PROCESSMicrosoft-signed
conhost.exeConsole Window Host
conhost.exe (Console Window Host) provides the window, text rendering, selection and modern console features for command-line programs such as Command Prompt. One instance runs per console window, so several are normal. It is legitimate, lightweight, and runs from System32 signed by Microsoft.
What conhost.exe does
Before Windows 7, console windows were drawn by the critical csrss.exe process, which was both a reliability and a security concern. Console Window Host split that responsibility out: conhost.exe now provides the window, text rendering, text selection, resizing and the modern console features (like copy and paste and colour) for command-line programs, while csrss coordinates. Each Command Prompt, and each console program that opens its own window, gets a conhost.exe.
Why several instances appear
One conhost.exe runs per console window. In addition, background components, installers and scheduled tasks that run console-based helpers each spawn a short-lived conhost. So a handful at once is normal, and they come and go as console programs start and stop.
When to look closer
conhost.exe is lightweight and mostly idle. A conhost using significant CPU usually reflects the console program it is hosting (a busy script) rather than conhost itself; find the parent process. A conhost that lingers with no visible window and consumes resources, or one running from outside System32, is worth verifying.
Confirming it is genuine
- Path:
C:\Windows\System32\conhost.exe. - Signature: Microsoft.
- Parent: a console program or task; Task Manager's Details tab and tools like Process Explorer show the parent.
The name is occasionally borrowed by malware placed in other folders; the path and signature are the test.
Frequently asked questions
Why are there several conhost.exe processes?
One runs for each console window and for some background tasks that use a console, including scheduled tasks and installers. When you close the last console window that uses one, it exits. Several at once is normal if several command-line programs or tasks are running.
Why does conhost.exe appear when I did not open a command prompt?
Background programs, updaters and scheduled tasks sometimes run console-based helpers, each of which needs a conhost. It appears briefly and exits. A conhost that persists with high CPU and no visible console is worth checking for path and signature.