The process conhost.exe started showing up on Windows 7, and searching Google doesn't reveal an explanation of what this process is and why it shows up.

What is the conhost.exe process?


conhost.exe is the new host process for console windows. Previously those were handled by csrss.exe which is the “Client Server Runtime Process”, a process running with system-level privileges.

Starting with Windows Vista, Microsoft made some very substantial improvements and changes in regard to security. One of those changes was that applications running in different “levels” or as different users weren't allowed to exchange data freely.

Since console windows were handled by csrss.exe this had the side-effect that you could no longer drag files onto a console window and have the full path and file name inserted. Drag & drop is such a case of data exchange which was ruled out. People cried out even though most Windows users probably didn't even know of that feature.

I doubt, though, that the missing drag & drop functionality was the reason behind pulling console windows out of csrss. The more pragmatic reason would be that there is absolutely no reason to have such functionality sitting that close to the core of the OS. Granted, it's not as much functionality as there could be if Windows would implement terminal emulators as usual on UNIX-like OSes (and much less than there would be if UNIX-likes fully adhered to ECMA-48). But nevertheless, anything going wrong with a single console window could tear a core part of the operating system down.

Making changes to how console windows work gets much harder due to that since you have to consider pretty dire consequences if anything goes wrong. Another change you'll see, except drag & drop working again, is that characters are no longer confined to their cell. Especially with ClearType enabled some glyphs would go beyond their cell boundaries and leave trails and other artifacts behind. This is almost (but not quite) fixed by now.

  • 1
    And all of a sudden, my rage against some weird console behavior fly away, thanks for this response. – SuperBloup Dec 31 '09 at 11:49
  • They were previously hosted by csrss because of the fullscreen functionality. – kinokijuf Dec 25 '11 at 8:52
  • They were previously hosted by csrss because of the fullscreen functionality. @kinokijuf, which is a sorely missed feature in Vista+. – Synetech Jul 25 '13 at 19:50
  • 1
    People cried out even though most Windows users probably didn't even know of that feature. - Thank you! I laughed so hard at that! – Vinayak Mar 18 '16 at 22:24
  • @Synetech: It's back, sort of, in Windows 10. Alt+Enter switches a console window into a fullscreen mode. – Joey Mar 18 '16 at 23:11

I just wrote up an article attempting to explain the purpose of the process. It's geared towards regular people, but there's lots of screenshots to illustrate.

What is conhost.exe and Why Is It Running?

The bottom line is that conhost.exe sits between the CSRSS process and cmd.exe, so you can use drag & drop again.

alt text


Conhost.exe is a new binary on Win7. It hosts the command prompt window that cmd.exe runs in.

Source here


It is the console window host on Windows 7. A couple programs (Spybot comes to mind) will detect it as a false positive, but it is made by Microsoft and it's not malicious.


I used "what is conhost.exe?" with Google, including the quotes, and received one answer: http://www.fileinspect.com/fileinfo/conhost-exe/

It says: The conhost.exe is a Console Window Host. This file is part of Microsoft® Windows® Operating System. Conhost.exe is developed by Microsoft Corporation. It’s a system and hidden file. Conhost.exe is usually located in the %SYSTEM% folder and its usual size is 270,848 bytes. The conhost.exe process is safe and disabling it can be dangerous, because programs on your computer need it to work correctly.

It's still a new application so it's logical that it's not very well-known at Google. It helps when you make your queries more specific...

Not the answer you're looking for? Browse other questions tagged or ask your own question.