LogonUI.exe

Windows ProcessMicrosoft Corporation

Also called logonui, windows logon user interface, credential ui

WindowsSystem Component

Windows Logon User Interface. It draws the credential tiles and PIN prompt on the secure desktop.

What you need to know

This draws the sign-in tiles. winlogon still owns the session.

LogonUI.exe is the credential user interface. It appears on the lock screen and secure desktop. Ending it can freeze the sign-in screen. It is not the session manager.

Safe?: Yes, in System32
Should I end it?: No while you need the lock screen
Same as winlogon?: No. This one draws the tiles

Feex says

If the PIN box is blank, I look at LogonUI and the credential provider, not at Chrome. This process is the paint, not the lock itself.

What is LogonUI.exe?

LogonUI.exe is the Windows Logon User Interface Host. It renders pictures, PIN, password, and Windows Hello prompts on the secure desktop.

What does it do?

It loads credential providers. A vendor fingerprint reader or a smart-card package plugs in here. It does not start services.exe.

Why is it running?

The machine is locked, at Ctrl+Alt+Delete, or switching users. You should not see a busy LogonUI after you are already on the desktop.

Is it safe?

Usually safe

The legitimate UI host is in System32. A LogonUI.exe unpacked next to a screensaver is not the Windows lock screen.

A legitimate copy normally runs from:

C:\Windows\System32\LogonUI.exe

Expected publisher: Microsoft Corporation
Runs on the secure desktop
winlogon is the parent role

Can I end it?

Ending LogonUI while the PC is locked can leave a black sign-in screen. It does not unlock a stuck desktop.

Can I remove it?

Do not delete LogonUI.exe. You would lose the supported way to type a password.

Should it start with Windows?

winlogon starts LogonUI when a credential prompt is needed. It is not a Startup Apps toggle.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Can rise on a slow GPU while the lock-screen slideshow runs
Memory: Moderate while the lock screen is up
Disk: Low
Network: Used if a picture password or web sign-in provider needs it

File information

LogonUI.exe file information
Executable name	LogonUI.exe
Common legitimate path	C:\Windows\System32\LogonUI.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Black lock screen

A broken lock-screen image, a third-party credential provider, or a GPU reset can blank LogonUI. Safe Mode is a test, not a wipe.

Stays after unlock

A leftover LogonUI after the desktop appears can mean a failed unlock. Restarting Explorer will not replace this process.

Troubleshooting

Diagnose before you change anything destructive.

Unload extra credential providers as a test

A fingerprint or SSO package can hang the tiles. The Windows password provider should still work.

Check the lock-screen slideshow

A huge OneDrive album as the lock background can make LogonUI look busy. That is the pictures, not malware named LogonUI.

Technical details

LogonUI.exe technical details
Image name	LogonUI.exe
Role	Credential user interface

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Credential providers · Logon UI hosts providers
Microsoft Support: Windows · Public support naming
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.