WINDOWS SERVICE
LanmanWorkstation: Workstation
Creates and maintains client network connections to remote servers using the SMB protocol: the side of Windows that opens shared folders and printers on other computers.
TECHNICAL SUMMARY
| Service name | LanmanWorkstation |
|---|---|
| Display name | Workstation |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k NetworkService -p |
| Runs as | NetworkService |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 11 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft states that if it is stopped these connections are unavailable, and that services which explicitly depend on it cannot start if it is disabled. Its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service LanmanWorkstation | Format-List Name, DisplayName, Status, StartType sc qc LanmanWorkstation
Common questions
What is the difference between LanmanWorkstation and LanmanServer?
Direction. LanmanWorkstation, shown as Workstation, is the client: Microsoft describes it as creating and maintaining connections to remote servers over SMB. LanmanServer, shown as Server, is the sharing side: it supports file, print and named-pipe sharing over the network for this computer.
What does the LanmanWorkstation service do?
Creates and maintains client network connections to remote servers using the SMB protocol: the side of Windows that opens shared folders and printers on other computers. It runs C:\Windows\System32\svchost.exe (svchost.exe -k NetworkService -p) as NetworkService.
Can I disable LanmanWorkstation?
Leave it alone. Microsoft states that if it is stopped these connections are unavailable, and that services which explicitly depend on it cannot start if it is disabled. Its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable.
How do I check that it is the real service?
On Windows 11 build 26300 it ran in its own svchost.exe -k NetworkService -p process as NetworkService and loaded C:\Windows\System32\wkssvc.dll, signed by Microsoft Windows. Netlogon and SessionEnv depend on it.