RIVET
Home / Process library / winlogon.exe
What is winlogon.exe?
winlogon.exe is Windows Logon. Creates the sign-in and lock screens, handles Ctrl+Alt+Del and signs you out.
| Name | winlogon.exe |
|---|---|
| Full name | Windows Logon |
| Publisher | Microsoft Windows |
| Normal location | C:\Windows\System32 |
| Safe to end? | Keep No. winlogon.exe is part of Windows and should keep running. |
| If you end it | Your session ends immediately. |
How to check it's the real winlogon.exe
- Open Task Manager (Ctrl+Shift+Esc) and go to Details.
- Right-click winlogon.exe and choose Open file location. It should open
C:\Windows\System32. - Right-click the file, choose Properties, then Digital Signatures. The signer should be Microsoft Windows.
A file called winlogon.exe somewhere else, or without that signature, is worth scanning with Microsoft Defender.
What RIVET shows
RIVET's process list shows winlogon.exe with this explanation, the verdict above, and a signature check, so you can see at a glance whether it is the genuine Windows file. Ending a process can't be undone, and RIVET warns you before it ends anything Windows needs.
Questions
Is winlogon.exe a virus?
The genuine winlogon.exe is part of Windows, signed by Microsoft Windows, and runs from C:\Windows\System32. Malware sometimes copies the name, so check the location and signature as shown above.
Can I end winlogon.exe?
No. winlogon.exe is part of Windows and should keep running. Your session ends immediately.