Section 1: Explorer as Shell

The Big Picture: The Face of Windows

When you sign in, you see a wallpaper, icons, a taskbar at the bottom and a Start button. It feels like "Windows itself". But none of that is the kernel (the core of the operating system, Chapter 7 and Chapter 8). It is just a program, running in user mode like Notepad or Chrome.

That program is called explorer.exe. Think of Windows as a theatre. The kernel is the machinery backstage. Explorer is the stage set the audience sees. If the set falls over, the machinery keeps working.

┌──────────────────────────────────────────────────┐
│  What you see:  desktop + taskbar + Start menu   │
│                 (drawn by explorer.exe)          │
├──────────────────────────────────────────────────┤
│  Your programs: Chrome, Word, Notepad ...        │
├──────────────────────────────────────────────────┤
│  Windows subsystems and services (Chapter 8)     │
├──────────────────────────────────────────────────┤
│  Kernel, drivers, hardware                       │
└──────────────────────────────────────────────────┘

1.1 explorer.exe: Desktop, Taskbar and File Browsing

What it is: explorer.exe has two jobs that share one name.

A shell is the program that lets you launch and manage other programs. (Do not confuse it with a command shell such as PowerShell. Both are "shells", but this one is graphical.) Windows calls the graphical one the Windows shell, or just "the shell".

Where does it come from? Remember the sign-in story from Chapter 24 — Windows Authentication:

You type your password / PIN
        │
        ▼
winlogon.exe       checks the sign-in with the security system (LSASS)
        │
        ▼
userinit.exe       sets up your session (runs your logon scripts)
        │
        ▼
explorer.exe       starts as your shell. The desktop appears.
                   (Your startup programs are launched around now.)

winlogon.exe is the program that manages sign-in. It reads a setting (a registry value named Shell, see Chapter 17 — Windows Registry) which normally says explorer.exe. In theory a different program could be the shell. In normal Windows it is always Explorer.

Explorer runs as you, with your permissions (Chapter 25). It is not a system program. That is why it can only touch what you can touch.

Is it one process or many? Usually one explorer.exe process runs the shell for your whole session. Depending on your settings, File Explorer folder windows may run in the same process or in extra ones. Either way, the first one is the shell.

Can you restart it? Yes. This is one of the most useful facts in Windows:

Why can it be restarted without signing out? Because your other programs do not depend on it. They are separate processes (Chapter 9). Restarting the shell is like turning the stage lights off and on. The actors on stage keep standing there.

Save your work first. Restarting Explorer does not close your other programs. But copy/move operations in progress or open File Explorer windows will be interrupted.

Tip: If the taskbar freezes, icons stop responding or Start does nothing, restarting Explorer fixes the problem in many cases.

1.2 Shell Extensions

What it is: A shell extension is a small piece of code (a DLL, see Chapter 22) that plugs into Explorer and adds features. Explorer loads these extensions into its own process.

You use shell extensions all the time without knowing:

Extensions are registered in the Windows registry. That is how Explorer knows which DLLs to load when you right-click a file.

Right-click a .zip file
        │
        ▼
Explorer asks the registry: "Who handles the context menu for .zip?"
        │
        ▼
Registry lists several handlers (DLL files)
        │
        ▼
Explorer loads each DLL and asks: "What menu items do you want to add?"
        │
        ▼
The menu appears with all items together

Why this matters (a common reason for slow right-clicks): Because the extensions run inside Explorer, a badly written one can slow down or even crash the shell. A right-click menu that takes seconds to appear, or an Explorer that crashes when you open a particular folder, is often caused by a third-party extension. Chapter 22 explained why: a DLL loaded into a process runs with that process's rights and can crash it.

Windows 11 note: The new, shorter right-click menu in Windows 11 shows only some items. A "Show more options" entry (or Shift + F10) opens the classic menu with all the extensions. This is a design choice. The extensions are still there.

Safe habit: Do not install shell "tweaker" tools from unknown sources. They add extensions to the most-used program in Windows.

Summary