What is Runtime Broker, and why it is causing high CPU load?
Microsoft introduced the Runtime Broker process (RuntimeBroker.exe) in Windows 8, and kept on using it in Windows 10 as well.
Runtime Broker is a legitimate Windows process, but one with quite a bad reputation for increasing CPU load and memory usage on systems sporadically.
If you monitor the Windows Task Manager, by loading it with Ctrl-Shift-Esc for instance, or if you use a more advanced process monitor like Process Explorer, you may have noticed already that Runtime Broker is not active all the time.
If you watch more closely, you may notice that it is linked somehow to Universal Windows Apps (those installed from Windows Store, that came with the operating system, and sideloaded apps).
The following guide offers information on the process, and tips on how to resolve the high CPU load that it causes sometimes.
Runtime Broker information
You will find Runtime Broker listed under processes, and under details when you open the Windows Task Manager on Windows 10.
Note that the Windows 10 Task Manager separates processes into apps and background processes. Depending on the status of Runtime Broker, you may find it listed under either one there. For a clearer picture, switch to details and locate it there.
Since Runtime Broker is linked to Universal Windows Apps, you will notice that it becomes active whenever you start one of these applications on your device.
To provide you with a little bit more detail: The main task of Runtime Broker is to check if these applications have declared all the required permissions, and to inform you about it.
So, it acts as a security middleman between the app and your data and hardware on the device.
Runtime Broker causing high CPU load
Reports started to come up as early as 2015 that Runtime Broker was causing high CPU loads on Windows 10, and as early as 2012 that it was using a lot of memory on Windows 8.
It may also use a lot of memory, especially if a faulty app is the root cause of the issue:
Runtime Broker is a Windows process in Task Manager that helps manage permissions on your PC for apps from Windows Store. It should only use a few megabytes of memory, but in some cases, a faulty app might cause Runtime Broker to use up to a gigabyte of RAM or more.
Quick temporary Fix
Microsoft suggests to kill the Runtime Broker Process if it uses more than 15% of memory.
If your RAM use is high and your PC is running slowly, an app may be the cause of the problem. Press Ctrl+Shift+Esc to open Task Manager and then, on the Processes tab, check to see how much memory Runtime Broker is using. If it’s using more than 15% of your memory, you probably have an issue with an app on your PC. To stop Runtime Broker from using so much memory, select Runtime Broker in the list, select End task to close Runtime Broker, and then restart your computer.
- Use Ctrl-Shift-Esc to open the Task Manager.
- Right-click on Runtime Broker in the processes list.
- Select End Task from the context menu that opens up.
- Restart the PC.
This is only a temporary solution, as Runtime Broker will launch again the next time a Universal Windows Application is started.
Fix 2: Disable get tips, tricks and suggestions
Any feature of Windows 10 that is powered by a Universal Windows Application, leads to the execution of the Runtime Broker process.
This explains why you may see the process thrashing the hard drive, causing high CPU load, or high memory usage, even though no Windows application was started at the time.
One common fix is to disable the application that is responsible for displaying tips and suggestions to Windows users.
- Use Ctrl-I to open the Settings application on Windows 10.
- Switch to System > Notifications & Actions.
- Locate "Get tips, tricks, and suggestions as you use Windows", and switch the preference to off.
Fix 3: A misbehaving application
If you notice that the high load, memory or disk use of Runtime Broker is caused by a particular application, you may do the following:
- If the app is not essential, uninstall it and be done with the issue.
- If the app is essential, check for updates. If an update is available download and install it to see if it resolves the issue.
- If that is not the case, try uninstalling the app, and installing it again after a PC restart.
Fix 4: Limit the number of apps that can run in the background
Some applications may run in the background. This means that they will continue to run even if they are not in the foreground.
You may control the behavior in the following way:
- Use Windows-I to open the Settings application.
- Go to Privacy > Background Apps.
Toggle any application that you don't want to run in the background to off. This may remove functionality such as the application's ability to send notifications or stay up to date.
Other fixes
If you search the Internet for fixes for Runtime Broker issues, you will end up with dozens of suggestions on resolving the issue.
- Change the local screen background from using Windows Spotlight (which changes background images frequently) to Picture. You do so in the Settings application under Personalization > Lock Screen.
- Disable P2P update functionality under Settings > Update & Security > Advanced Options > Choose how updates are delivered. Turn the option to off there.
