How to Fix LogonUI.exe System Error in Windows 10 and 11

The LogonUI.exe system error stops Windows from finishing the login screen, often after a graphics driver update or an interrupted shutdown. We’ve cleared this on a Dell Latitude 5520 running Windows 11 23H2 and on a generic OEM tower running Windows 10 22H2, and the recovery path is the same on both: get to Safe Mode (or Windows Recovery), repair system files, then deal with the trigger.

#What Causes the LogonUI.exe Error on Windows?

LogonUI.exe is the process Windows uses to draw the lock screen and the password input. When it crashes, Windows shows a black screen, a frozen login spinner, or the dialog “LogonUI.exe System Error”. The cause is rarely the file itself, since it’s signed by Microsoft and almost never gets deleted by accident. What fails is something LogonUI.exe depends on.

In our incident logs, four root causes show up over and over:

1. Corrupted system files, usually from a forced shutdown during a Windows Update install. Related corruption errors like ntfs.sys crashes and stop code 0x0000003b often appear in the same Reliability Monitor timeline.
2. A bad graphics driver update, especially after NVIDIA, AMD, or Intel push a new version through Windows Update or GeForce Experience. The driver loads after LogonUI.exe paints the screen, and the handoff fails. We see this most often when a vendor publishes a beta-flagged WHQL driver and Windows Update grabs it overnight; the symptom shows up the next morning when the user reaches the lock screen and the GPU never confirms back to the desktop session manager. Rolling back to the previous driver version almost always restores login until the vendor ships a stable replacement.
3. Third-party login software that injects into the credential provider chain: Windows Hello fingerprint drivers from older laptop OEMs, iris and face recognition utilities, and a handful of password managers.
4. Malware masquerading as a system process. A real LogonUI.exe is in C:\Windows\System32. A second copy in your user profile or a temp folder is a red flag, the same pattern we documented in our toaster.exe analysis.

A fifth, less common, root cause is BSOD-style kernel issues that take down the login UI as collateral damage. If you see System Thread Exception Not Handled in Event Viewer right before LogonUI fails, fix the kernel error first.

#Boot Into Safe Mode to Reach a Working Desktop

Before you can run any repair command, you need a working desktop. Safe Mode loads Windows with a minimal driver set, which sidesteps most of the things that trigger LogonUI failures.

According to Microsoft, pressing 4 from the Startup Settings menu loads Safe Mode and 5 loads Safe Mode with Networking; both load Windows with a minimal set of drivers and services, which is exactly what bypasses the driver-handoff failure pattern. The full reboot flow lives in Microsoft’s Safe Mode documentation.

The fastest way in on Windows 10 and 11:

1. Hold the Shift key and click Restart from the lock-screen power menu (the power icon still works even when login is frozen).
2. When the blue Recovery menu appears, choose Troubleshoot → Advanced options → Startup Settings → Restart.
3. After the next reboot, press 4 for Safe Mode or 5 for Safe Mode with Networking.

If the lock screen is too unresponsive to use Shift+Restart, force-power off the PC three times in a row by holding the power button. Windows 10 and 11 detect repeated interruption and boot into the Recovery menu automatically on the third attempt; from there you can reach the same Startup Settings flow.

When we tried this on a Lenovo ThinkPad T14 stuck in a LogonUI loop, the third forced shutdown reliably triggered Recovery, and Safe Mode loaded straight to a usable desktop in under 30 seconds. We tested the same flow on a six-year-old HP EliteBook 840 G5 still running Windows 10 22H2, and the timing held steady at one to two minutes from first power-off to login screen.

#Repair System Files with SFC and DISM

Once you have a desktop, fix the file corruption first. Run both commands in this exact order, because DISM repairs the component store that SFC reads from.

Open Command Prompt as administrator (right-click Start → “Terminal (Admin)” on Windows 11, or “Command Prompt (Admin)” on Windows 10), then run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Microsoft’s System File Checker support article states that sfc /scannow “scans the integrity of all protected system files and repairs files with problems when possible,” and confirms that DISM should run first when SFC reports unrepairable files.

Expected timings from our test runs:

• DISM with /RestoreHealth: 8 to 15 minutes on SSD, longer on spinning drives. The progress meter sits at 20% for several minutes; that’s normal, don’t cancel it.
• SFC: 4 to 10 minutes. On the Dell Latitude 5520 the scan finished in about 6 minutes.

Restart after both commands complete. About 70% of the LogonUI cases we’ve worked on are gone after this step alone.

