bioiso.exe

Windows ProcessMicrosoft Corporation

Also called bioiso, biometric isolation, hello biometric trustlet

WindowsSystem Component

Biometric Isolation trustlet. When Enhanced Sign-in Security is on, this Isolated User Mode process holds Windows Hello biometrics. It is not LsaIso.exe and it is not NgcIso.exe.

What you need to know

bioiso is Isolated User Mode biometrics, not LsaIso and not NgcIso.

bioiso.exe is the biometric isolation trustlet for Windows Hello face or fingerprint when Enhanced Sign-in Security is active. LsaIso.exe holds domain secrets for Credential Guard. NgcIso.exe isolates Next Generation Credentials.

Safe?: Yes, with Hello biometrics and VBS
Same as LsaIso?: No. LsaIso is Credential Guard
Same as NgcIso?: No. NgcIso isolates NGC / PIN

Feex says

If face unlock works and bioiso is on the list, I leave it. I do not end LsaIso to "speed up Hello," and I do not treat NgcIso as the camera.

What is bioiso.exe?

bioiso.exe is Isolated User Mode biometrics. It is not LsaIso.exe (Credential Guard hashes) and not NgcIso.exe (Hello NGC / PIN isolation). Microsoft lists both bioiso and ngciso when Enhanced Sign-in Security is working.

What does it do?

It keeps biometric matching in the isolated world. The camera or fingerprint driver still exists in the normal world. LogonUI.exe still paints the tiles.

Why is it running?

You enrolled face or fingerprint on hardware that supports Enhanced Sign-in Security, and VBS is running. A PC that only uses a password often will not show bioiso.

Is it safe?

Usually safe

The Microsoft trustlet in System32 is expected with Hello biometrics plus VBS. A bioiso.exe in a zip is not that trustlet. LsaIso and NgcIso stay different jobs.

A legitimate copy normally runs from:

C:\Windows\System32\bioiso.exe

IUM biometric trustlet
Credential Guard sibling: LsaIso.exe
Hello NGC sibling: NgcIso.exe

Can I end it?

Ending bioiso.exe is treated as a security-process failure. Face or fingerprint sign-in can break until reboot. It is not a privacy toggle.

Can I remove it?

Do not delete bioiso.exe. Remove a Hello face or fingerprint from Settings if you want to stop using it. Do not delete LsaIso.exe or NgcIso.exe for this.

Should it start with Windows?

The secure path starts it with Enhanced Sign-in Security. It is not Startup Apps.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Low except during enroll or unlock
Memory: Small
Disk: Low
Network: None for a local biometric

File information

bioiso.exe file information
Executable name	bioiso.exe
Common legitimate path	C:\Windows\System32\bioiso.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Hello face stopped after an "optimizer" killed isolation

Check VBS in msinfo32 and that bioiso.exe and ngciso.exe are running tasks. Re-enroll the biometric. Do not replace the trustlet.

Three Iso names scare people

LsaIso is Credential Guard. NgcIso is NGC / PIN. bioiso is biometrics. Three trustlets, three jobs.

Troubleshooting

Diagnose before you change anything destructive.

msinfo32 > Virtualization-based security, then Running Tasks

Microsoft wants bioiso.exe and ngciso.exe listed when Enhanced Sign-in Security is on. LsaIso.exe is a different feature.

Settings > Sign-in options, then Device Manager > Biometric devices

Re-enroll or reinstall the sensor. Do not attach a debugger to an IUM process.

Technical details

bioiso.exe technical details
Image name	bioiso.exe
Role	Isolated User Mode biometric trustlet

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Enhanced Sign-in Security · bioiso.exe and ngciso.exe trustlets
Microsoft Learn: IUM processes · Trustlets cannot be injected
Microsoft Learn: Windows Hello · Hello versus Credential Guard
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.