Showing results for 
Show  only  | Search instead for 
Did you mean: 

Excessive Winlogon Activity

I have a problem with excessive winlogon.exe activity on my PC. It started a few months ago and plenty of other people seem to be complaining of the same thing.

For example last night I ran MalwareBytes' Anti-Malware program and it took 15 hours to scan 105,000 files and it still wasn't finished. When I turned McAfee real time scanning off (after disabling web access as a security precaution) it scanned 250,000 files in less than an hour. MalwareBytes didn't flag any problems and a virus scan of the laptop is totally clean.

Looking at windows task manager reveals winlogon.exe activity is oscillating between ~2% and 60% on an almost regular basis.  During peak periods the PC is almost unresponsive.

What is going on with McAfee and how can I regain normal operating functionality of my PC?

Details of my PC:

     Windows XP SP3    

     McAfee Internet Security 11.0.578, Virus Scan 15.0.291

16 Replies

Re: Excessive Winlogon Activity

..what no response to this problem even after 48Hours.....

Is this a suitable strategy for handling difficult problems caused by the anti-virus program? No wonder so many people are complaining about the issue.

I am beginning to agree with the sentiments expressed in the following thread, it  reveals a lot about the company attitude

I'm really tired of the issues - McAfee you lost a longtime customer

Link is here: 

Come on McAfee prove that you can support customers on this issue.

Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 17

Re: Excessive Winlogon Activity

I see you're running with Internet Security 11 on an XP machine. From all that I've seen I don't think that version sits well with XP. If it were possible, I would suggest you switch back to version 10, which I still have and which seems (overall) to give fewer problems, and see if makes a difference.

As to why Internet Security v11 is so unfriendly to XP, I don't know. It may be that with Microsoft's push to kill XP and get users onto Windows 7 (or 8) the developers aren't making too much of an effort to make the product XP-compatible, but it's more likely that it's just been optimised for the PC architecture that is required for Win7. There is a big difference between the two in terms of system requirements - if you want to see just how much, download the Windows 7 update check from Microsoft and let it scan your system. It looked at mine and basically said it's not compatible because of the underlying Intel architecture. Go onto the Intel site and browse around among the chipset specifications, and you'll see that many of the older chipsets won't be supported for Win7, let alone 8.

It may be that making the product efficient for Win7/8 makes it inherently inefficient on XP :(

As for your complaint about not getting a reply from a McAfee person, these forums are - according to the online forum guides - customer self-help spaces. The official support channels are elsewhere. If you get help from the mods, that's not the same as official McAfee support. McAfee people keep an eye on the forums - they need to know what's going on - but they're not necessarily going to answer each and every question.

Now, back to the original question about winlogon - this is something I don't get with XP and Internet Security 10, so I can't go check it. (My problems are with mcshield, and I'm still running various tests looking for ways to minimise disruption caused by CPU spiking. They might help in cases like this, and if they do I'll pass on anything I find). But system specs could be relevant. So :

How much RAM have you got and what's your processor type and speed?

Have you got multi-threading?

Is your system 32 bit or 64?

What size is your page file?

That should give an indication of how well McAfee AV should run. The rest maybe is down to optimisation.

And the winlogon problem may have little or nothing to do with McAfee anyway. I've been on the Microsoft forums, and it seems that winlogon.exe high CPU problems began (or, rather, re-started) with a Microsoft update that went out at the beginning of July. (See this Microsoft thread, which hasn't been answered). When you Google for the problem ...

winlogon -high cpu- usage xp sp3 - Google Search.png

Message was edited by: Hayton on 09/09/11 15:50:48 IST

Re: Excessive Winlogon Activity

Re Malwarebytes is that the paid /registered version that clashes with Mcafee as both have real time scanning.

on 11/09/11 6:40:12 AM

Re: Excessive Winlogon Activity

You might want to check out the following thread:

I've experienced increased activity with winlogon.exe that's associated with System File Check/Windows File Protection due to some issues with the 11.0 version of McAfee. I'd check your Event Viewer for any warnings just before shutdown. You said you have XP SP3 and the correct version of McAfee (11.0) to make me suspect your winlogon.exe activity is a symptom of the McAfee issue.

Winlogon.exe + Mcshield.exe picks up for me whenever MalwareBytes Anti-Malware is scanning on the session following a McAfee update that requires a restart. In addition, winlogon.exe is active following these restart updates from McAfee in the first 5 minutes that XP SP3 starts. If you happen to run Process Explorer and look at the threads running under winlogon.exe, you'll see sfc_os.dll is causing the activity. This is System File Checker/Windows File Protection. We're still waiting on what's causing McAfee to trigger the WFP warnings, but I suspect winlogon.exe is tied to this. I haven't had much luck in confirmation of the winlogon.exe activity from anyone else though sadly.

Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 17

Re: Excessive Winlogon Activity

This doesn't answer anything, but it does confirm the link between winlogon.exe and SFC/WFP issues. It's a copy of a McAfee blog that hasn't been archived, from 2007. See the article ("WFP Hack Redefined") HERE.

In it is the throwaway line

sfc_os.dll is used by winlogon process to achieve this protection.

It's just a bit of background reading, but it also confirms what Microsoft say, that WFP has been targeted by malware.

If I find anything else relevant to these threads I'll pass it on.

Re: Excessive Winlogon Activity

Thanks to those who replied to my original post, it makes interesting but disappointing reading.

At least I've now got a better idea of what is going on, not that I feel anyone is going to produce a viable solution soon. Junking a £1000 XP laptop because a £22 piece of software doesn't like the operating system makes no sense.

One of the symptoms I see with this problem is web pages like this taking >4mins to load (hotmail is similar), even viewing/composing forum messages is a frustrating & arduous task. I'll monitor things as suggested.

Level 7
Report Inappropriate Content
Message 8 of 17

Re: Excessive Winlogon Activity

I, too have experienced excessive winlogon.exe memory usage in Task Manager within the past 10 days. After 24 hours of booting up winlogon.exe will quickly expand to around 1.3 gb. Yes, I've run various anti-spyware software, virus scans (by Norton, too), have checked the registry entry, have verified the file is only under system32, etc. etc.

This link also finds users pointing the finger of blame squarely at a McAfee upgrade - <>.


Level 16
Report Inappropriate Content
Message 9 of 17

Re: Excessive Winlogon Activity

As we know Winlogon is that  Microsoft component used in Windows operating systems responsible for handling  loading the user profile on logon, and optionally locking the computer when a screen saver is running etc. Moreover , Im just curios to know if we could overcome this with the  existence of only one antivirus software that is loaded in the OS.

scottyboy235/jrbarrie1  can you try to uninstall the other antivirus software from the PC and let us know if you still experience this issue , provided please get back if you did already try this step !

Level 7
Report Inappropriate Content
Message 10 of 17

Re: Excessive Winlogon Activity

Hi Dinesh,

Thank you for your prompt reply. Five hours ago I disengaged my McAfee Real Time Scanning, and activated AVG Anti-Virus. Winlogon.exe in Task Manager has not exceeded 15 mb. It has not increased dramatically as it has been doing recently. My preliminary conclusion is that it's an incompatibility in a recent McAfee software upgrade. I never had this problem prior to the last 10 days. It disappears when I disengage McAfee. What else can I conclude?

Please troubleshoot what is causing this error and remedy it. Thank you in advance.

How Many Badges Can You Collect?
Ready for a little competition? Members like you are earning badges and unlocking perks for their helpful answers. Are you? Click here to find out.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community