User OOBE Broker (UserOOBEBroker.exe): What It Is

User OOBE Broker is the Task Manager name for UserOOBEBroker.exe, a Windows component associated with the out-of-box experience (OOBE). If the running file is the verified Microsoft copy and it is not causing a problem, leave it alone. Seeing it after you have finished installing Windows does not, by itself, mean your PC is infected.

You can end a stuck User OOBE Broker task as a temporary troubleshooting step once setup is finished. It may start again. Do not interrupt an active setup or account-configuration screen, and do not delete the Windows executable to keep it out of Task Manager.

What does User OOBE Broker do?

OOBE means out-of-box experience: the Windows setup screens for choices such as region, keyboard, network, account and privacy settings [1]. The process belongs to this setup experience. Its presence at the desktop does not tell you which setup task, if any, needs attention.

The usual executable location is C:\Windows\System32\oobe\UserOOBEBroker.exe. If Windows is installed on another drive, the drive letter differs. Check the running process’s location, rather than searching for a file with the same name and assuming it is the one you saw.

Choose the next step by the symptom

• Verified Windows file; no repeated prompts, errors or sustained load. Leave it running. There is no benefit in deleting the file just to shorten the process list.
• Windows welcome messages or suggestions keep appearing. Adjust the welcome notification settings. This controls prompts, not every possible launch of the process.
• A stuck process or persistent CPU use after setup has finished. Verify the file, then follow the performance checks. End task is temporary.
• An unexpected firewall request names User OOBE Broker. Do not approve it by name alone. Check the file and requested access first.
• A copy runs from Downloads, Temp, AppData or an unexplained startup entry; or security software reports it. Follow the suspicious-copy checks. An unusual path is a reason to investigate, not a malware verdict.

How to check the actual UserOOBEBroker.exe file

1. Find the executable. Press Ctrl + Shift + Esc to open Task Manager. Find User OOBE Broker under Processes, or UserOOBEBroker.exe under Details. Right-click it and select Open file location. If it has already exited, check when it next appears; do not run an unknown copy just to make it visible.
2. Check its signature. Open the file’s Properties. If a Digital Signatures tab is present, select the Microsoft signature and open its details to check validation. The company name on the Details tab is descriptive text, not signature verification.
3. If that tab is missing or the result is unclear, check the Windows catalog signature too. Windows files can be signed through a catalog rather than an embedded signature. The PowerShell command below retrieves signature information, including catalog signing [4]. A missing Properties tab alone does not establish that the file is unsigned or malicious.

Open PowerShell and run this read-only check for the normal Windows path:

Get-AuthenticodeSignature -LiteralPath "$env:windir\System32\oobe\UserOOBEBroker.exe" |
  Format-List Status, StatusMessage, SignerCertificate, Path

If Task Manager showed another path, replace the quoted path with that exact file location. Otherwise, you would verify the normal Windows file while leaving the suspicious running copy unchecked.

• Valid status and a Microsoft Windows signer: supports the file’s signed identity. Combine it with the location and observed behavior; it is not a clean bill of health for the entire PC.
• NotSigned, an invalid result, or an unexpected signer: record the result and investigate. A validation failure is not a detection name; a damaged file or trust-validation problem also needs checking.
• File not found: recheck the exact running path. Do not download a replacement EXE from a file-download site.

For a deeper investigation, add the Command line column in Task Manager’s Details view. Microsoft Sysinternals Process Explorer can help inspect the parent process, while Sigcheck can inspect signatures. Record the path and launcher before changing anything. A parent name by itself is not an allowlist.

Can you end User OOBE Broker in Task Manager?

For a verified copy that appears stuck after setup is complete, End task is a reasonable temporary test. Save your work first. In Task Manager, open Details, select UserOOBEBroker.exe, and choose End task. Confirm only that process.

This stops the current instance; it neither uninstalls the component nor guarantees it will stay closed. If a setup or account screen is actively waiting for input, finish or dismiss that screen normally instead. Ending its supporting process can interrupt the flow. On a work or school device, ask the administrator about managed enrollment or setup prompts.

If it returns without errors or sustained resource use, its return alone does not call for another fix. Do not take ownership of, rename or delete the system file. Creating a replacement user account solely to make this entry disappear is also unnecessary.

How to stop repeated Windows welcome prompts

For unwanted welcome messages, change the notification preference rather than trying to remove User OOBE Broker:

1. On Windows 11, open Settings > System > Notifications, then expand Additional settings.
2. Clear the option for showing the Windows welcome experience after updates and sign-in. You can also turn off tips and suggestions if those are the messages bothering you [2].
3. On Windows 10, look under Settings > System > Notifications & actions for the corresponding welcome-experience checkbox. Labels vary by version.

