winlogon.exe

Windows ProcessMicrosoft Corporation

Also called winlogon, windows logon process, windows logon application

WindowsSystem Component

Windows Logon. It owns the secure attention sequence and loads your user session after you sign in.

What you need to know

This is the sign-in owner, not a leftover updater.

winlogon.exe handles Ctrl+Alt+Delete and starts the user session. Ending it signs you out. A copy outside System32 is not the Windows logon process.

Safe?: Yes, in System32
Should I end it?: No. You will be signed out
High CPU normal?: Not as a steady state

Feex says

If someone tells you to end winlogon to speed up the PC, I would close that tab. That process is how Windows knows you are signed in.

What is winlogon.exe?

winlogon.exe is the Windows Logon Process. It registers the secure attention sequence and coordinates the desktop after authentication.

What does it do?

It launches userinit and the shell after a successful sign-in. It also hosts the lock screen hand-off to LogonUI.exe. It does not scan files or print documents.

Why is it running?

Every interactive session needs a logon owner. You see it because you signed in. It is not started by a browser or a game.

Is it safe?

Usually safe

The legitimate file is signed Microsoft and lives in System32. A winlogon.exe in Downloads or a user temp folder is not the session owner.

A legitimate copy normally runs from:

C:\Windows\System32\winlogon.exe

Expected publisher: Microsoft Corporation
Expected path: System32
Ending it ends the session

Can I end it?

Ending winlogon.exe signs you out or crashes the session. It is not a way to free RAM.

Can I remove it?

Do not delete winlogon.exe. Windows cannot complete an interactive logon without it.

Should it start with Windows?

Windows starts winlogon as part of session setup. It is not a Startup Apps leftover.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Low after the desktop appears. Spikes while locking or unlocking
Memory: Small and steady
Disk: Low
Network: None by itself

File information

winlogon.exe file information
Executable name	winlogon.exe
Common legitimate path	C:\Windows\System32\winlogon.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Stuck at the lock screen

LogonUI draws the tiles. winlogon still owns the session. A hung credential provider is a likelier cause than a missing exe.

Copy in a random folder

Malware reuses the name. Check the path and signature before you trust the filename.

Troubleshooting

Diagnose before you change anything destructive.

Confirm System32 and the Microsoft signature

Open properties on the running image. A user-folder path is the first red flag.

Do not end it to test performance

Use Task Manager on the app that is actually busy. Ending winlogon is a sign-out.

Technical details

winlogon.exe technical details
Image name	winlogon.exe
Role	Interactive logon and SAS

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Winlogon · Winlogon and the SAS
Microsoft Support: Windows · Public support naming
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.