wscript.exe

Windows ProcessMicrosoft Corporation

Also called wscript, windows script host, wsh gui

WindowsSystem Component

Windows Script Host GUI host. It runs .vbs and .js with dialogs and no console window. cscript.exe is the console host. powershell.exe is PowerShell.

What you need to know

wscript is GUI WSH, not cscript and not powershell.

wscript.exe is Windows Script Host with a GUI. Double-clicked .vbs and .js files often start here. cscript.exe writes to a console. powershell.exe is a different language host.

Safe?: Yes, in System32, if you meant to run the script
Same as cscript?: No. cscript is the console host
Same as PowerShell?: No

Feex says

If a .vbs popped a box and the name is wscript, I read the script path. I do not end powershell.exe for that dialog, and I do not treat cscript as the same window.

What is wscript.exe?

wscript.exe is GUI Windows Script Host. It is not cscript.exe and it is not powershell.exe. The file is System32\wscript.exe.

What does it do?

It loads a script and can show MsgBox-style UI. cscript.exe prints to stdout instead. PowerShell does not use this host.

Why is it running?

You double-clicked a .vbs or .js, a logon script called wscript, or an installer still uses WSH. A wscript that stays with a weird script path needs a path check.

Is it safe?

Check the script path

System32 wscript.exe is Microsoft. The script it launched is the risk. A wscript.exe in Temp is not WSH.

A legitimate copy normally runs from:

C:\Windows\System32\wscript.exe

GUI WSH host
Console sibling: cscript.exe
Not powershell.exe

Can I end it?

Stops that script

Ending wscript.exe kills the running script and its dialogs. cscript.exe and powershell.exe can stay.

Can I remove it?

Do not delete wscript.exe. Change file associations or use AppLocker / WDAC if you need to block scripts. That is policy, not Explorer.

Should it start with Windows?

A script or a Run key can start it. It should not be a permanent tray app.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Follows the script
Memory: Small unless the script leaks
Disk: Whatever the script writes
Network: Only if the script talks to the network

File information

wscript.exe file information
Executable name	wscript.exe
Common legitimate path	C:\Windows\System32\wscript.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Email .vbs opens wscript

That is WSH running the attachment. End this process, then quarantine the script. It is not PowerShell by default.

People disable PowerShell to stop VBS

Wrong host. .vbs is wscript or cscript unless someone wrapped it.

Troubleshooting

Diagnose before you change anything destructive.

Read the command line for the .vbs or .js path

That file is the question. wscript.exe is only the host.

Do not replace wscript from a "WSH fix" zip

Servicing owns System32.

Technical details

wscript.exe technical details
Image name	wscript.exe
Role	Windows Script Host GUI

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: wscript · GUI Windows Script Host
Microsoft Learn: Windows Script Host · WSH hosts .vbs and .js
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.