wininit.exe C:\Windows\System32\wininit.exe

Windows Start-Up Application: started by smss.exe in session 0, it launches services.exe and lsass.exe. Critical process.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

wininit.exe is started by smss.exe in session 0. It launches the core system processes: the service control manager (services.exe) and the local security authority subsystem (lsass.exe). It is the session 0 counterpart of winlogon.exe, which serves interactive sessions.

Never terminate it: it is a critical process, and stopping it causes a blue screen.

What it contains

An executable signed by Microsoft in C:\Windows\System32.
A single instance, in session 0, with no window.
Its children are services.exe and lsass.exe.

Risks and best practices

Only one instance should exist. A second wininit.exe, or a file outside System32 or unsigned, is suspicious.
For a damaged file, repair with sfc /scannow rather than replacing it by hand.

Useful commands

# The process: path, session, start time (as administrator to see the path)
Get-Process -Name wininit -IncludeUserName -ErrorAction SilentlyContinue | Select-Object Id, SessionId, UserName, StartTime, Path

# Digital signature of the file
Get-AuthenticodeSignature "$env:windir\System32\wininit.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

# Parentage: services.exe and lsass.exe should have wininit.exe as parent
Get-CimInstance Win32_Process | Where-Object { $_.Name -in "services.exe","lsass.exe","wininit.exe" } | Select-Object Name, ProcessId, ParentProcessId

Report a mistake