WINDOWS SERVICE
TokenBroker: Web Account Manager
Microsoft describes it as the service Web Account Manager uses to provide single sign-on to apps and services.
TECHNICAL SUMMARY
| Service name | TokenBroker |
|---|---|
| Display name | Web Account Manager |
| Runs from | C:\Windows\System32\svchost.exe |
| Command line | svchost.exe -k netsvcs -p |
| Runs as | LocalSystem |
| Verdict | Depends on what you use |
Paths, signer and service account observed on Windows 11 build 26300 on 11 November 2026. Run the commands below to check your own PC.
Should you touch it?
Depends on what you useMicrosoft lists its default startup type as Manual and, in its guidance for fixed-purpose Windows 10 and 11 IoT Enterprise devices, rates it OK to disable. On a PC where you sign in to apps with a Microsoft, work or school account, single sign-on is exactly what it provides, so leave it. On the PC used for this page it was set to Manual and running.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service TokenBroker | Format-List Name, DisplayName, Status, StartType sc qc TokenBrokerLet it start only when needed (administrator)
Note the START_TYPE that sc qc printed first, so you can put it back.
cmdsc config TokenBroker start= demandPut it back
Use the start type you noted.
cmdsc config TokenBroker start= <auto|delayed-auto|demand>
Common questions
What does the TokenBroker service do?
Microsoft describes it as the service Web Account Manager uses to provide single sign-on to apps and services. It runs C:\Windows\System32\svchost.exe (svchost.exe -k netsvcs -p) as LocalSystem.
Can I disable TokenBroker?
Depends on what you use. Microsoft lists its default startup type as Manual and, in its guidance for fixed-purpose Windows 10 and 11 IoT Enterprise devices, rates it OK to disable. On a PC where you sign in to apps with a Microsoft, work or school account, single sign-on is exactly what it provides, so leave it. On the PC used for this page it was set to Manual and running.
Are TokenBroker and Web Account Manager the same thing?
Yes: TokenBroker is the service name and Web Account Manager is the display name in Microsoft's list of Windows services. Get-Service TokenBroker shows both on your PC.
How do I check that it is the real service?
On Windows 11 build 26300 it ran in its own svchost.exe -k netsvcs -p process as LocalSystem and loaded C:\Windows\System32\TokenBroker.dll, signed by Microsoft Windows. It depends on UserManager and BrokerInfrastructure.