Quick answer: sihost.exe is Shell Infrastructure Host, a genuine Windows process that helps run parts of the desktop such as the taskbar, the Start menu and file thumbnails. It’s safe when it’s in C:\Windows\System32 and signed by Microsoft. If it’s using a lot of CPU, ending it in Task Manager is a workaround Microsoft support staff suggest, and installing the latest Windows updates helps because Microsoft has fixed at least one high-CPU bug in it. For the “Unknown Hard Error” message, repair system files with DISM and SFC, from Safe Mode or Windows Recovery if the desktop won’t load.
In this guide
What sihost.exe does
Shell Infrastructure Host runs once for each signed-in user and supports the graphical shell. Microsoft support staff describe it as a core Windows component responsible for graphical elements like the taskbar, the Start menu and file thumbnails and previews, and Microsoft’s own troubleshooting documentation tells administrators to restart “SiHost” so the Start menu and related components pick up changes. Other guides also link it to notifications and slideshow wallpapers; that’s widely reported but not something Microsoft documents.
It isn’t the same process as ShellExperienceHost.exe, which draws the Start menu, Action Center and other modern shell windows. The two work together, so problems with one often show up alongside the other.
You can’t uninstall or disable sihost.exe, and you shouldn’t delete it: Windows needs it for the desktop to work. Ending it, on the other hand, is harmless in practice. The screen may flicker while it restarts, and Microsoft support staff suggest exactly that as a workaround when it misbehaves.
How to check it’s the real file
- Press Ctrl + Shift + Esc to open Task Manager and go to the Details page.
- Right-click sihost.exe and choose Open file location. The genuine file is in
C:\Windows\System32. - Right-click the file, select Properties and open the Digital Signatures tab. The signer should be Microsoft Windows.
A copy anywhere else, such as in your user’s AppData or Temp folder, or a similar name like sihost64.exe, is a red flag. Run a full scan with Microsoft Defender in Windows Security > Virus & threat protection, and an offline scan if needed. A file in System32 with a valid Microsoft signature is genuine, even if your antivirus has warned about it; that’s usually a false positive.
sihost.exe using high CPU or memory
A short spike when you open windows or change the wallpaper is normal. If it stays high:
- End it once. In Task Manager’s Details page, right-click sihost.exe and choose End task. Save your work first. Windows restarts it, and the CPU use often returns to normal. If it doesn’t restart, sign out and back in.
- Install all updates. In August 2022 Microsoft fixed “an issue that, in certain cases, causes sihost.exe to use a high amount of the CPU” in Windows 11, so make sure Settings > Windows Update shows you’re up to date.
- Close the Photos app. Many users report sihost.exe climbing while the Windows 11 Photos app browses large folders, especially on external drives or network shares, and staying high until they sign out. Try another photo viewer for big libraries, and update Photos from the Microsoft Store.
- Switch off a slideshow wallpaper as a test. Set Settings > Personalization > Background to Picture or Solid color and watch whether the usage drops.
- Repair system files. Run the DISM and SFC commands in the next section.
If several system processes are busy at once, the cause may be lower down; see System interrupts high CPU.
“sihost.exe – System Warning: Unknown Hard Error”
This message usually appears at sign-in, sometimes followed by a black screen or a missing taskbar. A Microsoft support specialist says it usually points to a corrupt system file or a hard disk error. Users often see it after a feature update, a driver update or a reset.
If you can reach the desktop, open Command Prompt as administrator and run these one after the other, then restart:
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowIf SFC can’t finish, see Windows Resource Protection could not perform the requested operation. To check the drive too, run chkdsk C: /f and accept the scan at the next restart.
If the desktop won’t load, interrupt the start-up three times in a row (hold the power button as Windows starts) to open the recovery environment. Choose Troubleshoot > Advanced options > Startup Repair. If that doesn’t help, go back to Startup Settings, restart, and press 5 for Safe Mode with Networking, then run the commands above from there.
If the error started after an update or a new app, uninstall that app or driver, or use Uninstall Updates under Advanced options in the recovery environment. A clean boot shows whether a third-party program is involved. If nothing else works, Microsoft’s support staff point to System Restore or resetting the PC while keeping your files.
“The file is open in Shell Infrastructure Host”
If you can’t delete, rename or move a file because it’s open in Shell Infrastructure Host, Microsoft support staff explain that sihost.exe is temporarily holding it while Windows creates a thumbnail or preview. Wait a few seconds and try again. If it keeps happening, close the preview pane in File Explorer (Alt + P), switch the folder to a view without large icons, or end sihost.exe once as described above.
Related guides
- ShellExperienceHost.exe: what it is and how to fix high CPU, memory or crashes
- System interrupts high CPU in Windows 11 and 10: what it is and how to fix it
- Windows Resource Protection Could Not Perform the Requested Operation: 7 Fixes
- How to open Command Prompt as administrator in Windows 11 and 10
Official sources:
Leave a Reply