PROCESSMicrosoft-signedCritical process
winlogon.exeWindows Logon
winlogon.exe (Windows Logon) manages interactive logon and logoff, the secure attention sequence (Ctrl+Alt+Del), loading the user profile, and locking the screen. It is a critical process that works with lsass.exe to authenticate users. The genuine file is in System32 and signed by Microsoft.
What winlogon.exe does
Windows Logon orchestrates interactive sign-in. It presents the logon UI through a credential provider, hands the entered credentials to lsass.exe for verification, loads the user's profile, and starts the shell. It also handles logoff, the lock screen, and the secure attention sequence (Ctrl+Alt+Del), which the kernel routes only to winlogon so that no other program can capture your password at the logon screen.
Why it is critical
winlogon.exe is started by wininit.exe and is a protected, critical process. Ending it breaks the session's security and desktop and forces a logoff or restart. One instance runs per interactive session.
Resource use
Activity is concentrated around logon, logoff, lock and unlock. At other times it should be idle. Persistent CPU use by a genuine winlogon.exe usually reflects a misbehaving credential provider, a Group Policy logon script, or a roaming-profile problem.
Confirming it is genuine
- Path:
C:\Windows\System32\winlogon.exe. - Signature: Microsoft.
- One per interactive session.
As with other core processes, the name is sometimes borrowed by malware placed elsewhere. The path and signature settle it. The token winlogon helps create is what whoami later reports.
Frequently asked questions
What is the secure attention sequence?
Ctrl+Alt+Del is intercepted by the kernel and handed to winlogon.exe, which guarantees you are talking to the real Windows logon UI and not a program impersonating it to steal your password. That is why it is required to log on in some configurations.
Why is winlogon.exe using CPU?
Briefly during logon, logoff, lock and unlock. Sustained CPU is unusual and, once the path and signature are confirmed genuine, may point to a profile or credential-provider problem.