# bioiso.exe

Windows Process: Microsoft Corporation

Also called bioiso, biometric isolation, hello biometric trustlet

Windows, System Component

Biometric Isolation trustlet. When Enhanced Sign-in Security is on, this Isolated User Mode process holds Windows Hello biometrics. It is not LsaIso.exe and it is not NgcIso.exe.

## What you need to know

bioiso is Isolated User Mode biometrics, not LsaIso and not NgcIso.

bioiso.exe is the biometric isolation trustlet for Windows Hello face or fingerprint when Enhanced Sign-in Security is active. LsaIso.exe holds domain secrets for Credential Guard. NgcIso.exe isolates Next Generation Credentials.

- **Safe?**: Yes, with Hello biometrics and VBS

  **Same as LsaIso?**: No. LsaIso is Credential Guard

  **Same as NgcIso?**: No. NgcIso isolates NGC / PIN

Feex says

If face unlock works and bioiso is on the list, I leave it. I do not end LsaIso to "speed up Hello," and I do not treat NgcIso as the camera.

## What is bioiso.exe?

bioiso.exe is Isolated User Mode biometrics. It is not LsaIso.exe (Credential Guard hashes) and not NgcIso.exe (Hello NGC / PIN isolation). Microsoft lists both bioiso and ngciso when Enhanced Sign-in Security is working.

## What does it do?

It keeps biometric matching in the isolated world. The camera or fingerprint driver still exists in the normal world. LogonUI.exe still paints the tiles.

## Why is it running?

You enrolled face or fingerprint on hardware that supports Enhanced Sign-in Security, and VBS is running. A PC that only uses a password often will not show bioiso.

## Is it safe?

Usually safe

The Microsoft trustlet in System32 is expected with Hello biometrics plus VBS. A bioiso.exe in a zip is not that trustlet. LsaIso and NgcIso stay different jobs.

A legitimate copy normally runs from:

`C:\Windows\System32\bioiso.exe`

- IUM biometric trustlet
- Credential Guard sibling: LsaIso.exe
- Hello NGC sibling: NgcIso.exe

## Can I end it?

No

Ending bioiso.exe is treated as a security-process failure. Face or fingerprint sign-in can break until reboot. It is not a privacy toggle.

## Can I remove it?

No

Do not delete bioiso.exe. Remove a Hello face or fingerprint from Settings if you want to stop using it. Do not delete LsaIso.exe or NgcIso.exe for this.

## Should it start with Windows?

The secure path starts it with Enhanced Sign-in Security. It is not Startup Apps.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Low except during enroll or unlock

  **Memory**: Small

  **Disk**: Low

  **Network**: None for a local biometric

## File information

| Executable name        | bioiso.exe                     |
| ---------------------- | ------------------------------ |
| Common legitimate path | C:\Windows\System32\bioiso.exe |
| Publisher              | Microsoft Corporation          |
| Signature expectation  | Signed by Microsoft Windows    |

## Common problems

### Hello face stopped after an "optimizer" killed isolation

Check VBS in msinfo32 and that bioiso.exe and ngciso.exe are running tasks. Re-enroll the biometric. Do not replace the trustlet.

### Three Iso names scare people

LsaIso is Credential Guard. NgcIso is NGC / PIN. bioiso is biometrics. Three trustlets, three jobs.

## Troubleshooting

Diagnose before you change anything destructive.

### msinfo32 > Virtualization-based security, then Running Tasks

Microsoft wants bioiso.exe and ngciso.exe listed when Enhanced Sign-in Security is on. LsaIso.exe is a different feature.

### Settings > Sign-in options, then Device Manager > Biometric devices

Re-enroll or reinstall the sensor. Do not attach a debugger to an IUM process.

## Technical details

Technical details

| Image name | bioiso.exe                            |
| ---------- | ------------------------------------- |
| Role       | Isolated User Mode biometric trustlet |

## Related

These entities connect to this article. Type is shown on every link.

[LsaIso.exe: Windows Process](https://feex.it/wiki/process/lsaiso.exe)[NgcIso.exe: Windows Process](https://feex.it/wiki/process/ngciso.exe)[Secure System: Windows Process](https://feex.it/wiki/process/secure-system)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Enhanced Sign-in Security ](https://learn.microsoft.com/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)· bioiso.exe and ngciso.exe trustlets
- [Microsoft Learn: IUM processes ](https://learn.microsoft.com/windows/win32/procthread/isolated-user-mode--ium--processes)· Trustlets cannot be injected
- [Microsoft Learn: Windows Hello ](https://learn.microsoft.com/windows/security/identity-protection/hello-for-business/)· Hello versus Credential Guard
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: bioiso.exe

  **Typical path**: C:\Windows\System32\bioiso.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [NgcIso.exe](https://feex.it/wiki/process/ngciso.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/bioiso.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)