Determine which Explorer.exe on Task List is really the shell?

Question

HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell" returns the shell name, usually Explorer.exe. However, it does not contain the path, or identify a particular executable file.

Enumerating the Task List locates the task Explorer.exe.

But what if the user had ran another, unrelated task called Explorer.exe?

What is the best way to determine that a particular instance of Explorer.exe is actually the shell?

I need to avoid confusion between task(s) which are the shell, and tasks which may not be the shell, but share the same name i.e. Explorer.exe

Answer 1

You could use Process Explorer to get more details of the process. You would be able to tell by the programs running under each explorer process, the location of the explorer process file, and a couple other things.

Answer 2

Maybe you could use the command line utility tasklist as follows:

tasklist /FI "imagename eq explorer.exe" /FI "session eq 1" /FI "sessionname eq Console"

Answer 3

Don't look for Explorer.exe, look for the full path of the shell, which should be C:\Windows\Explorer.exe.

Answer 4

I don't think there is a foolproof method; the best you could do is emulate what CreateProcess does:

If the file name does not contain a directory path, the system searches for the executable file in the following sequence:

1. The directory from which the application loaded.
2. The current directory for the parent process.
3. The 32-bit Windows system directory. Use the GetSystemDirectory function to get the path of this directory.
4. The 16-bit Windows system directory. There is no function that obtains the path of this directory, but it is searched. The name of this directory is System.
5. The Windows directory. Use the GetWindowsDirectory function to get the path of this directory.
6. The directories that are listed in the PATH environment variable.