CreateExplorerShellUnelevatedTask появилось в автозагрузке — что это?
Планировщик задач — место, где система и софт хранят служебные задачи, которые могут выполняться при загрузке Windows. Самые частые задачи — по поводу обновления ПО, например Хром, Яндекс браузер — там создают задания. Иногда задания создают и вирусы.
CreateExplorerShellUnelevatedTask — что за задача в планировщике?
Сразу коротко ответ:
Системное задание, которое запрещает запуск explorer.exe (Проводник) с повышенными правами.
explorer.exe — оболочка Windows, программа Проводник. Все файлы, папки, меню Пуск, трей, панель задач — работает при помощи Проводника.
На сайте Microsoft сказано что данная задача — программа Проводник, не вирус. В принципе логично, потому что в свойствах задачи указан путь:
- Explorer.EXE — оболочка Windows.
- /NOUACCHECK — ключ запуска оболочки.
CreateExplorerShellUnelevatedTask может быть в автозагрузке при обычном режиме. Это нужно, чтобы explorer.exe не запускался с повышенными правами (небезопасно). Однако если использовать безопасный режим — задание работать не будет и Explorer запуститься с повышенными правами.
Поэтому можно сделать вывод — отключать не стоит. Хотя на форуме Microsoft пишут что можно:
Важно: у некоторых пользователей данное задание тормозит загрузку системы.
CreateExplorerShellUnelevatedTask — можно ли отключить?
Мое мнение — если ПК работает нормально, отключать не нужно.
Однако при желании — можно:
- Зажмите Win + R, появится окошко Выполнить.
- Вставьте команду taskschd.msc, нажмите ОК.
- Откроется Планировщик заданий.
- Выберите раздел Библиотека планировщика задач.
- Справа будут задания — найдите CreateExplorerShellUnelevatedTask, нажмите правой кнопкой > выберите Отключить.
Если на ПК установлен хороший антивирус — то отключить можно. Что значит хороший? Например Avast, однако лично я советую Kaspersky, тем более что есть бесплатная версия.
Заключение
- CreateExplorerShellUnelevatedTask — задание, которое не дает запускаться explorer.exe с повышенными правами.
- Многие пользователи отключили и не заметили никаких проблем. Однако позаботьтесь о наличии качественного антивируса.
What is “CreateExplorerShellUnelevatedTask” in Task Scheduler in Windows?
If you noticed a strange task with the name “CreateExplorerShellUnelevatedTask” in Task Scheduler in Windows 10 , Windows 11 or Windows Server operating system, this article will help you in understanding what is this unusual task present in Task Scheduler and is it safe to delete or disable this task?
Table of Contents
- CreateExplorerShellUnelevatedTask Present in Windows Task Scheduler
- What is CreateExplorerShellUnelevatedTask in Task Scheduler in Windows?
- CreateExplorerShellUnelevatedTask Causing High CPU Usage in Windows Server
- How to Disable CreateExplorerShellUnelevatedTask in Task Scheduler in Windows?
CreateExplorerShellUnelevatedTask Present in Windows Task Scheduler
Recently an AskVG reader contacted me regarding this issue. He found this suspicious task automatically created in Task Scheduler in his Windows 11 device.
Task Scheduler is a system tool which comes built-in with all Windows versions. You can use Task Scheduler to schedule important tasks or set reminders. Windows also use Task Scheduler to perform system related tasks on regular intervals.
You can also check whether the CreateExplorerShellUnelevatedTask option is present in your Windows device with the help of following steps:
1. Press WIN+R keys together to launch RUN dialog box, type taskschd.msc and press Enter. It’ll open Task Scheduler.
2. Now in right-side pane, you’ll see list of all tasks system created as well as user created.
Now you can check whether the CreateExplorerShellUnelevatedTask is present in your computer system.
Following screenshot shows the CreateExplorerShellUnelevatedTask present in one of our Windows 11 machines:
Name: CreateExplorerShellUnelevatedTask
Author: ExplorerShellUnelevated
Status: Enabled
Action: Start a program – C:\WINDOWS\explorer.exe /NoUACCheck
What is CreateExplorerShellUnelevatedTask in Task Scheduler in Windows?
Now you might be wondering what is this weird CreateExplorerShellUnelevatedTask doing in your Windows device?
Here is the answer:
Some people think that “CreateExplorerShellUnelevatedTask” task was created by 3rd party software such as CCleaner , etc or by some malware but that’s not true.
CreateExplorerShellUnelevatedTask is a system task created by Windows to prevent users and apps from running Windows Explorer process elevated. If the user or a program tries to run the Explorer elevated, the task is run to launch the Explorer unelevated.