Basically, anything else that runs as an application may cause the issue.
Check if Runtime Broker is a virus
Last but not least, you may also want to check whether Runtime Broker is a legitimate Windows process, or if it is a virus.
The easiest option to find out is to check if RuntimeBroker.exe is located in c:\windows\system32\.
- Use Ctrl-Shift-Esc to open the Task Manager.
- Locate the Runtime Broker process there under processes.
- Right-click on the process, and select the "open file location" menu item.
This opens the location on the computer the process has been started from. Anything but c:\windows\system32\
If it is, go to Virustotal and upload the rogue file there to have it checked.
Similar like ShellExperienceHost, theoretically you can totally uninstall them with install_wim_tweak.exe. On Shell wifi and action center isn’t working anymore but if you know the consequences and what it brings then it’s worth, my system got more stable after removing both services packages.
Er, do not use crap like Windows 10?
I haven’t noticed any activity from that process, that is on LTSB2016 which has none of the crapps. My only issue with it is that it keeps “adopting” FireFox’s process for some reason. Instead of Explorer being FireFox’s parent process, it’s this RuntimeBroker. Which is weird, I did figure that this process has something to do with the Metro side of the OS. ProcessExplorer marks it as “immersive process”.
The good part: killing/suspending it does not affect FireFox or (almost) anything else, releasing Fx’s process from being its child process. Bad part is that if you manage to get rid of RuntimeBroker (blocking its execution or suspending it) you end up without jumplists in taskbat and context menu in Start. This is annoying, why did M$ broke functionality handeled by one process from 7 to 8.1 into two different processes in 10? It really makes no sense to me, and further shows signs of sloppy programming, which does indeed characterises this entire OS.
Nowhere to be seen on my system probably because I’m logged into the machine with a local account which more or less prevents downloading anything from the Windows store. There is actually a workaround to login to the store for single downloads even though the user may only be logged in locally, but I’ve never bothered with it.
What if the process can’t be killed?
“This opens the location on the computer the process has been started from. Anything but c:\windows\system32\
If it is, go to Virustotal and upload the rogue file there to have it checked.”
Now this is extremely unclear. Should it or should it not be in c:\windows\system32\? If it is in c:\windows\system32\ – does this mean that it’s fine or does it suggest that this might be a virus?
Artiom — it SHOULD be in c:\windows\system32\ . Anywhere else means you have a problem.
I’ve been using this laptop with Windows 8.1 for over 6 years –and I don’t use any “Store” apps nor have lockscreen notifications– and now for the first time, while on the Quora website using Brave browser, Runtime Broker has become active. It cranks up CPU and heat (my fan alerts me to its activity) and calms down shortly afterward. I had 8 instances of the process! So I ended the task and restarted Windows, and a single instance returned and is again intermittently active for a minute or so and then calms down.
Since this doesn’t seem related to Windows app, what else?
Re: Runtime Broker
I have occasionally had my computer begin to go crazy with CPU and memory usage with Windows 10. This becomes noticeable because I have a laptop with two fans, and two SSD’s. Most of the time the laptop is very quite because there is no sound of the HDD’s spinning and the fans are usually off, or running at slow speed. When this does happen you can hear the fans spinning at full speed, and by putting my had behind the laptop I can feel very hot air being blow out.
I decided to stop as many of the programs running in the background as possible. A big question of course is will stopping them running in the background cause problems. Well I decided to turn them all off except:
Alarm and Clock – I’m not sure if this would effect the clock on my taskbar which I like.
Connect – I’m clear on what it does so I left it.
Notification Manager For Adobe Creative Cloud – Want to keep CC running smoothly.
Windows Security – Seems necessary.
I hope I didn’t turn anything off that needs to be on.
I use the Calculator via a link to its location in System32, plus why run in the background?
Two things.
1. After doing this when I clicked on a link in Quora to another related article I got a blank page (Using Firefox 91.0.2 64 bit). But when I clicked refresh the page would then load fine. Maybe that will go away when I restart.
2. There are lots of sites that advise turning off all of the background apps. Some say “except the ones you might need” The only examples being Skype, Facebook, and Windows Security. But are there any others people can think of that need to be on? Oh, yeah, some people said Weather is nice to have on.
Do any of them really need to be on?