dllhost.exe

Windows ProcessMicrosoft Corporation

Also called dllhost, com surrogate

WindowsSystem Component

COM Surrogate. Windows uses it to run certain COM objects, including some File Explorer previews, outside the main shell.

What you need to know

This is a COM host, often for Explorer previews.

dllhost.exe runs COM objects in their own process. File Explorer thumbnail and preview handlers are a common reason you see it.

Safe?: Usually yes in System32
Should I close it?: Usually no
Why so many?: Previews and COM hosts

Feex says

COM Surrogate looks scary because the name is vague. I would check the path first. A System32 copy doing thumbnails is ordinary.

What is dllhost.exe?

dllhost.exe is the COM Surrogate. Windows starts it so a COM object can run outside the caller, often outside Explorer.

What does it do?

It loads a DLL that implements a COM class. Preview handlers and thumbnail extractors are the everyday case.

Why is it running?

Explorer starts it when a folder needs a preview that should not crash the whole shell if the handler fails.

Why are there multiple copies?

Each surrogate can host a different COM class. Several copies while you browse media folders are common.

Is it safe?

Usually safe

The legitimate host is in System32. A dllhost.exe in a user temp folder is not the normal COM Surrogate.

A legitimate copy normally runs from:

C:\Windows\System32\dllhost.exe

Expected publisher: Microsoft Corporation
Expected path: System32

Can I end it?

Usually no

Ending a surrogate can kill a preview. It should not be a daily cleanup. If one copy is stuck, close the Explorer window first.

Can I remove it?

Do not delete dllhost.exe. Windows uses it for COM isolation.

Should it start with Windows?

It starts on demand. You should not add it as a startup program.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Can rise while building thumbnails
Memory: Depends on the handler
Disk: Can rise in a folder of large files
Network: Usually low

File information

dllhost.exe file information
Executable name	dllhost.exe
Common legitimate path	C:\Windows\System32\dllhost.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Crashes when opening a folder

A broken preview handler can take the surrogate down. That is why the handler is isolated. Try a different folder or a simpler view.

High CPU in Pictures or Videos

Thumbnail work is real work. Wait for the folder to settle before you end the host.

Troubleshooting

Diagnose before you change anything destructive.

Confirm the path and signature

Open the process properties and check that dllhost.exe runs from the expected folder and is signed by the expected publisher. This is the first check, not a Registry edit.

See what the process is doing

Task Manager can show CPU, memory, disk, and GPU. High use during an obvious job is often normal. High use when the PC is idle needs a closer look at the related app or service.

Avoid destructive first steps

Do not delete dllhost.exe, disable critical services without knowing the effect, or edit the Registry as the first move.

Technical details

dllhost.exe technical details
Image name	dllhost.exe
Friendly name	COM Surrogate

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: COM Surrogate · COM surrogate processes

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.