Microsoft Security Events Component Minifilter (MsSecFlt) Service Defaults in Windows 11
Microsoft Security Events Component File System Filter Driver.
The Microsoft Security Events Component Minifilter service does not exist in:
- Windows 11 Home 21H2
- Windows 11 Home 22H2
- Windows 11 Home 23H2
- Windows 11 Home 24H2
Default Settings
| Startup type: |
| ||||||||||||||||||||||||
| Display name: | Microsoft Security Events Component Minifilter | ||||||||||||||||||||||||
| Service name: | MsSecFlt | ||||||||||||||||||||||||
| Service type: | kernel | ||||||||||||||||||||||||
| Error control: | normal | ||||||||||||||||||||||||
| Group: | Filter | ||||||||||||||||||||||||
| Path: | %SystemRoot%\system32\drivers\mssecflt.sys | ||||||||||||||||||||||||
| Registry key: | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsSecFlt |
Default Behavior
Microsoft Security Events Component Minifilter is a kernel driver. It does not exist in Windows 11 Home 21H2, Windows 11 Home 22H2, Windows 11 Home 23H2, Windows 11 Home 24H2. This service starts by the operating system Boot Loader before the Kernel initialization, as a part of the driver stack in Windows 11 Pro 21H2, Windows 11 Education 21H2, Windows 11 Enterprise 21H2, Windows 11 Pro 22H2, Windows 11 Education 22H2, Windows 11 Enterprise 22H2. This service starts only if the user, an application or another service starts it in Windows 11 Pro 23H2, Windows 11 Education 23H2, Windows 11 Enterprise 23H2, Windows 11 Pro 24H2, Windows 11 Education 24H2, Windows 11 Enterprise 24H2.
If Microsoft Security Events Component Minifilter fails to start, the failure details will be recorded into Event Log. Then Windows 11 should boot up and notify the user about the MsSecFlt service startup failure.
Dependencies
Microsoft Security Events Component Minifilter cannot be started, if the FltMgr service won't start.
Restore Default Startup Configuration of Microsoft Security Events Component Minifilter
Before you begin doing this, make sure that all the services on which Microsoft Security Events Component Minifilter depends are configured by default and function properly. See the list of dependencies above.1. Run the Command Prompt as an administrator.
2. Depending on the version of your operating system, copy the commands below, paste them into the command window and press ENTER.
For Windows 11 21H2 Pro, Windows 11 21H2 Education, Windows 11 21H2 Enterprise, Windows 11 22H2 Pro, Windows 11 22H2 Education, Windows 11 22H2 Enterprise:
sc config MsSecFlt start= boot
sc start MsSecFlt
For Windows 11 23H2 Pro, Windows 11 23H2 Education, Windows 11 23H2 Enterprise, Windows 11 24H2 Pro, Windows 11 24H2 Education, Windows 11 24H2 Enterprise:
sc config MsSecFlt start= demand
3. Close the command window and restart the computer.
The MsSecFlt service is using the mssecflt.sys file that is located in the C:\Windows\system32\drivers directory. If the file is removed or corrupted, read this article to restore its original version from Windows 11 installation media.