How do I replace the system shell (explorer.exe) with another process in Windows 10?

Question

This is for Windows 10.

Is there a way to replace explorer.exe with, for example, a powershell script?

I'm looking to start a custom shell application without having to have explorer.exe run in the background or handle the startup of those items.

EDIT: Since I'm getting down voted... I was capable of doing something similar in Windows Embedded 7 Standard. I added a key called Shell to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

The key added there had Powershell.exe with command line options to execute script silently. There I was able to execute my custom shell.

This does not work with Windows 10.

Solution 1

This is stored in the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Replace this with whatever you want, but the software it loads in place will then need to provide a way to log out/shut down/restart the machine, or you'll need to use Task Manager to do so.

Solution 2

This is how I've been doing it for years, from Windows NT4 on to Windows 10 and Server 2019.

It is best to change Windows Explorer's settings to show file extensions, so you don’t select ‘ntuser.dat.log’ or ‘ntuser.ini’ or another wrong file below.

1. Create a new user, let’s say ‘Test’.
2. Log on as that user, so the first logon agent is executed, creating the profile directory and registry hive.
   Log off again, and log back into your normal account (or any account that is member of the Administrators group).
3. Make sure the user account you just logged out of is not logged in – neither at the console, nor remote desktop, nor any scheduled tasks that may be active under this account, during the remainder of this procedure.
4. Open regedit, and select HKEY_USERS.
5. Menu File / Load Hive.
   Navigate to C:\Users\{new user name} -- C:\Users\Test in my example
   Select the file ‘NTUSER.DAT’ and load it.
6. You will be prompted to enter a key name. Just invent one, the user’s registry hive will be loaded under that name as a new branch in HKEY_USERS. I used ‘Test’ here.
7. Go to HKEY_USERS\Test\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
   Create a new String value, named Shell.
   Set it to the application you want to start instead of the normal Windows shell.
   Specify the full path, make no assumptions about PATH environment variables etc., as far as I could figure out there is no environment yet when Windows reads this key.
   I used ‘C:\Windows\system32\cmd.exe’ in the example below.
   This works with explorer.exe without path, so I think Windows will search the C:\Windows directory – but I’m not sure, because it will also launch explorer.exe if you leave the setting empty or specify a non-existing file.
8. Important
   Now go back to HKEY_USERS\Test, and unload that hive (menu File / Unload Hive, and confirm).
   If you skip this step and leave it loaded, the entire user profile including its registry hive will be re-created under a new name (C:\Users\Test.1 or similar) the next time you log on as that user, and your changes will be lost.
   Windows 10 and later Server systems seem to be more permissive here than older versions, but I would take no risk.
9. Now just log off, and log on as Test.

This is how the result looks in the Server 2019 VM under VMWare where I just ran through this procedure to make sure I skipped no steps:

Some things to keep in mind when you create your shell program:

• Your custom shell will start in C:\Windows\system32\ as working directory, even if your exe is located somewhere else.
  If you created a plain user account (non-admin), it will not have write access there, so best 'cd' to somewhere else early, if you expect your app to write log files or so in its working directory.
• When your application exits (or crashes), it will not log you out – you’ll be left with an empty black screen.
  In cmd.exe, for example, log off by issuing the ‘logoff’ command (C:\Windows\system32’\logoff.exe).
• Some functionality you may expect to be available in a custom app you wrote in C# or so, will not work because it is provided by explorer.exe.
  It may not work and just give an error, or it may launch explorer.exe.
• If you launch explorer.exe (for example by typing ‘explorer’ at the command prompt in the example), the first instance will not show up as the explorer window you would expect. The normal Windows desktop, task bar etc. will appear instead.
• Don’t think users will never discover ways to still get to the classic desktop, even if you block ctrl+alt+del or delete the task manager executable.
  One trick users of my kiosk app discovered > 20 years ago, way back under Windows NT4: remove all paper from the printer, and start a print job from within my app. The "out of paper" error message that was issued by the (HP) printer driver contained a Help button. In the help file that opened, one of the pages contained a link to open the Printers control panel. Control panel is just another instance of explorer.exe. A bit later, shop attendants were browsing the web on the kiosk.

Comments

[digitai]

I tried this, however my tablet got bricked. Windows 10 Pro 1607. Need to custome shell a classic windows app, W10Pro admits just UWA. How dis you use your proposed answer?

[YumYumYum]

What is the task manager executable path in windows 10 pro?

[komodosp]

This doesn't show you how to set a shell for a specific user though, which is what the OP appears to ask (given his use of HKEY_CURRENT_USER)

[Luc VdV]

Never try this on your normal user account, create a new account to do it. As for "bricking", OF COURSE it will cause problems if you do this to the only account you can log on with, and make a mistake in the path or filename, or if you set it to an application that doesn't allow you to reverse the change. But even then it won't brick your machine, you can still Ctrl+Alt+Del into task manager, and start explorer.exe from there to get the good old UI back.

[Tom]

@LucVdV since the key is under HKLM, adding another account won't help, will it?

[Luc VdV]

Tom - You're right. I was referring to the OP's use of HKEY_CURRENT_USER, I hadn't even noticed that Jonno did it in HKLM - really bad idea.

[Jonno]

@LucVdV You can access task manager independently of explorer.exe however you approach this, and I would hope anyone looking to put a machine into a kiosk mode is in-tune enough to restore a registry key once they hit CTRL+ALT+DEL or CTRL+SHIFT+ESC. I've yet to find a method that works using only HKCU, but if there is one it would make a lot more sense, I agree.

[Luc VdV]

@Jonno - HKCU: you either have to apply the setting while logged in as that user, or load that user's hive under HK_USERS (select HKEY_USERS, menu File / Load Hive, navigate to ntuser.dat in the user's profile, specify a name to load it as, apply the setting, and not forget to unload the hive after you're done). I've done it on literally dozens of systems, from Windows NT4 on to Server 2016. However, there have been a few Windows 10 builds where it wouldn't work. It does seem to work again on the latest ones.

[Luc VdV]

BTW, Ctrl+Shift+Esc works only if explorer.exe is running, and I used to disable Ctrl_Alt_Del just to prevent kiosk users from doing this :)

[Jonno]

@LucVdV Could you provide a new answer on how to do this? HKCU based would be far preferable, but I just can't reproduce anything you've just said on my own machine (Win 10 21H1). If I don't remove explorer.exe from the HKLM key, it always starts explorer.exe, regardless of what I put in the same path under HKCU (is there a different key for this..?). Ctrl + Shift + Esc functions for me in all scenarios, with or without explorer.exe, as well as Ctrl + Alt + Del without the relevant removal of that hotkey.

[Luc VdV]

Done. And it turns out @Jonno was right, Ctrl+Shift+Esc also works when explorer isn't running. I assumed incorrectly that it would be the same as for Ctrl+Esc (which is the start menu key for keyboards that don't have a windows logo key, and requires explorer).