ntoskrnl.exe C:\Windows\System32\ntoskrnl.exe

Windows kernel (NT OS Kernel): memory manager, scheduler, I/O and security. Protected system file, essential to boot.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

ntoskrnl.exe is the executable of the Windows kernel and executive. It manages memory, processes and threads, I/O and security, and exposes the services drivers rely on. The system loader (winload) loads it at boot, and it then starts the first user-mode process, smss.exe.

What it contains

A single kernel-mode executable, signed by Microsoft, in C:\Windows\System32.
A version specific to each Windows build; it must match the loaded drivers and HAL.
It shows up in error logs and dump files when the kernel is involved (bug checks).

Risks and best practices

Without it the system no longer boots, so do not replace, delete or modify it. Windows Resource Protection guards it, and TrustedInstaller owns it.
A missing or corrupt file is handled with sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth, or with startup repair from WinRE.
An invalid signature or an unexpected path for something posing as the kernel is a compromise indicator.

Useful commands

# Show the file version
(Get-Item "$env:windir\System32\ntoskrnl.exe").VersionInfo | Select-Object FileName, FileVersion, ProductName

# Check the file's digital signature
Get-AuthenticodeSignature "$env:windir\System32\ntoskrnl.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

# Verify the protected file's integrity (run as administrator)
sfc /verifyfile="$env:windir\System32\ntoskrnl.exe"

# Current boot entry (winload loader and system folder)
bcdedit /enum {current}

Report a mistake