WINDOWS PROCESS
SecurityHealthService
The service behind the Windows Security app. Microsoft documents that Windows Security uses the Windows Security Service (SecurityHealthService), which in turn uses the Security Center service (wscsvc), to show up-to-date information about the protection status of the PC, including protection from third-party antivirus and firewall products.
TECHNICAL SUMMARY
| Process | SecurityHealthService.exe |
|---|---|
| Display name | Windows Security Health Service |
| File | C:\Windows\System32\SecurityHealthService.exe |
| Signed by | Microsoft Windows |
| Verdict | Leave it alone |
Paths, signer and service account observed on Windows 11 build 26300 on 11 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft's guidance for Windows 10 and 11 IoT Enterprise rates the service Don't disable. Microsoft also notes that disabling or modifying the services behind Windows Security does not turn off Microsoft Defender Antivirus: it leaves the PC in a lowered protection state, even with a third-party antivirus. On the PC used for this page one copy was running, in session 0, started by services.exe, and Windows did not accept a stop request for it.
What PC Tweaker does with it
PC Tweaker's priority rules refuse programs in the Windows folder and security software, so the app never changes this process's priority, and no control in the catalogue stops or edits it.
Check it yourself
See where it runs from
Protected processes hide their path from a normal window; run PowerShell as administrator to see it.
PowerShellGet-Process SecurityHealthService -ErrorAction SilentlyContinue | Select-Object Id, PathCheck who signed the file
Expect Status: Valid and a certificate issued to Microsoft Windows. A file with this name anywhere else, or with another signer, deserves a closer look.
PowerShellGet-AuthenticodeSignature "C:\Windows\System32\SecurityHealthService.exe" | Format-List Status, SignerCertificate
Common questions
Is SecurityHealthService.exe safe, or could it be a virus?
The genuine file is in C:\Windows\System32 and is signed by Microsoft Windows. A program can borrow a familiar name, so check where your copy runs from and who signed it with the commands in “Check it yourself”. A file with this name anywhere else, or with another signer, deserves a closer look.
Can I end SecurityHealthService.exe?
Leave it alone. Microsoft's guidance for Windows 10 and 11 IoT Enterprise rates the service Don't disable. Microsoft also notes that disabling or modifying the services behind Windows Security does not turn off Microsoft Defender Antivirus: it leaves the PC in a lowered protection state, even with a third-party antivirus. On the PC used for this page one copy was running, in session 0, started by services.exe, and Windows did not accept a stop request for it.
Can I download SecurityHealthService.exe if it is missing or damaged?
A copy from a download site is not a fix and cannot be trusted: this is a Windows system file. On Windows 11 build 26300 the genuine file is C:\Windows\System32\SecurityHealthService.exe, 157,592 bytes, with a valid Microsoft Windows signature. If Windows Security does not open, check the service first with Get-Service SecurityHealthService, then check the file with the command in “Check it yourself”.
How is SecurityHealthService set up as a service?
On build 26300 the service runs this executable as LocalSystem, with its startup type set to Manual, and depends on RpcSs. sc qprotection SecurityHealthService reports the protection level Windows light, which Microsoft documents as reserved for Windows' own services.