WINDOWS SERVICE
NgcCtnrSvc: Microsoft Passport Container
Manages local user identity keys used to authenticate the user to identity providers, and TPM virtual smart cards.
TECHNICAL SUMMARY
| Service name | NgcCtnrSvc |
|---|---|
| Display name | Microsoft Passport Container |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k LocalServiceNetworkRestricted -p |
| Runs as | LocalService |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | OK to disable |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft states that if it is disabled, local user identity keys and TPM virtual smart cards cannot be accessed, and that reconfiguring it is not recommended. Its two lists rate it OK to disable for servers and fixed-purpose devices. Its default startup type is Manual: on the PC used for this page it was running.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service NgcCtnrSvc | Format-List Name, DisplayName, Status, StartType sc qc NgcCtnrSvc
Common questions
What does the NgcCtnrSvc service do?
Manages local user identity keys used to authenticate the user to identity providers, and TPM virtual smart cards. It runs C:\Windows\System32\svchost.exe (svchost.exe -k LocalServiceNetworkRestricted -p) as LocalService.
Can I disable NgcCtnrSvc?
Leave it alone. Microsoft states that if it is disabled, local user identity keys and TPM virtual smart cards cannot be accessed, and that reconfiguring it is not recommended. Its two lists rate it OK to disable for servers and fixed-purpose devices. Its default startup type is Manual: on the PC used for this page it was running.
How is NgcCtnrSvc different from NgcSvc?
They are two services with separate jobs in Microsoft's lists. NgcSvc (Microsoft Passport) provides process isolation for the cryptographic keys; NgcCtnrSvc (Microsoft Passport Container) manages the local user identity keys and TPM virtual smart cards. On Windows 11 build 26300 they also run under different accounts: NgcSvc as LocalSystem, NgcCtnrSvc as LocalService.
How do I check that it is the real service?
On build 26300 it is registered as svchost.exe -k LocalServiceNetworkRestricted -p, runs as LocalService and loads C:\Windows\System32\NgcCtnrSvc.dll, signed by Microsoft Windows. It depends on RpcSs and has a trigger registered. sc qc NgcCtnrSvc prints the same on your PC.