WINDOWS SERVICE
Netlogon: Netlogon
Maintains a secure channel between this computer and the domain controller for authenticating users and services.
TECHNICAL SUMMARY
| Service name | Netlogon |
|---|---|
| Display name | Netlogon |
| Runs from | C:\Windows\System32\lsass.exe |
| Command line | lsass.exe |
| Runs as | LocalSystem |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 9 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneOn a PC joined to a domain, Microsoft says stopping it may prevent users and services from being authenticated, and services that depend on it cannot start when it is disabled. Unlike most services it runs inside lsass.exe, so it does not appear under svchost.exe.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service Netlogon | Format-List Name, DisplayName, Status, StartType sc qc Netlogon
Common questions
What does the Netlogon service do?
Maintains a secure channel between this computer and the domain controller for authenticating users and services. It runs C:\Windows\System32\lsass.exe (lsass.exe) as LocalSystem.
Can I disable Netlogon?
Leave it alone. On a PC joined to a domain, Microsoft says stopping it may prevent users and services from being authenticated, and services that depend on it cannot start when it is disabled. Unlike most services it runs inside lsass.exe, so it does not appear under svchost.exe.