slui.exe

Windows ProcessMicrosoft Corporation

Also called slui, software licensing ui, activation ui

WindowsSystem Component

Windows Activation UI (Software Licensing UI). It is the dialog you click. It is not sppsvc.exe, the Software Protection service.

What you need to know

slui is the activation dialog, not sppsvc.exe (the licensing service).

slui.exe draws Activate Windows and related licensing UI. sppsvc.exe is Software Protection Platform, the service that actually checks tokens. Closing the dialog does not stop sppsvc. Ending sppsvc does not uninstall slui.

Safe?: Yes, in System32
Same as sppsvc?: No. sppsvc is the licensing service
Can I end it?: The activation dialog closes

Feex says

If the watermark dialog is on screen, I expect slui. I do not end sppsvc to close that window, and I do not run an "activator" that replaces either file.

What is slui.exe?

slui is the activation dialog, not sppsvc.exe (the licensing service). Software Licensing UI is this file. Software Protection is sppsvc.exe. Settings may open slui for Activate Windows.

What does it do?

It shows product-key and activation pages and hands work to SPP. It does not host the SPP service and it does not install updates (TiWorker).

Why is it running?

Windows or an app opened the activation UI, or you ran slui. A watermark without this window still involves sppsvc in the background.

Is it safe?

Usually safe

System32 slui.exe is Microsoft. A slui.exe in an activator zip is not. This is still not sppsvc.exe.

A legitimate copy normally runs from:

C:\Windows\System32\slui.exe

Software Licensing UI
Service sibling: System32\sppsvc.exe
Expected publisher: Microsoft Corporation

Can I end it?

Closes the dialog

Ending slui.exe closes Activate Windows. sppsvc.exe can keep revalidating. Ending the service to hide a watermark is a different, unsupported move.

Can I remove it?

Do not delete slui.exe. Activate from Settings if you want the UI. Do not replace sppsvc.exe. Do not delete System32.

Should it start with Windows?

Activation UI can pop after sign-in. The service schedule is sppsvc, not a Startup Apps row named slui by default.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Low while the dialog sits there
Memory: Small
Disk: Low
Network: Activation when you click through

File information

slui.exe file information
Executable name	slui.exe
Common legitimate path	C:\Windows\System32\slui.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

People kill sppsvc to dismiss slui

The dialog is this exe. Killing Software Protection can break licensing checks. Close slui, leave the service unless you are repairing SPP.

An activator drops a fake slui.exe

Path and signature decide. Real UI is System32. The service remains sppsvc.

Troubleshooting

Diagnose before you change anything destructive.

Settings > System > Activation, or run slui from System32

That is this UI. services.msc > Software Protection is sppsvc, the sibling service.

Do not run an activator that claims to replace slui or sppsvc

Repair licensing with Microsoft's activation help. Leave both System32 files in place.

Technical details

slui.exe technical details
Image name	slui.exe
Role	Software Licensing / activation UI

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Support: activate Windows · Activation UI the user sees
Microsoft Learn: Software Protection · sppsvc is the service, slui is the UI
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.