WINDOWS SERVICE
VaultSvc: Credential Manager
Provides secure storage and retrieval of credentials to users, applications and security service packages.
TECHNICAL SUMMARY
| Service name | VaultSvc |
|---|---|
| Display name | Credential Manager |
| Runs from | C:\Windows\System32\lsass.exe |
| Command line | lsass.exe |
| Runs as | LocalSystem |
| Signed by | Microsoft Windows |
| Verdict | Leave it alone |
| Microsoft, Windows Server 2016 guidance | No guidance |
Paths, signer and service account observed on Windows 11 build 26300 on 12 November 2026. Run the commands below to check your own PC.
Should you touch it?
Leave it aloneMicrosoft's guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable: the credentials that users and applications store and retrieve go through it. Its default startup type is Manual. On the PC used for this page it was running inside lsass.exe.
What PC Tweaker does with it
PC Tweaker does not change this service. No control in the catalogue stops it, disables it or edits its start type.
Check it yourself
See its state and start type
PowerShellGet-Service VaultSvc | Format-List Name, DisplayName, Status, StartType sc qc VaultSvc
Common questions
What does the VaultSvc service do?
Provides secure storage and retrieval of credentials to users, applications and security service packages. It runs C:\Windows\System32\lsass.exe (lsass.exe) as LocalSystem.
Can I disable VaultSvc?
Leave it alone. Microsoft's guidance for Windows 10 and 11 IoT Enterprise rates it Don't disable: the credentials that users and applications store and retrieve go through it. Its default startup type is Manual. On the PC used for this page it was running inside lsass.exe.
VaultSvc is not running. Is that a fault?
Not necessarily: Microsoft lists its default startup type as Manual. Check that it has not been disabled with Get-Service VaultSvc | Select-Object Status, StartType. cmdkey /list, from the command Microsoft documents for creating, listing and deleting stored user names and passwords, shows what is stored.
Why does VaultSvc run inside lsass.exe?
That is how Windows registers it. On Windows 11 build 26300 the service's command line is C:\Windows\system32\lsass.exe and it loads C:\Windows\System32\vaultsvc.dll, signed by Microsoft Windows. The same lsass.exe process hosted KeyIso (CNG Key Isolation) and SamSs (Security Accounts Manager). It depends on RpcSs.