Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
rhs.exe is the Resource Host Monitor used by Windows Server Failover Clustering. It loads cluster resource DLLs outside the Cluster Service so a faulty resource can be isolated and the host process can be recycled. A crash, timeout, or termination usually points to a cluster resource that failed, deadlocked, or took too long to respond; the filename alone does not prove malware.
Microsoft’s documentation concerns Windows Server clusters, not every Windows PC. To troubleshoot safely, identify the affected resource and operation in cluster and Windows event logs, verify the Windows Server version, then apply only a fix that matches the documented condition. Treat an unexpected rhs.exe file on a non-clustered computer as an identity and security question first.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat does rhs.exe do?
In a Windows Server Failover Cluster, applications and infrastructure components are represented by cluster resources. Each resource type supplies a resource DLL that acts as a proxy between the Cluster Service and the underlying application, storage, network name, or other managed component.
Instead of loading those DLLs directly into the Cluster Service, Windows loads them into the Resource Host Monitor process, commonly shown as rhs.exe or RHS.exe. Microsoft Failover Clustering engineer John Marlin describes RHS as a recyclable process: if a resource DLL crashes, becomes corrupted, or cannot be trusted, the cluster can terminate or recycle its host without necessarily taking the entire Cluster Service down with it. The engineering explanation was updated March 15, 2019 and says it was first published in 2009.
Popular on Amazon
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
This isolation explains why an RHS event is often a symptom rather than the original fault. The useful question is not simply “Why did rhs.exe stop?” but “Which resource DLL was RHS hosting, what operation was in progress, and why did that resource fail to complete it?”
Is rhs.exe safe?
It can be legitimate on a Windows Server installation that has Failover Clustering configured, but the name alone cannot authenticate a file. A legitimate process should make sense in the server’s role, location, signature, publisher information, and operating-system version. A file with the same name on a home or gaming PC, or on a server with no clustering role, deserves additional scrutiny.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check whether the machine should have RHS at all
- Confirm whether Failover Clustering is installed and whether the computer belongs to a cluster.
- Record the file’s full path, file properties, version information, and digital-signature publisher.
- Compare the file identity with the installed Windows Server edition and its servicing history. A third-party catalog entry that reports a Microsoft signature for one version is not proof that every file named rhs.exe is genuine.
A plausible Windows installation path and a valid signature are useful evidence, not an automatic guarantee. If the path, signature, publisher, behavior, or detection history is unusual, scan the file with Windows Security or another trusted security product. Do not create a Defender exclusion merely because a process name looks familiar; Microsoft warns that exclusions reduce scanning protection.
What not to download
Do not replace the executable by downloading an identically named file from a DLL or executable download site. Do not use a registry cleaner as a general RHS repair. Those actions can introduce an untrusted binary or damage the cluster configuration without identifying the resource that actually failed.
Why does rhs.exe crash or stop?
RHS instability generally falls into a few different categories. Separating them matters because a storage-specific fix from an old Windows Server release is not an appropriate answer to a current resource-DLL deadlock.
| Possible cause | What the cluster may show | What to verify |
|---|---|---|
| Resource DLL crash or access violation | RHS terminates while starting, stopping, moving, or checking a resource. | Identify the resource DLL, the operation, and any Windows Error Reporting details or dump. |
| Timeout or deadlock | A resource does not answer a requested call within the expected time, after which RHS or the cluster reports a failure or recovers. | Look for the exact operation that stalled and whether the resource was busy, blocked, or waiting on another dependency. |
| Failover or resource movement | RHS stops while a role or resource is being moved between nodes. | Record the affected node, destination node, resource name, and timestamp, then correlate both nodes’ logs. |
| Legacy physical-disk identification issue | On Windows Server 2008 or 2008 R2, RHS can stop during physical-disk resource movement or failover. | Check whether logical unit number identification data was truncated above 512 bytes, the condition in Microsoft’s documented case. |
| Legacy third-party resource path issue | On Windows Server 2008 R2, a resource DLL path containing nested environment variables can be involved in RHS failure. | Inspect the configured third-party resource path and compare it with the exact Microsoft support scenario. |
| Broader operating-system or hardware fault | A stop error, firmware problem, memory fault, or malware event appears alongside the cluster message. | Perform the general stop-error checks, while continuing to diagnose the cluster resource separately. |
Microsoft’s engineering explanation also makes an important distinction: terminating RHS after a resource fails to respond in time can be normal recovery behavior. The termination is not, by itself, proof of infection or proof that the executable is damaged.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also popular on Amazon
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
How do I investigate an rhs.exe error?
