explorer.exe C:\Windows\explorer.exe

Executable of File Explorer and the Windows shell (desktop, taskbar, Start menu); never replace or delete it.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

explorer.exe is the process that displays File Explorer and the Windows interface: desktop, taskbar, Start menu and notification area. Winlogon starts it as the shell at sign-in. A 32-bit version also exists in C:\Windows\SysWOW64.

What it contains

A Microsoft-signed executable, updated with Windows and protected by the system.
It is the default shell, defined by the Shell value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. A kiosk can replace it with another application.
Several instances can exist if the option to open folder windows in a separate process is enabled.

Risks and best practices

Without explorer.exe there is no desktop or taskbar at sign-in, so do not delete or replace it.
Ending the process restarts the shell automatically and fixes many interface freezes without rebooting.
An explorer.exe outside C:\Windows or unsigned is suspicious: check the signature and path.
The Winlogon Shell value is a classic persistence target: check it.

Useful commands

# Running process and path
Get-Process explorer | Select-Object Id, Path, StartTime

# File signature and version
Get-AuthenticodeSignature "$env:windir\explorer.exe" | Select-Object Status, SignerCertificate
(Get-Item "$env:windir\explorer.exe").VersionInfo.FileVersion

# Shell defined in the Registry
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon').Shell

# Restart the shell of the current session (it restarts automatically)
Stop-Process -Name explorer -WhatIf

Report a mistake