These preferences suppress optional messages. They do not permanently disable the executable, bypass required setup, or override an organization’s policy. If the prompt returns, note its exact wording: an account-setup request or security alert is a different problem from a welcome suggestion.

What if UserOOBEBroker.exe uses high CPU or keeps failing?

First confirm that this process has sustained CPU use. A background entry with little activity is not the same as a performance fault.

1. Check the right row. Sort Task Manager by CPU and watch the process while the slowdown happens. Record its PID, path, the visible prompt or error, and whether the problem starts at sign-in or after an update.
2. Finish pending setup and restart. Save your work, complete the visible setup flow, check Windows Update and restart when requested. Recheck the same symptom afterward. If it is gone, stop troubleshooting.
3. Repair system files only if malfunction persists. For a verified Windows copy accompanied by errors or sustained load, open Command Prompt as administrator. Run DISM.exe /Online /Cleanup-image /Restorehealth; after it reports successful completion, run sfc /scannow and wait for verification to finish [3].
4. Use the result. If repairs were made, restart and check the original symptom. If repair fails or the issue continues, keep the error message and Windows build for Microsoft support or your administrator. A clean SFC result does not require the process to disappear.

DISM and SFC repair Windows components; they do not diagnose every background-process problem or remove a malicious look-alike. If the busy process is actually Windows Update’s MoUsoCoreWorker.exe, use its separate troubleshooting guide.

Should you allow User OOBE Broker through the firewall?

Do not click Allow just because the dialog displays a Windows-looking name. If the request is unexpected and you cannot identify a reason for it, cancel or decline it while you verify the executable. A firewall prompt is an access request, not an antivirus verdict.

1. Record the dialog’s program name, publisher, path and selected network profiles. Compare the path with the actual file and signature checks above.
2. Keep the firewall enabled. Do not open a port or enable access on Public networks merely to silence the prompt. Microsoft recommends allowing only apps you recognize and access you actually need [5].
3. If declining the request interrupts a setup feature you were deliberately using, check that exact feature’s requirements with Microsoft support or your administrator before creating a narrow exception. The name alone does not explain why your device requested access.

If you already allowed it, review the entry in Windows Security > Firewall & network protection > Allow an app through firewall. Confirm the exact app before removing an unnecessary exception; leave unrelated rules alone. On a managed device, let IT review the rule.

When a same-name copy needs a malware investigation

A file name can be copied. An unexplained instance under a user-writable folder, a failed signature check, a security-tool alert, or an unfamiliar launcher deserves investigation. None of those observations identifies a malware family on its own. Likewise, finding multiple copies on disk is not the same as finding multiple malicious processes.

If the file came from an unknown installer, crack, game mod or fake update, do not run it again. Save the exact path, detection name and scan report. Review suspicious startup entries, scheduled tasks and scripts for references to that specific copy. Do not disable unrelated Windows setup tasks or delete every file in the surrounding folder.

Run a full scan with Gridinsoft Anti-Malware if a suspicious copy ran, security alerts recur, or an unknown startup task relaunches it. Removing one EXE can leave a scheduled task, script or bundled module that recreates the activity. Review detections and quarantine confirmed threats; an empty scan result or a familiar filename does not prove that no compromise occurred.

Keep the legitimate Windows component. After cleanup, restart and check whether the same suspicious path, startup entry or alert returns. If an alert names the signed Windows copy, retain the report and seek a vendor review before restoring, excluding or manually deleting it. Do not label it a false positive from the signature alone.

If a suspicious game or mod already ran, follow the account-protection checklist; after confirmed credential theft, change passwords and revoke sessions from a clean device. For a different process name, use the dedicated checks for SecurityHealthSystray.exe, pythonw.exe or TextInputHost.exe.

FAQ

References

1. Microsoft Learn. “Customize the out-of-box experience (OOBE).” Updated March 13, 2026; accessed November 5, 2026. OOBE documentation.
2. Microsoft Support. “Notifications and Do Not Disturb in Windows.” Accessed November 5, 2026. Notification settings.
3. Microsoft Support. “Using System File Checker in Windows.” Accessed November 5, 2026. DISM and SFC procedure.
4. Microsoft Learn. “Get-AuthenticodeSignature.” PowerShell documentation; accessed November 5, 2026. Signature and catalog verification.
5. Microsoft Support. “Risks of Allowing Apps Through Windows Firewall.” Accessed November 5, 2026. Firewall exception guidance.