Microsoft Security Events Component Minifilter (MsSecFlt) Service Defaults in Windows 10

Microsoft Security Events Component File System Filter Driver.

Default Settings

Startup type:
Windows 10 Home 1507N/A
Windows 10 Pro 1507N/A
Windows 10 Education 1507N/A
Windows 10 Enterprise 1507N/A
Windows 10 Home 1511N/A
Windows 10 Pro 1511N/A
Windows 10 Education 1511N/A
Windows 10 Enterprise 1511N/A
Windows 10 Home 1607N/A
Windows 10 Pro 1607Manual
Windows 10 Education 1607Manual
Windows 10 Enterprise 1607Manual
Windows 10 Home 1703N/A
Windows 10 Pro 1703Manual
Windows 10 Education 1703Manual
Windows 10 Enterprise 1703Manual
Windows 10 Home 1709N/A
Windows 10 Pro 1709Boot
Windows 10 Education 1709Boot
Windows 10 Enterprise 1709Boot
Windows 10 Home 1803N/A
Windows 10 Pro 1803Boot
Windows 10 Education 1803Boot
Windows 10 Enterprise 1803Boot
Display name:Microsoft Security Events Component Minifilter
Service name:MsSecFlt
Service type:kernel
Error control:normal
Registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsSecFlt

Default Behavior

Microsoft Security Events Component Minifilter is a kernel device driver. It does not exist in Windows 10 Home 1607, Windows 10 Home 1703, Windows 10 Home 1709, 1803 Home. This service is starting only if the user, an application or another service starts it in Windows 10 Pro 1607, Windows 10 Education 1607, Windows 10 Enterprise 1607, Windows 10 Pro 1703, Windows 10 Education 1703, Windows 10 Enterprise 1703. This service is starting by the operating system Boot Loader as a part of the driver stack for the boot volume in Windows 10 Pro 1709, Windows 10 Education 1709, Windows 10 Enterprise 1709, 1803 Pro, 1803 Education, 1803 Enterprise. If Microsoft Security Events Component Minifilter fails to start, the failure details are being recorded into Event Log. Then Windows 10 will start up and notify the user that the MsSecFlt service has failed to start due to the error.


Microsoft Security Events Component Minifilter cannot be started under any conditions, if the FltMgr service is disabled.

Restore Default Startup Configuration for Microsoft Security Events Component Minifilter

Before you begin doing this, make sure that all the services on which Microsoft Security Events Component Minifilter depends are configured by default and function properly. See the list of dependencies above.

1. Run the Command Prompt as an administrator.

2. Depending on the version of your operating system, copy the commands below, paste them into the command window and press ENTER.

For Windows 10 1607 Pro, Windows 10 1607 Education, Windows 10 1607 Enterprise, Windows 10 1703 Pro, Windows 10 1703 Education, Windows 10 1703 Enterprise:
sc config MsSecFlt start= demand

For Windows 10 1709 Pro, Windows 10 1709 Education, Windows 10 1709 Enterprise, Windows 10 1803 Pro, Windows 10 1803 Education, Windows 10 1803 Enterprise:
sc config MsSecFlt start= boot
sc start MsSecFlt

3. Close the command window and restart the computer.

The MsSecFlt service is using the mssecflt.sys file that is located in the %WinDir%\system32\drivers folder. If the file is changed, damaged or deleted, you can restore its original version from Windows 10 installation media.