The Windows Process Journey — explorer.exe (Windows Explorer)

“explorer.exe” is an executable which is the “Windows Explorer”. The executable is located at “%windir%\explorer.exe (On 64 bit systems there is also a 32 bit version located in %windir%\SysWOW64\explorer.exe). It is responsible for handling elements of the graphical user interface in Windows (including the taskbar, start menu, and desktop), the “File Explorer” and more. Thus, we can think about it as a graphical shell (https://www.pcmag.com/encyclopedia/term/explorerexe).

In case we terminate “explorer.exe” the taskbar will disappear and also the desktop both the shortcuts and the wallpaper itself (https://copyprogramming.com/howto/what-happens-if-i-end-the-explorer-exe-process). For more understanding about “exeplorer.exe” I think it is a good idea to go over the reference implementation in ReactOS (https://github.com/reactos/reactos/tree/81db5e1da884f76e6cee66b8cb1c7a2f6ff791eb/base/shell/explorer).

Every time a user logins interactively “explorer.exe” is executed under the user which logged on to the system (https://learn.microsoft.com/en-us/windows-server/security/windows-authentication/windows-logon-scenarios). The process which starts “explorer.exe” is “userinit.exe” (I will post on it in the near future) — as can be seen in the screenshot below.

I also suggest going over the following link https://ss64.com/nt/explorer.html to checkout all the arguments that can be passed to “exeplorer.exe” while launching it. There are also several examples of usage there. By the way, it seems that Microsoft wants to decouple features from “explorer.exe” in order to make Windows 11 faster (https://www.windowslatest.com/2022/12/22/microsoft-wants-to-make-windows-11-faster-by-decoupling-features-from-explorer-exe/).

See you next time ;-) You can also follow me on twitter — @boutnaru (https://twitter.com/boutnaru).