WINDOWS SERVICE
NgcSvc: Microsoft Passport
Provides process isolation for the cryptographic keys Windows uses to authenticate to a user's identity providers.
TECHNICAL SUMMARY
| Service name | NgcSvc |
|---|---|
| Display name | Microsoft Passport |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k LocalSystemNetworkRestricted -p |
| Runs as | LocalSystem |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | OK to disable (needed to sign in with PIN and Windows Hello, which Windows Server doesn't support) |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft notes that it is needed to sign in with a PIN and Windows Hello, and that with it disabled these keys cannot be used or managed, which includes signing in to the machine and single sign-on for apps and websites. Its two lists rate it OK to disable for servers and fixed-purpose devices, and both add that reconfiguring it is not recommended. On the PC used for this page it was Manual and running.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service NgcSvc | Format-List Name, DisplayName, Status, StartType sc qc NgcSvc
Common questions
What does the NgcSvc service do?
Provides process isolation for the cryptographic keys Windows uses to authenticate to a user's identity providers. It runs C:\Windows\System32\svchost.exe (svchost.exe -k LocalSystemNetworkRestricted -p) as LocalSystem.
Can I disable NgcSvc?
Leave it alone. Microsoft notes that it is needed to sign in with a PIN and Windows Hello, and that with it disabled these keys cannot be used or managed, which includes signing in to the machine and single sign-on for apps and websites. Its two lists rate it OK to disable for servers and fixed-purpose devices, and both add that reconfiguring it is not recommended. On the PC used for this page it was Manual and running.
I sign in with a password. Is NgcSvc still needed?
Microsoft's advice is not to reconfigure it. The service is Manual and, in Microsoft's words, starts and stops automatically, so it does not need to be disabled to stay out of the way. Disabling it makes the keys it isolates unavailable, and Microsoft lists signing in to the machine and single sign-on for apps and websites among the uses that depend on them.
How do I check that it is the real service?
On Windows 11 build 26300 it is registered as svchost.exe -k LocalSystemNetworkRestricted -p, runs as LocalSystem and loads C:\Windows\system32\ngcsvc.dll, signed by Microsoft Windows. It depends on RpcSs and has a trigger registered. sc qc NgcSvc prints the same on your PC.