WINDOWS SERVICE
seclogon: Secondary Logon
Enables starting processes under alternate credentials.
TECHNICAL SUMMARY
| Service name | seclogon |
|---|---|
| Display name | Secondary Logon |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k netsvcs -p |
| Runs as | LocalSystem |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft states that if this service is stopped, that way of signing in is unavailable, and that services which explicitly depend on it cannot start if it is disabled; its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Its default startup type is Manual: on the PC used for this page it was stopped, so it uses nothing until you start a program with other credentials.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service seclogon | Format-List Name, DisplayName, Status, StartType sc qc seclogon
Common questions
What does the seclogon service do?
Enables starting processes under alternate credentials. It runs C:\Windows\System32\svchost.exe (svchost.exe -k netsvcs -p) as LocalSystem.
Can I disable seclogon?
Leave it alone. Microsoft states that if this service is stopped, that way of signing in is unavailable, and that services which explicitly depend on it cannot start if it is disabled; its guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable. Its default startup type is Manual: on the PC used for this page it was stopped, so it uses nothing until you start a program with other credentials.
What stops working if Secondary Logon is disabled?
Starting a process under alternate credentials, which is the one function Microsoft's description gives it. A stopped service is not the problem: Manual is its default. Disabled is the setting that blocks it.
How do I check that it is the real service?
On Windows 11 build 26300 it is registered as svchost.exe -k netsvcs -p, runs as LocalSystem and loads C:\Windows\system32\seclogon.dll, signed by Microsoft Windows. It has no dependencies. sc qc seclogon prints the same on your PC.