# LogonUI.exe

Windows Process: Microsoft Corporation

Also called logonui, windows logon user interface, credential ui

Windows, System Component

Windows Logon User Interface. It draws the credential tiles and PIN prompt on the secure desktop.

## What you need to know

This draws the sign-in tiles. winlogon still owns the session.

LogonUI.exe is the credential user interface. It appears on the lock screen and secure desktop. Ending it can freeze the sign-in screen. It is not the session manager.

- **Safe?**: Yes, in System32

  **Should I end it?**: No while you need the lock screen

  **Same as winlogon?**: No. This one draws the tiles

Feex says

If the PIN box is blank, I look at LogonUI and the credential provider, not at Chrome. This process is the paint, not the lock itself.

## What is LogonUI.exe?

LogonUI.exe is the Windows Logon User Interface Host. It renders pictures, PIN, password, and Windows Hello prompts on the secure desktop.

## What does it do?

It loads credential providers. A vendor fingerprint reader or a smart-card package plugs in here. It does not start services.exe.

## Why is it running?

The machine is locked, at Ctrl+Alt+Delete, or switching users. You should not see a busy LogonUI after you are already on the desktop.

## Is it safe?

Usually safe

The legitimate UI host is in System32. A LogonUI.exe unpacked next to a screensaver is not the Windows lock screen.

A legitimate copy normally runs from:

`C:\Windows\System32\LogonUI.exe`

- Expected publisher: Microsoft Corporation
- Runs on the secure desktop
- winlogon is the parent role

## Can I end it?

No

Ending LogonUI while the PC is locked can leave a black sign-in screen. It does not unlock a stuck desktop.

## Can I remove it?

No

Do not delete LogonUI.exe. You would lose the supported way to type a password.

## Should it start with Windows?

winlogon starts LogonUI when a credential prompt is needed. It is not a Startup Apps toggle.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Can rise on a slow GPU while the lock-screen slideshow runs

  **Memory**: Moderate while the lock screen is up

  **Disk**: Low

  **Network**: Used if a picture password or web sign-in provider needs it

## File information

| Executable name        | LogonUI.exe                     |
| ---------------------- | ------------------------------- |
| Common legitimate path | C:\Windows\System32\LogonUI.exe |
| Publisher              | Microsoft Corporation           |
| Signature expectation  | Signed by Microsoft Windows     |

## Common problems

### Black lock screen

A broken lock-screen image, a third-party credential provider, or a GPU reset can blank LogonUI. Safe Mode is a test, not a wipe.

### Stays after unlock

A leftover LogonUI after the desktop appears can mean a failed unlock. Restarting Explorer will not replace this process.

## Troubleshooting

Diagnose before you change anything destructive.

### Unload extra credential providers as a test

A fingerprint or SSO package can hang the tiles. The Windows password provider should still work.

### Check the lock-screen slideshow

A huge OneDrive album as the lock background can make LogonUI look busy. That is the pictures, not malware named LogonUI.

## Technical details

Technical details

| Image name | LogonUI.exe               |
| ---------- | ------------------------- |
| Role       | Credential user interface |

## Related

These entities connect to this article. Type is shown on every link.

[winlogon.exe: Windows Process](https://feex.it/wiki/process/winlogon.exe)[How to read Task Manager: Guide](https://feex.it/wiki/software/system/how-to-read-task-manager)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Credential providers ](https://learn.microsoft.com/windows/win32/secauthn/credential-providers-in-windows)· Logon UI hosts providers
- [Microsoft Support: Windows ](https://support.microsoft.com/windows)· Public support naming
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: LogonUI.exe

  **Typical path**: C:\Windows\System32\LogonUI.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/logonui.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)