NgcIso.exe

Windows ProcessMicrosoft Corporation

Also called ngciso, ngc isolated, windows hello isolated

WindowsSystem Component

Windows Hello Isolated NGC. It is the Isolated User Mode trustlet for Next Generation Credentials, not the PIN dialog you type into.

What you need to know

This isolates Windows Hello secrets. LogonUI.exe still draws the PIN tiles.

NgcIso.exe is the NGC isolation trustlet. It shows up on PCs that use Windows Hello with VBS. Ending it does not hide the lock screen. It weakens the Hello container.

Safe?: Yes, with Windows Hello
Is it LogonUI?: No. This one isolates the credential
Should I end it?: No

Feex says

If NgcIso is running and you use a PIN or face sign-in, I would leave it. The tiles are LogonUI. This process is the vault.

What is NgcIso.exe?

NgcIso.exe is Isolated NGC, the Windows Hello credential isolation process. NGC is Next Generation Credentials, the PIN and biometric container.

What does it do?

It holds Hello keys in the isolated world. LogonUI.exe still paints the prompt. winlogon.exe still owns the session.

Why is it running?

You enrolled a PIN, fingerprint, or face, and the device supports VBS isolation for those keys. A PC that only uses a password may not show it.

Is it safe?

Usually safe

The Microsoft trustlet is expected with Hello plus VBS. An NgcIso.exe in a zip is not Windows Hello.

A legitimate copy normally runs from:

C:\Windows\System32\NgcIso.exe

Expected publisher: Microsoft Corporation
IUM trustlet
UI is LogonUI, not this file

Can I end it?

Ending NgcIso.exe can break PIN and biometric sign-in until reboot. It is not a privacy toggle.

Can I remove it?

Do not delete NgcIso.exe. Remove a Hello PIN from Settings if you want to stop using it.

Should it start with Windows?

The secure path starts it with Hello. It is not Startup Apps.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Low except during enroll or unlock
Memory: Small
Disk: Low
Network: None for a local PIN

File information

NgcIso.exe file information
Executable name	NgcIso.exe
Common legitimate path	C:\Windows\System32\NgcIso.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

PIN stopped working after an "optimizer" killed isolation

Restore VBS and reboot. Deleting the trustlet is not a PIN reset.

Confused with LsaIso

LsaIso is Credential Guard for domain hashes. NgcIso is Windows Hello NGC. Two trustlets, two jobs.

Troubleshooting

Diagnose before you change anything destructive.

Sign-in options in Settings

Remove and re-add the PIN if Hello is broken. Do not replace NgcIso.exe.

Check VBS in msinfo32

Hello isolation needs the same foundation as Credential Guard.

Technical details

NgcIso.exe technical details
Image name	NgcIso.exe
Role	Isolated NGC / Windows Hello

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Windows Hello · NGC and Hello
Microsoft Learn: IUM processes · Hello isolation uses IUM
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.