bcdedit.exe

by Microsoft

System Utilityhigh risk

Summary

Windows Boot Configuration Data Editor - modifies the Windows boot configuration store. Controls boot options, recovery settings, and boot manager behavior.

bcdedit.exe is the 652nd most commonly executed Windows program in EchoTrail's dataset, observed 6,426 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by LTSVC.exe.

652nd

most commonly executed Windows program

6,426

observed executions

low

statistical confidence

Behavior

Top Paths

C:\Windows\System32100%

Top Hashes (SHA256)

069ce47afc6f23154cb8430602e41d9860f5934936aeb99252319ba93fd1427c53.48%
2229c395b0c07bdecdbe89c3faaf57dcf10243386732bc32f6faa8662ad482d513.46%
85a43c95bc60213353be0960cc2947b8f458b6470c683fe18f35e0469c47d2d19.46%
6a8db4d2ee7a9479a1de80a9c2df43f4265575a3b2e33cea87744ffcf3ece6355.88%
29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf339475.73%
374eaee5e641064b906290fce1d69e7e640a10c9704431d8548147a1d949d4283.44%
c8872ac2aa1e0e6f3e810788061ef2730e963d90341080b94e6879879bb77a862.09%
4c4e8087e7a9f3dc4c5d73889aed62a7865c9c9c321dac225476aa5f9a94fe9d1.99%
47771425756930ba813675e8ef1b2c45971e7ac45de10f3c25fd3ffbb28495ec1.25%
217c99ea6c370a1c9244d7a203d1b0e620d7c3babda76bd10b937325a99106a40.48%

Process Ancestry

Top Grandparents

Top Parents

Top Children

conhost.exe99.98%
netsh.exe0.02%

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does bcdedit.exe normally do?

Used by administrators to configure boot options, dual-boot setups, and recovery environments. Also invoked by Windows Update during feature updates.

When is bcdedit.exe suspicious?

Disabling Windows Recovery Environment. Modifying boot policies to ignore failures. Setting safeboot options. Any execution outside of IT maintenance or OS updates.

How do attackers abuse bcdedit.exe?

Ransomware commonly runs "bcdedit /set {default} recoveryenabled No" and "bcdedit /set {default} bootstatuspolicy ignoreallfailures" to prevent victims from using recovery options after encryption. Critical indicator of destructive activity.

Detection guidance

Alert on any bcdedit execution that modifies recoveryenabled or bootstatuspolicy. Monitor command-line arguments. These commands in combination with vssadmin delete shadows are high-confidence ransomware indicators.

False positive notes

Windows Update and OS upgrades may invoke bcdedit. Dual-boot configuration by IT is legitimate.

MITRE ATT&CK techniques

T1490 T1542.003

Related Processes

cmd.exe vssadmin.exewbadmin.exe

Ask Rocky about bcdedit.exe

Rocky answers questions about bcdedit.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.