SearchHost.exe in Windows 11: What It Is, and Is It a Virus?

What SearchHost.exe actually is

SearchHost.exe is the user interface for Windows 11 search. When you press the Start button and start typing, or click the search box on the taskbar, this is the process that draws the panel, runs the query and shows you the results.

You do not have to take our word for that. Microsoft names it explicitly in its Fix problems in Windows Search article, in the instructions for restarting search:

“Follow these steps to end the SearchUI.exe (Windows 10) or SearchHost.exe (Windows 11) process. Stopping this process stops Windows Search. The next time that you search, Windows Search automatically starts.”

So SearchHost.exe on Windows 11 is the direct successor to SearchUI.exe on Windows 10. The genuine copy lives here:

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe

Microsoft documents that folder in the same article, as the install location of the Windows 11 search package, and gives a command that re-registers the package from the Appxmanifest.xml inside it. That detail matters more than it looks, and it explains almost everything else on this page: because the package is registered from a manifest, SearchHost.exe is a packaged app — the app model Microsoft used to call UWP — and not a classic Windows program or a service.

One thing we could not establish: what CBS stands for in that package name. It is not Component-Based Servicing, which is a different part of Windows entirely (the one that writes CBS.log). Rather than guess, we are leaving it unexplained.

Why it shows as “Suspended” — and why that is correct

This is the single most common reason people go looking for SearchHost.exe, and the answer is reassuring: suspended is the state it is supposed to be in most of the time.

Because it is a packaged app, it follows the app lifecycle Microsoft documents for that model:

“By default, apps that are not in the foreground are suspended. This results in power savings and more resources available for the app currently in the foreground.”

And from the same app lifecycle documentation, on what suspension actually does: the app’s threads are stopped and the app is left in memory unless the operating system needs to reclaim resources, so that switching back to it restores it quickly. Suspended does not mean crashed, stuck, or idling wastefully. It means parked.

Why it is suspended even though you never opened search

Windows does not wait for you. Microsoft documents that where a device has resources to spare, the operating system will prelaunch frequently used apps that have opted into the behaviour, starting them in the background and then quickly suspending them so they resume faster when you do reach for them.

That is the documented mechanism behind a suspended SearchHost.exe appearing moments after you sign in. We should be precise about the limits of that, though: Microsoft documents prelaunch in general, but does not publish a list naming SearchHost.exe as one of the apps it applies to. The mechanism is documented; the specific attribution is our inference.

On Microsoft’s Q&A forum, a community answerer put the practical version plainly — the process runs whenever you open the search box, and should remain suspended once the search window is closed. That is a community observation rather than documentation, but it matches both the lifecycle docs and what you can watch happen in Task Manager.

Is it a virus? The standard test gives a false positive here

Malware does sometimes name itself after a real Windows process, so the question is fair. The useful check is location: the genuine file runs from the SystemApps folder shown above. Something calling itself SearchHost.exe and running from your Downloads folder, a temp directory or a user profile folder is worth investigating.

Now the part most articles get wrong, and get wrong in a way that frightens people unnecessarily.

The evidence here is genuinely mixed, and we would rather show you that than pretend otherwise: a third-party file-metadata database reports the opposite result for its sample, listing the signature as verified and issued to Microsoft Windows. The likely reconciliation is catalog signing — Windows can sign a file through a separate catalog file holding cryptographic hashes, instead of embedding a signature blob in the executable. A catalog-signed file shows no Digital Signatures tab yet is entirely genuine. We could not find a Microsoft page stating that SearchHost.exe specifically is signed that way, so treat that as the probable explanation rather than a confirmed one.

What to check instead

PowerShell reads catalog signatures as well as embedded ones, so it gives a straight answer where the Properties dialog does not:

Get-AuthenticodeSignature "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"

Sysinternals Sigcheck, which Microsoft publishes, is the other good option, and prints a Catalog: line when the signature is external:

sigcheck.exe -v "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"

If you are still unsure after that, run a full scan with Windows Security rather than trying to judge the file by eye. Two things that are not useful signals: the file’s size, which is build-dependent and will generate false alarms if you compare it against a number from a process database, and the number of copies on disk.

