WINDOWS SERVICE
KeyIso: CNG Key Isolation
Hosted in the LSA process, it provides key process isolation to private keys and associated cryptographic operations, and stores and uses long-lived keys in a secure process.
TECHNICAL SUMMARY
| Service name | KeyIso |
|---|---|
| Display name | CNG Key Isolation |
| Runs from | C:\Windows\System32\lsass.exe |
| Command line | lsass.exe |
| Runs as | LocalSystem |
| Signed by | Microsoft Windows |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft's guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Other services need it: on the PC used for this page Wired AutoConfig (dot3svc), the Extensible Authentication Protocol service (EapHost) and Xbox Live Networking Service listed it as a dependency, and it was running.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service KeyIso | Format-List Name, DisplayName, Status, StartType sc qc KeyIso
Common questions
What does the KeyIso service do?
Hosted in the LSA process, it provides key process isolation to private keys and associated cryptographic operations, and stores and uses long-lived keys in a secure process. It runs C:\Windows\System32\lsass.exe (lsass.exe) as LocalSystem.
Can I disable KeyIso?
Leave it alone. Microsoft's guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Other services need it: on the PC used for this page Wired AutoConfig (dot3svc), the Extensible Authentication Protocol service (EapHost) and Xbox Live Networking Service listed it as a dependency, and it was running.
What depends on the CNG Key Isolation service?
On Windows 11 build 26300 three services listed KeyIso as a dependency: dot3svc (Wired AutoConfig), EapHost (Extensible Authentication Protocol) and XboxNetApiSvc. Microsoft notes for services in general that those which explicitly depend on a disabled service cannot start. Get-Service KeyIso -DependentServices lists them on your PC.
How do I check that it is the real service?
On build 26300 the service's command line is C:\Windows\system32\lsass.exe, matching Microsoft's statement that it is hosted in the LSA process, and it loads C:\Windows\system32\keyiso.dll, signed by Microsoft Windows. It is Manual with a trigger registered, and depends on RpcSs.