SecurityHealthSystray.exe

Windows ProcessMicrosoft Corporation

Also called securityhealthsystray, windows security tray, defender shield

WindowsSystem Component

The Windows Security shield in the notification area. It is the tray icon, not the scan engine and not the health service that feeds it.

What you need to know

This is the shield icon. SecurityHealthService.exe is the broker. MsMpEng.exe is the scan.

SecurityHealthSystray.exe only owns the notification-area shield. Ending it hides status. It does not turn Defender off.

Safe?: Yes. It is the shield icon
Does it scan?: No. MsMpEng scans
Can I end it?: The icon vanishes. Protection may stay

Feex says

If the shield is gone and this process is dead, I would start Windows Security again. I would not treat a missing icon as proof the engine stopped.

What is SecurityHealthSystray.exe?

SecurityHealthSystray.exe is the Windows Security notification-area icon. It sits in System32 on current Windows.

What does it do?

It shows healthy or "action needed." Clicks open Windows Security. It does not enumerate files for malware.

Why is it running?

You signed in and Windows Security wants a visible status. A third-party antivirus that owns the slot may hide or replace this icon.

Is it safe?

Usually safe

The Microsoft-signed System32 tray is the shield. A Systray exe in Temp is not Windows Security.

A legitimate copy normally runs from:

C:\Windows\System32\SecurityHealthSystray.exe

Tray icon only
Broker: SecurityHealthService.exe
Engine: MsMpEng.exe

Can I end it?

Hides the icon

Ending the tray process removes the shield until it starts again. Use Windows Security if you want to change protection.

Can I remove it?

Do not delete SecurityHealthSystray.exe to "debloat." You lose status, not a miner.

Should it start with Windows?

Windows starts the tray with the user session. That is expected.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Idle
Memory: Small
Disk: None
Network: None by itself

File information

SecurityHealthSystray.exe file information
Executable name	SecurityHealthSystray.exe
Common legitimate path	C:\Windows\System32\SecurityHealthSystray.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Icon missing, Defender still running

Restart this process or Windows Security. Check MsMpEng before you assume protection died.

Two shields

A third-party suite plus this tray can overlap. Pick an owner in Windows Security.

Troubleshooting

Diagnose before you change anything destructive.

Open Windows Security from Start

The app works even if the tray is dead.

Do not replace the exe

Servicing owns System32.

Technical details

SecurityHealthSystray.exe technical details
Image name	SecurityHealthSystray.exe
Role	Windows Security tray icon

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Support: Windows Security · Shield and app
Microsoft Learn: Windows · Primary Windows documentation
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.