What is “CreateExplorerShellUnelevatedTask” in Task Scheduler in Windows?
If you noticed a strange task with the name “CreateExplorerShellUnelevatedTask” in Task Scheduler in Windows 10, Windows 11 or Windows Server operating system, this article will help you in understanding what is this unusual task present in Task Scheduler and is it safe to delete or disable this task?
Table of Contents
CreateExplorerShellUnelevatedTask Present in Windows Task Scheduler
Recently an AskVG reader contacted me regarding this issue. He found this suspicious task automatically created in Task Scheduler in his Windows 11 device.
Task Scheduler is a system tool which comes built-in with all Windows versions. You can use Task Scheduler to schedule important tasks or set reminders. Windows also use Task Scheduler to perform system related tasks on regular intervals.
Advertisement
You can also check whether the CreateExplorerShellUnelevatedTask option is present in your Windows device with the help of following steps:
1. Press WIN+R keys together to launch RUN dialog box, type taskschd.msc and press Enter. It’ll open Task Scheduler.
2. Now in right-side pane, you’ll see list of all tasks system created as well as user created.
Now you can check whether the CreateExplorerShellUnelevatedTask is present in your computer system.
Following screenshot shows the CreateExplorerShellUnelevatedTask present in one of our Windows 11 machines:
Name: CreateExplorerShellUnelevatedTask
Advertisement
Author: ExplorerShellUnelevated
Status: Enabled
Action: Start a program – C:\WINDOWS\explorer.exe /NoUACCheck
What is CreateExplorerShellUnelevatedTask in Task Scheduler in Windows?
Now you might be wondering what is this weird CreateExplorerShellUnelevatedTask doing in your Windows device?
Here is the answer:
Some people think that “CreateExplorerShellUnelevatedTask” task was created by 3rd party software such as CCleaner, etc or by some malware but that’s not true.
CreateExplorerShellUnelevatedTask is a system task created by Windows to prevent users and apps from running Windows Explorer process elevated. If the user or a program tries to run the Explorer elevated, the task is run to launch the Explorer unelevated.
Here is a comment from “frank_song” at official Microsoft TechNet forum about CreateExplorerShellUnelevatedTask presence:
The CreateExplorerShellUnelevatedTask task prevents Explorer from running elevated. Any attempt to start Explorer with elevation switch seems to get intercepted by Windows and a CreateExplorerShellUnelevatedTask task is created and run instead. Because the task is configured to run with the lowest privileges, Explorer never gets run with elevation. When Explorer is executed with the ‘/nouaccheck’ switch the CreateExplorerShellUnelevatedTask task is ignored and Explorer is launched conventionally, it’s elevated status inherited from the process that started it. I suggest you disable it for a test.
So CreateExplorerShellUnelevatedTask is not suspicious. In fact, it’s a legit task created by Windows and you don’t need to worry about it.
CreateExplorerShellUnelevatedTask Causing High CPU Usage in Windows Server
At TechNet forum, the topic starter faced problems with this system task. He was facing high CPU usage problem due to this task in his Windows Server 2016 device.
If you are also facing issues related to this task in your Windows computer, you can safely disable this task with the help of steps given below.
How to Disable CreateExplorerShellUnelevatedTask in Task Scheduler in Windows?
1. Press WIN+R keys together to launch RUN dialog box, type taskschd.msc and press Enter. It’ll open Task Scheduler.
2. Now look for “CreateExplorerShellUnelevatedTask” in right-side pane.
3. Right-click on the task and select Disable option.
That’s it. It’ll immediately disable the task.
In future, if you decide to re-enable the task, right-click on the task and select Enable option.
PS: Advanced users can also use following direct command to disable the task using command-line tools such as Command Prompt or PowerShell:
SchTasks /Change /Disable /TN CreateExplorerShellUnelevatedTask
Also Check:
[Fix] Can’t Create Tasks to Display Messages in Task Scheduler in Windows 8 and Later
How to Import (Restore) All Tasks in Bulk Using Task Scheduler in Windows?
How to Import / Export (Backup / Restore) Tasks Using Task Scheduler in Windows?
Excellent! Thanks…
This task, which is relatively newly added via update, is almost certainly an attempt to reduce overuse/misuse of elevated shells by users as a way to protect against their own poor security practices.
I see no way that an elevated shell could be launched without user input (even if that was to unknowingly install some software that relaunched the shell elevated).
there is obvious value in this, especially in the context of “mass behavior”.
when Microsoft can reduce the likelihood of threats/exploits finding purchase in even 1% of their installed userbase, the “background signal” of threats broadcast back to the whole of the internet reduces tremendously
the obvious example would be bots in a botnet, where anecdotes have explicit interpretations (eg a reduction in the total number of Windows bots at any given moment capable of being hired out or used for DoS)