userinit.exe

Windows ProcessMicrosoft Corporation

Also called userinit, userinit logon application

WindowsSystem Component

Userinit Logon Application. After you sign in, winlogon starts this file so it can launch the shell, usually explorer.exe.

What you need to know

This starts Explorer after logon, then should go away. A userinit that never exits needs a path check.

userinit.exe is the documented logon helper. winlogon launches it. It starts the Userinit value, normally explorer.exe, then exits. Persistence malware loves the same Run key name.

Safe?: Yes, in System32
Should it stay running?: It usually exits after the shell starts
Malware name?: The filename is also abused in Run keys

Feex says

I always open the folder on userinit. System32 plus a short life is logon. A userinit.exe that stays all day from AppData is a different story.

What is userinit.exe?

userinit.exe is Userinit Logon Application. It is the official next hop after winlogon authenticates you.

What does it do?

It restores network connections and starts the shell listed in the Userinit registry value. On a healthy PC that shell is explorer.exe and userinit then exits.

Why is it running?

You just signed in. A copy still running an hour later is either a custom shell replacement or a fake path.

Is it safe?

Check the path and how long it lives

System32 userinit that exits is Windows. A second userinit in a user folder, or a Userinit registry value that points at something else, is the classic persistence trick.

A legitimate copy normally runs from:

C:\Windows\System32\userinit.exe

Started by winlogon
Should launch explorer.exe and exit
Path first, then publisher

Can I end it?

Only a leftover fake

Do not end the System32 copy during logon. You can interrupt the desktop start. A long-lived copy from the wrong folder is a malware step after you confirm the path.

Can I remove it?

Only a fake copy

Do not delete System32\userinit.exe. Repair the Userinit registry value if the shell will not start. That is an advanced repair.

Should it start with Windows?

Logon starts it once. It should not be a Startup Apps row of its own.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: A brief spike at logon
Memory: Small, then gone
Disk: Low
Network: Mapped drives at logon

File information

userinit.exe file information
Executable name	userinit.exe
Common legitimate path	C:\Windows\System32\userinit.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Desktop never appears

If Userinit was rewritten to skip explorer.exe, you get a blank shell. That is a registry investigation, not a missing wallpaper.

Two userinit.exe rows

One in System32 during logon is normal. One from Temp that stays is not.

Troubleshooting

Diagnose before you change anything destructive.

Open file location immediately

System32 is the only expected answer for the real helper.

Do not "fix" Userinit from a random .reg

Those files are a favorite payload.

Technical details

userinit.exe technical details
Image name	userinit.exe
Role	Logon shell launcher

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Winlogon · userinit after authentication
Microsoft Learn: Run and RunOnce · Userinit related persistence
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.