Here is a comment from “frank_song” at official Microsoft TechNet forum about CreateExplorerShellUnelevatedTask presence:
The CreateExplorerShellUnelevatedTask task prevents Explorer from running elevated. Any attempt to start Explorer with elevation switch seems to get intercepted by Windows and a CreateExplorerShellUnelevatedTask task is created and run instead. Because the task is configured to run with the lowest privileges, Explorer never gets run with elevation. When Explorer is executed with the ‘/nouaccheck’ switch the CreateExplorerShellUnelevatedTask task is ignored and Explorer is launched conventionally, it’s elevated status inherited from the process that started it. I suggest you disable it for a test.
So CreateExplorerShellUnelevatedTask is not suspicious. In fact, it’s a legit task created by Windows and you don’t need to worry about it.
CreateExplorerShellUnelevatedTask Causing High CPU Usage in Windows Server
At TechNet forum, the topic starter faced problems with this system task. He was facing high CPU usage problem due to this task in his Windows Server 2016 device.
If you are also facing issues related to this task in your Windows computer, you can safely disable this task with the help of steps given below.
How to Disable CreateExplorerShellUnelevatedTask in Task Scheduler in Windows?
1. Press WIN+R keys together to launch RUN dialog box, type taskschd.msc and press Enter. It’ll open Task Scheduler.
2. Now look for “CreateExplorerShellUnelevatedTask” in right-side pane.
3. Right-click on the task and select Disable option.
That’s it. It’ll immediately disable the task.
In future, if you decide to re-enable the task, right-click on the task and select Enable option.
PS: Advanced users can also use following direct command to disable the task using command-line tools such as Command Prompt or PowerShell:
SchTasks /Change /Disable /TN CreateExplorerShellUnelevatedTask
About the author: Vishal Gupta (also known as VG) has been awarded with Microsoft MVP (Most Valuable Professional) award. He holds Masters degree in Computer Applications (MCA). He has written several tech articles for popular newspapers and magazines and has also appeared in tech shows on various TV channels.
You are here: Home » Windows 10 » What is “CreateExplorerShellUnelevatedTask” in Task Scheduler in Windows?
Comments
NOTE: Older comments have been removed to reduce database overhead.
CreateExplorerShellUnelevatedTask explorer.exe
Thank you! Please check your email and confirm your subscription!
- Copyright © 2003- 2016 Glarysoft Ltd. All rights reserved.
- Home | EULA | Privacy Policy | Refund Policy | Terms of Use
Glarysoft uses cookies to improve content and ensure you get the best experience on our website. By continuing to use this website, you agree to our privacy policy.
What is the CreateExplorerShellUnelevatedTask scheduled task?
Explorer needs to run non-elevated because it needs to be available to other applications which aren’t necessarily elevated. To ensure that it can do that, Explorer detects that it is running elevated and de-elevates itself by using a scheduled task called CreateExplorerShellUnelevatedTask which does what it says on the tin: It launches Explorer un-elevated. The elevated version of Explorer exits after asking the scheduled task to run. So the elevated Explorer exits, and is replaced by an un-elevated Explorer. A customer wanted to know why, when they looked at several of the servers they had deployed, some of them have the CreateExplorerShellUnelevatedTask and some don’t. Does this mean that the systems which don’t have the special task have been corrupted or compromised? No need to worry. The CreateExplorerShellUnelevatedTask is created on demand when Explorer is first launched elevated. If your system doesn’t have this task, then pat yourself on the back. It means that your system hasn’t ever needed it.
Raymond Chen
Follow
Read next
AppLocale grows up.
Raymond Chen
May 31, 2022
Variations on a paste theme.
Raymond Chen
September 6, 2022
14 comments
skSdnW —> skSdnW May 24, 2022 10:24 am
collapse this comment copy link to this comment
UAC has a defined set of privileges to remove and groups to deny in a token. If CreateRestrictedToken LUA_TOKEN is not correct, why not add another flag and let people easily de-elevate child processes?
Harry Johnston —> Harry Johnston May 24, 2022 4:27 pm
collapse this comment copy link to this comment
Hmmm. I suspect that in order for everything to work the way it is meant to, it isn’t sufficient to just build a token that looks like the user’s non-elevated token; you need to actually use the specific non-elevated token that was generated during logon. If you have the elevated token you can query the associated non-elevated token using GetTokenInformation and the TokenLinkedToken class, but you may need SeTcbPrivilege for this to work properly, i.e., you need to be running as local system. (I know you need SeTcbPrivilege if you want to get a usable elevated token from a non-elevated token; I’m not sure about the other way around.) In most cases I think you would be better off redesigning to avoid the need to de-elevate.
Me Gusta —> Me Gusta May 24, 2022 7:16 pm
collapse this comment copy link to this comment
I think it is a different issue.
I remember before developer mode allowed it on a dev PC, you had to add the ability to create symbolic links to the account using the user rights assignment security setting if your account wasn’t an administrator.
This ended up with a really interesting situation where an administrator could create symbolic links. If you allowed it to, a limited user account which wasn’t UAC restricted could create symbolic links, but a UAC restricted user account couldn’t, even if you added the account to allow it to create symbolic links.