Start with evidence from the incident, not with file replacement. The following sequence preserves the information needed to distinguish a crashing DLL from a timeout, a storage condition, or an unrelated system failure.
1. Capture the complete incident context
Before clearing logs or restarting repeatedly, write down:
- The full event text and event ID.
- The date and exact timestamp, including the time zone used by the server.
- The node that logged the event and any node to which a role was failing over.
- The resource or role named in the message.
- Whether the event occurred during resource start, stop, failover, storage access, a health check, or another operation.
- Any stop code, exception code, access-violation text, timeout wording, or reference to a dump.
Several related events may be separated by only a few seconds. Preserve the sequence; the first resource failure is often more informative than the later message that RHS was terminated.
2. Review cluster and Windows logs together
Use Failover Cluster Manager to inspect the cluster’s events and the affected role or resource. Then open Event Viewer and review Windows Logs > System and Windows Logs > Application for the same time window. Look for storage, service, resource-DLL, Windows Error Reporting, and failover messages that identify a component before the RHS event.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Export or save the relevant events before applying changes. If the cluster spans multiple nodes, collect the corresponding time window from every node; a dependency failure may be logged on one node while the RHS termination appears on another.
3. Identify the resource DLL and operation
The cluster and event details should tell you which resource was being managed. Determine whether it is a Microsoft resource type or a third-party provider, and note the operation that was in progress. A DLL crash, access violation, or deadlock can all appear as RHS instability, but the remedy depends on which resource and call are implicated.
Also popular on Amazon
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Check Windows Error Reporting information or an available dump for the module name and exception details. Do not infer the responsible DLL from the process name alone: RHS is a host for multiple resource DLLs, and the host executable may be healthy while the hosted component is not.
4. Match the finding to the Windows Server version
Write down the exact Windows Server release, edition, architecture, and current update state. Microsoft’s published RHS support cases reviewed for this topic are narrowly scoped to Windows Server 2008 and Windows Server 2008 R2. A workaround or hotfix for one of those releases should not be presented as a universal repair for newer Windows Server versions.
For a legacy server, compare the event wording and conditions with the complete Microsoft support article before changing storage identification data, resource paths, or cluster settings. If the version or scenario does not match, continue with resource-vendor guidance and current Microsoft support documentation instead of forcing the old fix.
How do I fix an rhs.exe crash caused by a cluster resource?
Once the evidence identifies the resource, choose the least disruptive corrective action that addresses that resource. Keep a record of every change and schedule disruptive work during an approved maintenance window.
Repair or update the failing resource provider
If a third-party resource DLL is named, obtain its current guidance from the vendor that supplied the cluster resource. Verify that the version supports the installed Windows Server release and cluster configuration. A provider update or configuration correction is more appropriate than replacing RHS, because RHS is the host and the provider is the component that failed.
Address a timeout or deadlock
Use the operation and dependency information in the logs to determine what the resource was waiting for. Check the resource’s storage, network, service, and authentication dependencies, and confirm that the dependency was available on the node at the time of the timeout. If the same operation repeatedly exceeds its allowed response time, involve the resource owner or vendor; repeatedly restarting RHS only masks the trigger and can cause additional failovers.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also popular on Amazon
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Handle a resource movement or failover failure
Compare the source and destination nodes. If the failure follows a role to one particular node, inspect that node’s storage paths, firmware, drivers, and local event log. If it follows the resource regardless of node, focus on the resource DLL, its configuration, and its external dependencies.
Apply a documented legacy storage fix only when it matches
Microsoft documents a Windows Server 2008 and 2008 R2 physical-disk case in which RHS stopped during resource movement or failover. The cited cause was truncation of logical unit number identification data larger than 512 bytes, which led to an access violation. This is a version- and scenario-specific support case. Confirm all conditions in the Microsoft article and obtain the applicable supported update or procedure through official channels; do not apply it to a different Windows Server release or a different storage symptom.
Check the documented Windows Server 2008 R2 resource-path case
Another Microsoft case concerns a third-party resource DLL path containing nested environment variables on Windows Server 2008 R2. If your logs identify that pattern, compare the configured path with the documented case and follow the supported correction for that release. A path that merely looks unusual is not enough evidence to change it on a production cluster.
What general Windows checks should I perform?
