Microsoft introduced the Runtime Broker process (RuntimeBroker.exe) in Windows 8, and kept on using it in Windows 10 as well.
Runtime Broker is a legitimate Windows process, but one with quite a bad reputation for increasing CPU load and memory usage on systems sporadically.
If you monitor the Windows Task Manager, by loading it with Ctrl-Shift-Esc for instance, or if you use a more advanced process monitor like Process Explorer, you may have noticed already that Runtime Broker is not active all the time.
If you watch more closely, you may notice that it is linked somehow to Universal Windows Apps (those installed from Windows Store, that came with the operating system, and sideloaded apps).
The following guide offers information on the process, and tips on how to resolve the high CPU load that it causes sometimes.
You will find Runtime Broker listed under processes, and under details when you open the Windows Task Manager on Windows 10.
Note that the Windows 10 Task Manager separates processes into apps and background processes. Depending on the status of Runtime Broker, you may find it listed under either one there. For a clearer picture, switch to details and locate it there.
Since Runtime Broker is linked to Universal Windows Apps, you will notice that it becomes active whenever you start one of these applications on your device.
To provide you with a little bit more detail: The main task of Runtime Broker is to check if these applications have declared all the required permissions, and to inform you about it.
So, it acts as a security middleman between the app and your data and hardware on the device.
It may also use a lot of memory, especially if a faulty app is the root cause of the issue:
Runtime Broker is a Windows process in Task Manager that helps manage permissions on your PC for apps from Windows Store. It should only use a few megabytes of memory, but in some cases, a faulty app might cause Runtime Broker to use up to a gigabyte of RAM or more.
Quick temporary Fix
Microsoft suggests to kill the Runtime Broker Process if it uses more than 15% of memory.
If your RAM use is high and your PC is running slowly, an app may be the cause of the problem. Press Ctrl+Shift+Esc to open Task Manager and then, on the Processes tab, check to see how much memory Runtime Broker is using. If it’s using more than 15% of your memory, you probably have an issue with an app on your PC. To stop Runtime Broker from using so much memory, select Runtime Broker in the list, select End task to close Runtime Broker, and then restart your computer.
This is only a temporary solution, as Runtime Broker will launch again the next time a Universal Windows Application is started.
Any feature of Windows 10 that is powered by a Universal Windows Application, leads to the execution of the Runtime Broker process.
This explains why you may see the process thrashing the hard drive, causing high CPU load, or high memory usage, even though no Windows application was started at the time.
One common fix is to disable the application that is responsible for displaying tips and suggestions to Windows users.
If you notice that the high load, memory or disk use of Runtime Broker is caused by a particular application, you may do the following:
Some applications may run in the background. This means that they will continue to run even if they are not in the foreground.
You may control the behavior in the following way:
Toggle any application that you don't want to run in the background to off. This may remove functionality such as the application's ability to send notifications or stay up to date.
If you search the Internet for fixes for Runtime Broker issues, you will end up with dozens of suggestions on resolving the issue.
Basically, anything else that runs as an application may cause the issue.
Last but not least, you may also want to check whether Runtime Broker is a legitimate Windows process, or if it is a virus.
The easiest option to find out is to check if RuntimeBroker.exe is located in c:\windows\system32\.
This opens the location on the computer the process has been started from. Anything but c:\windows\system32\
If it is, go to Virustotal and upload the rogue file there to have it checked.Advertisement
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.