, or it may launch explorer.exe.
• If you launch explorer.exe (for example by typing ‘explorer’ at the command prompt in the example), the first instance will not show up as the explorer window you would expect. The normal Windows desktop, task bar etc. will appear instead.
• Don’t think users will never discover ways to still get to the classic desktop, even if you block ctrl+alt+del or delete the task manager executable.
  One trick users of my kiosk app discovered > 20 years ago, way back under Windows NT4: remove all paper from the printer, and start a print job from within my app. The "out of paper" error message that was issued by the (HP) printer driver contained a Help button. In the help file that opened, one of the pages contained a link to open the Printers control panel. Control panel is just another instance of explorer.exe. A bit later, shop attendants were browsing the web on the kiosk.

Answer 3

As a complement to @nurchi answer:

I tried many times, it looks like you can only using some program as Windows 10 shell, for example: cmd.

But when I was trying to using some other program like task manager (taskmgr.exe in system32), it just didn't work. Taskmgr won't launch after logon.

Here is a way to solve the issue: using cmd to launching other programs.

For example: You can put C:\windows\system32\cmd.exe /c notepad in the Shell key.

If you want to launch the explorer AFTER notepad exited, you can put C:\windows\system32\cmd.exe /c notepad & explorer in the Shell key.

Answer 4

In my Windows 10 Embedded Enterprise box, I have the main user with admin privileges (password protected) and the "Operator" user with regular user privileges and no password.

This step is optional, needed only if you want to auto login:

Start-Run (or Win-R) and launch netplwiz, uncheck the Users must enter a username and password... box and hit Apply: a new window pops up asking for a default username and password. In my case, I use Operator and blank password. Press OK and in the other window also press OK to accept the changes and close the window.

The following works even if a user has to login with password, so the above is really optional, only if an old-school Kiosk mode is needed (for a non UWP application).

Microsoft Docs has an answer to your question, in short:

1. Under the admin user, open registry editor: regedit
2. Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\boot\ and change the value of Shell string from the default SYS:Microsoft\Windows NT\CurrentVersion\Winlogon to USR:Software\Microsoft\Windows NT\CurrentVersion\Winlogon
3. (Optional) Go to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and change Shell string from default explorer.exe to something else. This is generally a backup in case the user-based shell is not found. This setting applies to all users, so I prefer to leave it on explorer.exe.
4. Optionally login as the default user if you created one as per the above. Go to HKEY_Current_User\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Create/change the value of Shell string to point to an executable or batch file that you'd like to run as a custom shell for a given user.

In this setup, when the computer starts, the Operator user logs in automagically and my custom application is launched. When needed, I connect a network cable to the computer and connect to is using VNC (optionally, I could just plug in a keyboard), hit Ctrl-Alt-Del and either lock or sign out the Operator user. Then I login as the admin user and the "normal" Windows Explorer is launched. I do whatever changes are necessary and either reboot the machine or logout and login as Operator again.

Keep in mind that messing with the wrong registry setting can cause the system to fail to boot. While I made an attempt at accurately representing the steps, refer to the actual documentation, read it completely at least once before attempting any changes so you have an overall picture of what needs to be done... Hope this helps.