Microsoft Security Events Component Minifilter (MsSecFlt) Service Defaults in Windows 10

Microsoft Security Events Component File System Filter Driver.

Default Settings

Startup type:
Windows 10 Home 1507N/A
Windows 10 Pro 1507N/A
Windows 10 Education 1507N/A
Windows 10 Enterprise 1507N/A
Windows 10 Home 1511N/A
Windows 10 Pro 1511N/A
Windows 10 Education 1511N/A
Windows 10 Enterprise 1511N/A
Windows 10 Home 1607N/A
Windows 10 Pro 1607Manual
Windows 10 Education 1607Manual
Windows 10 Enterprise 1607Manual
Windows 10 Home 1703N/A
Windows 10 Pro 1703Manual
Windows 10 Education 1703Manual
Windows 10 Enterprise 1703Manual
Display name:Microsoft Security Events Component Minifilter
Service name:MsSecFlt
Service type:filesys
Error control:normal
Group:FSFilter Activity Monitor
Path:%SystemRoot%\system32\drivers\mssecflt.sys
Registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsSecFlt

Default Behavior

Microsoft Security Events Component Minifilter is a file system driver. In Windows 10 it is starting only if the user, an application or another service starts it. If Microsoft Security Events Component Minifilter fails to start, the failure details are being recorded into Event Log. Then Windows 10 will start up and notify the user that the MsSecFlt service has failed to start due to the error.

Dependencies

Microsoft Security Events Component Minifilter cannot be started under any conditions, if the FltMgr service is disabled.

Restore Default Startup Configuration for Microsoft Security Events Component Minifilter

1. Select your Windows 10 edition and release, and then click Download.

2. Save the Win10_MsSecFlt_Service_Startup.cmd file to a local storage device.

3. Run the saved file as an administrator.

4. Restart the computer.

The MsSecFlt service is using the mssecflt.sys file that is located in the %WinDir%\system32\drivers folder. If the file is changed, damaged or deleted, you can restore its original version from Windows 10 installation media.