winlogon.exe C:\Windows\System32\winlogon.exe

Interactive logon process: handles the secure attention sequence, loads the profile and starts the user shell.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

winlogon.exe handles interactive sign-in and sign-out. It processes the secure attention sequence (Ctrl+Alt+Del), authenticates the user through authentication providers, loads their profile and environment, locks and unlocks the workstation, then starts userinit.exe, which launches the shell (explorer.exe). There is one instance per interactive session.

What it contains

An executable signed by Microsoft in C:\Windows\System32.
Its configuration is under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, notably the Shell and Userinit values.
It relies on lsass.exe for authentication.

Risks and best practices

Do not terminate it: stopping winlogon.exe causes a blue screen or ends the session.
Check Shell and Userinit, two classic persistence targets. Their defaults are explorer.exe and C:\Windows\system32\userinit.exe, (with the trailing comma). Anything else needs an explanation.
Do not replace the file. If it is corrupt, run sfc /scannow.

Useful commands

# Running instances: one per interactive session, check path and signature
Get-CimInstance Win32_Process -Filter "Name='winlogon.exe'" | Select-Object ProcessId, SessionId, ExecutablePath

# Digital signature of the file
Get-AuthenticodeSignature "$env:windir\System32\winlogon.exe" | Select-Object Status, @{n="Signer";e={$_.SignerCertificate.Subject}}

# Shell and Userinit values
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' | Select-Object Shell, Userinit

Report a mistake