CreateRestrictedToken just removed or set a fixed list of privileges and groups as deny only. The other thing to remember is that a token that you restrict yourself is just as good as one that is automatically restricted. CreateProcessAsUser allows you to use a restricted version of your own user token to create a new process, and it does this purely by comparing the user’s SID.
Harry Johnston —> Harry Johnston May 25, 2022 10:25 pm
collapse this comment copy link to this comment
I don’t think that’s true. For one thing, a token you’ve created yourself won’t be associated with the right set of network drive mappings.
Ian Boyd —> Ian Boyd May 26, 2022 6:12 am
collapse this comment copy link to this comment
– [How can I launch an unelevated process from my elevated process, redux](https://devblogs.microsoft.com/oldnewthing/20190425-00/?p=102443)
switchdesktopwithfade@hotmail.com —> switchdesktopwithfade@hotmail.com May 24, 2022 12:17 pm
collapse this comment copy link to this comment
I’m more interested in the general-purpose “\Microsoft\Windows\Task Manager\Interactive” which is what Task Manager uses to run non-elevated command lines from its Run prompt. It rejects all my attempts to manually invoke it from my app, so I need to clone it so that my launcher has a way of running non-elevated processes without the unreliable method of searching for a running explorer.exe process. I’m guessing that the RunTask COM component it invokes is just a thin wrapper that lets it accurately forward an arbitrary command line without clashing with the task parameters. I don’t know what else I could be missing, judging from CreateExplorerShellUnelevatedTask.
Harry Johnston —> Harry Johnston May 24, 2022 4:30 pm
collapse this comment copy link to this comment
Suggestion: instead of your launcher being a single process which runs elevated, have two processes, one of which runs non-elevated and the other elevated. That way you can launch your non-elevated processes nicely, without depending on undocumented features.
switchdesktopwithfade@hotmail.com —> switchdesktopwithfade@hotmail.com May 25, 2022 5:19 pm
collapse this comment copy link to this comment
Now tell me how to launch each of those processes.
Harry Johnston —> Harry Johnston May 25, 2022 10:21 pm
collapse this comment copy link to this comment
Typically the non-elevated process would be launched from the Start Menu, and that process would then launch the elevated process, with the user’s consent, of course. In some scenarios you might prefer the non-elevated process to start automatically when the user logs in, and there’s plenty of ways of doing that – adding an entry to the Run key, for example. Usually the part that people get stuck on is how to get the elevated process to start by itself, but it sounds like you’ve already got that part working, so I’m not sure why starting a non-elevated process as well would be a problem. That said, you were probably right in the first place – it would be architecturally simpler to have a single process and use task scheduler to launch the subprocesses for you. I don’t believe this is particularly difficult? Edit In Powershell it can be as simple as this:
$action = New-ScheduledTaskAction -Execute 'notepad.exe' Register-ScheduledTask -TaskName 'Launch Notepad' -Action $action -User $env:username Start-ScheduledTask -TaskName 'Launch Notepad'
Harry Johnston —> Harry Johnston May 24, 2022 4:31 pm
collapse this comment copy link to this comment
I’m curious as to how Explorer would wind up running elevated in the first place. The user kills it and then relaunches it from an elevated command window?
Joshua Hudson —> Joshua Hudson May 24, 2022 5:01 pm
collapse this comment copy link to this comment
There used to be a way to get an explorer window to launch in its own process and I would frequently launch elevated explorer windows. I don’t actually do that anymore; all the reasons have gone away. I also ran this Windows 10 machine for the longest time with cmd.exe as the shell and would launch explorer only when necessary (ridiculous memory hog but we’ve had that discussion already). You can easily imagine what happens when you launch explorer elevated by accident from the wrong cmd.exe window.
Michael Spam —> Michael Spam May 25, 2022 12:57 am
collapse this comment copy link to this comment
I used to run an explorer “replacement” in elevated mode to do such work. There is a very popular, free, portable explorer clone than can come in handy sometimes. (not sure if I’m allowed to mention non-microsoft products directly here, but a quick Bing search will find it!).
Neil Rashbrook —> Neil Rashbrook May 25, 2022 3:27 am
collapse this comment copy link to this comment
The last time I wanted to do that (sadly I forget why) I went for the old fallback of opening Notepad in elevated mode and then performing the desired task from its file open dialog.
Marek Knápek —> Marek Knápek May 25, 2022 2:59 pm
collapse this comment copy link to this comment
The Explorer process can host ton of 3rd patry plugins, called shell extensions. Think of right-click context menu items or file properties dialog tabs. Those extensions can cause Explorer to misbehave, such as stuck unresponsive, spin the CPU or eat tons of RAM. The dissatisfied user then kills Explorer from (elevated) Task Manager and re-launches it from there. Explorer then inherits the elevation. From there, all other programs are elevated – this is bad.