cscript.exe

Windows ProcessMicrosoft Corporation

Also called cscript, windows script host console, wsh console

WindowsSystem Component

Windows Script Host console host. It runs .vbs and .js and writes to a Command Prompt window. wscript.exe is the GUI host.

What you need to know

cscript is console WSH, not wscript.

cscript.exe is the console Windows Script Host. Scheduled tasks and admin scripts prefer it so output lands in a console. wscript.exe is the windowed host.

Safe?: Yes, in System32, if you meant the script
Same as wscript?: No. wscript is the GUI host
Same as cmd?: No. cmd.exe is the shell around it

Feex says

If a black window is printing script text and the image is cscript, I read that script path. I do not end wscript for a console job, and I do not blame powershell unless the command line says so.

What is cscript.exe?

cscript.exe is console Windows Script Host, not wscript.exe. Both host .vbs and .js. Only this one is built for stdout and scheduled tasks.

What does it do?

It runs the script and prints to the console. It does not draw MsgBox the way wscript does unless the script forces UI.

Why is it running?

A task, a logon script, or an admin command called cscript //nologo. A forever-running copy needs the script path, not a guess that it is cmd.exe.

Is it safe?

Check the script path

System32 cscript.exe is Microsoft. The .vbs it launched is the risk. A cscript.exe in AppData is not WSH.

A legitimate copy normally runs from:

C:\Windows\System32\cscript.exe

Console WSH host
GUI sibling: wscript.exe
Not powershell.exe

Can I end it?

Stops that script

Ending cscript.exe kills the console script. The cmd.exe window that launched it may stay. wscript.exe is a different host.

Can I remove it?

Do not delete cscript.exe. Block scripts with AppLocker or WDAC if you need that control. wscript.exe is the GUI host, not this console host.

Should it start with Windows?

A scheduled task or a script starts it. It is not a chat Startup row.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Follows the script
Memory: Small unless the script leaks
Disk: Script output
Network: Only if the script uses the network

File information

cscript.exe file information
Executable name	cscript.exe
Common legitimate path	C:\Windows\System32\cscript.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Console flash at logon

A leftover cscript task can flash a window. Read Task Scheduler. That is not wscript and not PowerShell unless the action says so.

People end cmd.exe and the script keeps going

The host is cscript.exe. cmd.exe may only have started it.

Troubleshooting

Diagnose before you change anything destructive.

Match the command line to a task

Look for cscript.exe and a .vbs path. wscript.exe is the wrong row for a console job.

Do not replace cscript from a forum zip

Servicing owns System32.

Technical details

cscript.exe technical details
Image name	cscript.exe
Role	Windows Script Host console

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: cscript · Console Windows Script Host
Microsoft Learn: wscript · GUI sibling
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.