WINDOWS PROCESS

SecurityHealthSystray.exe: Windows Security notification icon

Q: Is SecurityHealthSystray.exe safe, or could it be a virus?

The genuine file is in C:\Windows\System32 and is signed by Microsoft Windows. A program can borrow a familiar name, so check where your copy runs from and who signed it with the commands in “Check it yourself”. A file with this name anywhere else, or with another signer, deserves a closer look.

The Windows Security icon in the notification area of the taskbar, which Microsoft documents as one of the ways to open the Windows Security app. The file describes itself as the Windows Security notification icon, and Windows starts it when you sign in.

TECHNICAL SUMMARY

Process	SecurityHealthSystray.exe
Display name	Windows Security notification icon
File	C:\Windows\System32\SecurityHealthSystray.exe
Signed by	Microsoft Windows
Verdict	Depends on what you use

Paths, signer and service account observed on Windows 11 build 26300 on 11 November 2026. Run the commands below to check your own PC.

Should you touch it?

Depends on what you use

It is a startup entry for an icon, not the antivirus. Microsoft documents a policy that hides the Windows Security notification area control, so hiding the icon is a supported choice; the protection comes from the Defender and Windows Security services, which run separately. On the PC used for this page its startup entry had been switched off, so the icon process was not running, while SecurityHealthService.exe was.

What PC Tweaker does with it

PC Tweaker's priority rules refuse programs in the Windows folder and security software, so the app never changes this process's priority, and no control in the catalogue stops or edits it.

Check it yourself

01
See where it runs from
Protected processes hide their path from a normal window; run PowerShell as administrator to see it.
```
Get-Process SecurityHealthSystray -ErrorAction SilentlyContinue | Select-Object Id, Path
```
PowerShell
02
Check who signed the file
Expect Status: Valid and a certificate issued to Microsoft Windows. A file with this name anywhere else, or with another signer, deserves a closer look.
```
Get-AuthenticodeSignature "C:\Windows\System32\SecurityHealthSystray.exe" | Format-List Status, SignerCertificate
```
PowerShell

Common questions

Is SecurityHealthSystray.exe safe, or could it be a virus?

The genuine file is in C:\Windows\System32 and is signed by Microsoft Windows. A program can borrow a familiar name, so check where your copy runs from and who signed it with the commands in “Check it yourself”. A file with this name anywhere else, or with another signer, deserves a closer look.

Can I end SecurityHealthSystray.exe?

Depends on what you use. It is a startup entry for an icon, not the antivirus. Microsoft documents a policy that hides the Windows Security notification area control, so hiding the icon is a supported choice; the protection comes from the Defender and Windows Security services, which run separately. On the PC used for this page its startup entry had been switched off, so the icon process was not running, while SecurityHealthService.exe was.

Why is SecurityHealthSystray.exe in my startup programs?

Windows puts it there. On Windows 11 build 26300 the machine-wide Run key, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, has a value named SecurityHealth that points to C:\Windows\System32\SecurityHealthSystray.exe. An entry with that name pointing anywhere else deserves a closer look.

How do I hide the Windows Security icon?

Microsoft documents the policy Hide Windows Security notification area control (HideWindowsSecurityNotificationAreaControl): when it is enabled the icon is hidden, and you have to sign out and in again, or restart, for it to take effect. It hides the icon; it is not a switch for Microsoft Defender Antivirus.