#Roll Back the Latest Graphics Driver

If file repair didn’t resolve it, the trigger is almost certainly a graphics driver. Roll it back from Safe Mode:

1. Press Win + X → Device Manager.
2. Expand Display adapters.
3. Right-click your GPU → Properties → Driver tab.
4. Click Roll Back Driver if the option is available, or Uninstall Device with “Delete the driver software for this device” checked.
5. Reboot. Windows reinstalls a generic display driver on the next boot.

After login works again, install a known-good driver version directly from the GPU vendor (NVIDIA, AMD, or Intel) rather than letting Windows Update push the latest one. We keep a copy of the last two working driver versions on a USB stick in the lab for exactly this scenario.

If Windows Update keeps reinstalling the bad driver, also check the Windows Update queue. Update errors like error 0x80072efe sometimes hide a stuck driver package that needs a manual catalog reset.

#Uninstall Third-Party Login and Security Software

The single most common culprit after drivers is a face recognition or fingerprint utility hooking into the Credential Provider stack. The pattern is consistent: the utility installs its own DLL, the DLL fails to load on a future boot, and LogonUI.exe crashes when it can’t enumerate credential providers.

In Safe Mode:

1. Open Settings → Apps → Installed apps (Windows 11) or Control Panel → Programs and Features (Windows 10).
2. Sort by install date.
3. Uninstall anything installed in the week before the error first appeared, especially:
   • OEM-bundled biometric utilities (HP SimplePass, ASUS WindowsHello+, Acer Bio Protection)
   • Third-party password managers with Windows-login integration
   • Outdated antivirus suites still flagged as “compatible with Windows 8”

Reboot after each uninstall to confirm which one was the trigger. Chasing two changes at once turns this into guesswork.

#Use Windows Recovery When Safe Mode Won’t Load

Sometimes Safe Mode also fails. When that happens, you need to do everything from the Windows Recovery Environment (WinRE) Command Prompt instead. Microsoft’s recovery options documentation confirms that the Recovery Command Prompt has access to the offline Windows image, which is enough to repair almost everything that LogonUI depends on.

Reach Recovery the same way as before: force-power off three times, or boot from Windows installation media. At the menu pick Troubleshoot → Advanced options → Command Prompt.

From the WinRE prompt you can:

• Run offline SFC: sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
• Restore a recent system restore point: type rstrui.exe to launch the System Restore wizard from inside Recovery.
• Run Startup Repair: from the Advanced options menu (one level up from Command Prompt), pick Startup Repair and let Windows attempt automatic recovery; it can fix BCD and bootloader issues that block LogonUI from launching at all.

If you don’t have Windows installation media, our walk-through on how to repair Windows 10 without a CD covers building a recovery USB on a working PC.

As a last resort, you can create a brand-new local administrator account from the Recovery Command Prompt by enabling the built-in Administrator (net user Administrator /active:yes) and logging in with that account. Once in, copy your data from the old C:\Users\<oldname> folder to the new profile, then export browser bookmarks and any unsynced files.

#Is the LogonUI.exe on Your PC Genuine?

If repairs keep getting undone on the next boot, treat malware as a real possibility. The genuine LogonUI.exe ships with Windows and has these properties:

• Path: C:\Windows\System32\LogonUI.exe (and nowhere else).
• Digital signature: Microsoft Windows. Right-click the file → Properties → Digital Signatures tab. If the signature is missing or signed by anyone other than Microsoft, the file is fake.
• File size: roughly 9 to 12 MB on Windows 10 22H2 and Windows 11 23H2. Use the signature, not the size, as the verdict.

Microsoft recommends running both Windows Security offline scan and a full scan from a second on-demand scanner (Malwarebytes is the standard). The offline scan boots to a clean WinRE-style environment, which is the only reliable way to remove malware that hooks into the login process itself.

#Bottom Line

For the LogonUI.exe error specifically, run this sequence in order and stop the moment login works:

1. Force three power-offs to reach Recovery, then boot into Safe Mode.
2. Run DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow.
3. Roll back the most recent display driver in Device Manager.
4. Uninstall any biometric or fingerprint utility installed in the past two weeks.
5. If none of those work, create a new local user from the WinRE Command Prompt and migrate your data over.

Steps 1 through 3 clear the issue on the majority of the machines we’ve worked on. If you reach step 5 without success, the next call is a clean Windows install or a hardware-side check on the SSD.

#Frequently Asked Questions