Several copies is normal

People find three copies, or seven, and reasonably assume something is wrong. It is not. Alongside the live copy, Windows keeps additional copies under C:\Windows\WinSxS, the side-by-side store that holds multiple versions of system files so updates can be rolled back and damaged components repaired. A Microsoft support specialist confirmed that finding extra copies there is unremarkable. Those folder names carry build numbers, so they differ on every machine — there is no “correct” list to compare yours against.

When SearchHost.exe is missing from Task Manager

The honest answer is that Microsoft does not document what absence means, so anyone stating confidently that it proves an infection is guessing. Two explanations are realistic:

1. Search simply is not running. By far the most likely, and not a fault — the process starts when you search. Press Start, type something, and look again.
2. The package has been removed. Debloat scripts and “privacy” tools sometimes strip the Windows 11 client package, and the process cannot run if the package is gone.

If search itself is broken as well as the process being absent, skip the file hunt and go to the repair ladder below. Re-registering the package is the fix; looking for a deleted executable is not.

High CPU, high memory, or search running hot

The first thing to establish is which process is actually busy, because the one people blame is usually not the one doing the work. SearchHost.exe draws the interface. The heavy lifting — walking your disk and building the index — belongs to SearchIndexer.exe, and that is normally what you see consuming CPU and disk after a large file copy, a fresh install, or an index rebuild. In that situation the correct response is usually to leave it alone until it finishes.

If SearchHost.exe itself is persistently busy rather than suspended, work through the repair ladder in order — and if the machine is sluggish generally rather than only during search, our guide to speeding up Windows 11 is the better starting point. If the indexer is the busy one, our guide to fixing Windows 11 search when it stops working covers narrowing the indexed locations, which is the setting that actually reduces the workload.

Restarting and repairing search, in the order to try it

1. End the process

Microsoft documents this as a supported repair step, and it is completely safe — Windows starts search again automatically the next time you use it. Microsoft’s steps: press Ctrl+Alt+Delete and open Task Manager, go to Details, right-click SearchHost.exe, choose End task, and confirm with End process.

2. Run the built-in troubleshooter

Windows ships a Search and Indexing troubleshooter, and running it costs nothing. Microsoft lists it ahead of the heavier repairs for good reason. If File Explorer is misbehaving alongside search, the shell as a whole may be the problem — see resetting File Explorer.

3. Repair the system files behind it

Run these from a terminal opened as administrator, in this order. DISM repairs the component store that sfc draws its known-good copies from, so running sfc first against a damaged store achieves less:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

4. Re-register the search package

This is Microsoft’s documented command for Windows 11, run from an elevated PowerShell window. Note the capitalisation of Appxmanifest.xml — it is Microsoft’s own:

Add-AppxPackage -Path "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Appxmanifest.xml" -DisableDevelopmentMode -Register

We are also deliberately not printing the piped one-liner that circulates for this job. As usually written it is not valid — -Register needs a -Path pointing at a manifest — and we could not verify a working form of it in Microsoft’s documentation. Use the explicit -Path command above.

SearchHost, SearchIndexer, SearchProtocolHost, SearchApp

Four similarly named processes doing genuinely different jobs. Knowing which is which saves you troubleshooting the wrong one.

Process	What it does
SearchHost.exe	The Windows 11 search interface — the panel you type into. Microsoft names it as the successor to Windows 10’s SearchUI.exe. Normally suspended.
SearchIndexer.exe	The indexing engine, running under the Windows Search service. This is what reads your files and builds the index, and what legitimately uses CPU and disk while it catches up.
SearchProtocolHost.exe	A helper the indexer starts to reach particular content types and locations. Appears and disappears while indexing is under way.
SearchApp.exe	The name used by the search interface on earlier Windows 11 builds and in some update states. If you see this instead of SearchHost.exe, you are looking at the same job under an older name.

If your problem is that search returns nothing rather than that a process looks odd, the indexer is where to start — see how to fix Windows 11 search when it stops working.