Skip to content

pwsh.exe

Application ProcessMicrosoft Corporation

Also called pwsh, powershell 7, powershell core

WindowsApplication

PowerShell 7. It is the cross-platform pwsh host, often under Program Files\PowerShell\7. It is not Windows PowerShell 5.1 (powershell.exe).

What you need to know

pwsh is PowerShell 7, not Windows PowerShell 5.1.

pwsh.exe is PowerShell 7, installed from Microsoft as a side-by-side host. powershell.exe is still Windows PowerShell 5.1 in System32\WindowsPowerShell. Windows Terminal and OpenConsole only draw the window. Ending pwsh does not remove 5.1.

Safe?
The host is. The script may not be
Same as powershell.exe?
No. That is Windows PowerShell 5.1
Can I end it?
That PowerShell 7 session stops
Feex says
If I see pwsh, I read the command line as PowerShell 7. I do not treat powershell.exe as the same host, and I do not blame conhost for a 7-only module.

What is pwsh.exe?

pwsh is PowerShell 7, not Windows PowerShell 5.1. The 5.1 host stays powershell.exe. This file is the newer runtime you install. It is not Windows Terminal.

What does it do?

It runs PowerShell 7 scripts and modules. Some 5.1 snap-ins will not load here. It does not draw the tab UI (WindowsTerminal.exe) and it is not cmd.exe.

Why is it running?

You opened PowerShell 7, a VS Code terminal set to pwsh, or a task called this host. A PC with only 5.1 will not show a Program Files\PowerShell\7 copy.

Is it safe?

Host is legitimate. Script is the question

A Microsoft-signed pwsh under Program Files\PowerShell is PowerShell 7. A pwsh.exe in Temp is not. Safety is still the parent and the -Command line. This is still not powershell.exe.

A legitimate copy normally runs from:

C:\Program Files\PowerShell\7\pwsh.exe

  • PowerShell 7 side-by-side install
  • Windows PowerShell 5.1 is System32\WindowsPowerShell\v1.0\powershell.exe
  • Window may be Windows Terminal or OpenConsole

Can I end it?

Stops that 7 session

Ending pwsh.exe kills PowerShell 7. powershell.exe 5.1 can stay. Ending WindowsTerminal.exe only closes the tab UI, not every 7 host started by a task.

Can I remove it?

Uninstall PowerShell 7, keep 5.1

Uninstall PowerShell from Apps if you want pwsh gone. Do not delete System32\powershell.exe. Do not delete System32.

Should it start with Windows?

A scheduled task or profile can start pwsh. That is not the 5.1 host and not a Windows default named powershell.exe.

Normal resource behavior

These are contextual labels, not universal averages.

CPU
Follows the 7 script
Memory
Can grow on large object pipelines
Disk
Follows the script
Network
Follows the script

File information

pwsh.exe file information
Executable name pwsh.exe
Common legitimate path C:\Program Files\PowerShell\7\pwsh.exe
Publisher Microsoft Corporation
Signature expectation Signed by Microsoft Windows

Common problems

A 5.1-only snap-in fails and they repair powershell.exe

This host is 7. Install the 7 module or run Windows PowerShell 5.1. Different exe, different gallery story.

Hidden pwsh from a random task

Read -File / -Command. The 7 host is still Microsoft. The payload is the line. That is not "Terminal is malware."

Troubleshooting

Diagnose before you change anything destructive.

pwsh -v versus $PSVersionTable in powershell.exe

7 prints from this file. 5.1 prints from Windows PowerShell. Do not mix the upgrade docs.

Inspect parent PID the same way you would for 5.1

explorer plus a shortcut is you. Office launching pwsh is a macro story. Do not delete the 7 install folder as the first move.

Technical details

Technical details
pwsh.exe technical details
Image name pwsh.exe
Sibling powershell.exe (Windows PowerShell 5.1)

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Was this article useful?