dwm.exe (Desktop Window Manager): genuine Windows process, or a copy using its name?

What the Desktop Window Manager does

Since Windows Vista, windows no longer draw straight to the screen. Each window draws to an off-screen surface in video memory, and the Desktop Window Manager (DWM) renders these surfaces into one desktop image and presents it. That is how Windows shows glass window frames, window animations, live previews and high-resolution scaling. In Windows Vista and 7 this was the Aero theme; Windows 10 and 11 still use DWM for composition.

Microsoft Learn describes DWM as a Windows service, listed in Services as Desktop Window Manager Session Manager. The file is dwm.exe in the System32 folder and ships with every Windows 10 and Windows 11 release.

It holds a surface for every open window, so its memory use grows with the number of windows, their size and the number of displays. This is the reason many people mistake it for a virus: the legitimate file is one of the larger entries in the process list. Normal Windows files are installed with the operating system, and a dwm.exe that arrived any other way did not come from Windows.

About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.

How to check a dwm.exe

Three checks need nothing installed.

1. Where the file is. In Task Manager, Details tab, right-click dwm.exe and choose Open file location. The genuine file is in C:\Windows\System32. A copy in a user folder, AppData, Temp, ProgramData or the Downloads folder is not Windows.
2. Who signed it. Right-click the file, choose Properties, then Digital Signatures: the signer must be Microsoft Windows and the signature valid. From PowerShell the status and path of every running copy are printed with:

   Get-Process dwm | Select-Object Id, SessionId, Path | ForEach-Object { $_; Get-AuthenticodeSignature $_.Path | Select-Object Status, @{n='Signer';e={$_.SignerCertificate.Subject}} }

3. How many copies there are. One dwm.exe per desktop session is normal, so a PC with one signed-in user has one. Several copies with different paths mean at least one is not Windows. The command lists them with their folders:

   Get-CimInstance Win32_Process -Filter "Name='dwm.exe'" | Select-Object ProcessId, SessionId, ExecutablePath

4. Compare the file with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds.

These checks show whether the file is the Windows one. They cannot show that code was injected into the running genuine process, which is a documented technique; for that run Microsoft Defender's full scan and, if the signs below apply, the offline scan.

Warning signs and what they mean

Documented abuse of dwm.exe

What public reports record about dwm.exe. Each row links to the source. MITRE ATT&CK does not list dwm.exe as a masquerade target in its own entries; these are vendor and incident reports.

Two patterns: a flaw in the genuine component, fixed by installing Windows updates, and code injected into the genuine process, where the file passes every check. A copy named dwm.exe in another folder gives itself away by its path.

Everyday problems that are not malware

dwm.exe versions by Windows release

The newest build indexed for each release, and the update that delivered it. 69 Microsoft builds in total are known.

Questions people ask