General stop-error guidance is useful when RHS events appear with broader operating-system failures, but it complements rather than replaces cluster-resource diagnosis.
- Install applicable Windows updates. Use the server’s normal, approved servicing process and confirm that the update supports the exact Windows Server release.
- Update BIOS and firmware. Check the server manufacturer’s supported versions, especially when storage controllers, networking, or platform firmware appear in the event sequence.
- Run relevant hardware tests. Test memory and the hardware associated with the failing resource. A hardware fault can produce secondary cluster errors.
- Review malware findings. Run a trusted security scan if the file identity or behavior is suspicious. Keep protection enabled while investigating.
- Recheck the cluster after each controlled change. Record whether the same resource, operation, and node fail again. Changing several variables at once makes the result difficult to interpret.
How can I verify that the file itself is not malicious?
File verification should be a separate workstream from cluster recovery. First preserve the full path, hash if your organization collects it, version information, signature status, and publisher. Next compare those details with the server’s installed Windows build and trusted servicing records.
Use Windows Security or another trusted security product to scan a suspicious file and the surrounding system. A detection, an invalid signature, an unexpected location, or execution on a computer without Failover Clustering warrants incident-response handling. Do not weaken protection with an exclusion while you are still determining whether the file is legitimate.
Also popular on Amazon
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
If the file is legitimate but RHS continues to fail, return to the cluster logs and resource DLL. Security validation cannot identify a deadlocked resource, and a clean scan does not prove that a cluster configuration is healthy.
What should I avoid when rhs.exe stops working?
- Do not assume the process name proves malware or proves legitimacy.
- Do not download a replacement executable from an unofficial file repository.
- Do not apply a Windows Server 2008 or 2008 R2 hotfix to a newer release without a matching Microsoft case.
- Do not terminate RHS repeatedly as a permanent fix; the cluster may already be recycling it as part of recovery.
- Do not clear logs before saving the event sequence and identifying the resource.
- Do not change storage, environment-variable paths, or cluster dependencies on a production system without a rollback plan.
- Do not add an antivirus exclusion simply to suppress an alert.
What is the safest recovery sequence?
For a recurring incident, use this order so that each action produces useful evidence:
- Preserve the event text, event ID, timestamp, node, resource, operation, and any exception or dump reference.
- Confirm whether the server actually has Failover Clustering and whether the file’s signature and publisher are plausible.
- Correlate Failover Cluster Manager, Event Viewer, and Windows Error Reporting records across all affected nodes.
- Identify the resource DLL and decide whether the pattern is a crash, access violation, timeout, deadlock, or failover-specific failure.
- Match the finding to the exact Windows Server version and to any documented Microsoft support scenario.
- Apply one supported correction at a time, beginning with the resource provider or dependency that the evidence identifies.
- Run the general update, firmware, hardware, memory, and malware checks when broader stop errors are present.
- Monitor the same resource and operation after the change, and keep a rollback record if the cluster is production-critical.
This sequence avoids the most common diagnostic mistake: treating the recyclable host process as though it were the underlying application or storage component.
For related non-cluster Windows errors on supported Windows 11, 10, 8, or 7 systems, Outbyte PC Repair is an optional shortcut that can address more than 100 common Windows issues, clean temporary and cache files, check selected vulnerabilities, and provide an app-crash log. It complements antivirus protection rather than replacing it; results vary, and no tool repairs every crash. It offers a free trial by category for at least two days before a paid subscription.
Frequently asked questions
Frequently Asked Questions
Can I end rhs.exe in Task Manager?
Avoid ending it manually on a production cluster. The cluster may already be recycling the host as a recovery action, and stopping it yourself can trigger another resource failure or failover without preserving the diagnostic evidence.
Does rhs.exe run on Windows 11 or Windows 10?
The Microsoft documentation covered here is for Windows Server Failover Clustering. A similarly named file on a consumer edition is not established as the cluster Resource Host Monitor, so verify its path, signature, publisher, and why it is running before treating it as legitimate.
Recommended Free Tools
Should I copy rhs.exe from another server?
No. Files from another server may belong to a different build, edition, architecture, or update level. Use trusted Windows servicing and the cluster-resource vendor’s supported repair process instead of copying an executable.
What if the server has no Failover Clustering role installed?
Treat the process as unexplained rather than automatically safe. Record its location and signature, scan it with a trusted security product, and investigate which application launched it; the cluster-specific troubleshooting steps do not establish its identity on a non-clustered machine.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
