# Why Runtime Broker Uses High CPU or Memory on Windows

Runtime Broker is a normal Windows process, `RuntimeBroker.exe`, that sits between Store-style apps and the parts of Windows they ask to use, such as location or the microphone. It usually idles with little CPU and a modest amount of memory. When it uses a lot of either, the cause is nearly always one packaged app that keeps asking it for something, so the fix is to find that app. Ending Runtime Broker only buys a few minutes.

## What it looks like on a healthy PC

Microsoft says little about this process in public, so here is what a Windows 11 PC actually shows. A test ThinkPad had three copies running, and every one looked like this:

```text
C:\Windows\System32\RuntimeBroker.exe -Embedding
Started by: C:\Windows\system32\svchost.exe -k DcomLaunch -p
```

Several copies are normal, because apps get their own. Yours may differ in number, but the path and the parent should match. List yours with:

```powershell
Get-CimInstance Win32_Process | Where-Object Name -eq 'RuntimeBroker.exe' | Select-Object ProcessId, ExecutablePath, CommandLine
```

## Find the app behind it

Windows has no column that names the app behind each copy, so narrowing it down is the practical way:

1. Open Task Manager with `Ctrl + Shift + Esc` and sort **Processes** by **CPU** or **Memory**.
2. Close packaged apps one at a time, the likes of Photos, Your Phone, Widgets, Teams, Mail or anything from the Microsoft Store, and watch whether the number falls within a minute.
3. If the number falls, update that app, or reset it in **Settings › Apps › Installed apps › (the app) › Advanced options**. **Terminate** on the same page stops its background processes.
4. If nothing changes, restart and watch which app was open when the number climbs again.

In the same **Advanced options** page, **Background apps permissions** can be set to **Never** for an app you do not need running in the background, where the option is offered.

| You see | What it usually means | Try |
| --- | --- | --- |
| A few percent CPU for a moment after opening an app | Normal permission checks | Nothing |
| Sustained CPU while one app is open | That app is asking repeatedly | Update, reset or remove it |
| Memory climbing for hours, into the gigabytes | A leak in a copy or an app it serves | End that copy, then find the app as above |
| Spikes with no app open | Widgets, the Start menu or tips | See below |

## A setting people often point to

Many reports tie Runtime Broker CPU to Windows tips. If nothing above helped, turn off **Settings › System › Notifications › Additional settings › Get tips and suggestions when using Windows**. Microsoft does not document this link, and it is a common report rather than a proven cause. It costs nothing to try, and you can tell within a day whether it helped.

## Is it a virus

The real file is in `C:\Windows\System32` and is signed by Microsoft. A copy that runs from anywhere else, a name that is slightly off, or a copy started by something other than `svchost.exe` deserves a scan with Microsoft Defender. Check the path with the PowerShell line above.

## What not to do

- Do not delete `RuntimeBroker.exe` or take its ownership to block it. Apps that rely on it will fail, and Windows treats the missing file as damage.
- Do not disable it through registry edits from forum posts. Store apps need it, and you lose the symptom without finding the app.
- Do not end it over and over. Ending a copy is safe enough, though the app it served may misbehave or close, and Windows starts another when one is needed.
- Do not install a "RAM cleaner" because of it. Those tools push memory out to disk for a moment, and that adds disk work.

## Where Mole fits

Mole for Windows' Status page folds Runtime Broker into one row per session, so you can watch the combined CPU and memory while you close apps. **Why is this running?** in the row's menu lists the heaviest copies as they were when you opened it, so reopen it to compare, and it shows the **Executable** and what started it, which is a quick check of the path and parent described above. Because Runtime Broker runs from the Windows folder, Mole marks it as System and offers no **Terminate** or **Force Quit**. Mole does not manage app permissions or tips. For the broader problem, see [high CPU usage on Windows](/windows/blog/windows-high-cpu-usage), [high memory usage on Windows](/windows/blog/windows-high-memory-usage) and [the Store's own process, wsappx](/windows/blog/wsappx-high-cpu-windows).

## FAQ

### What is Runtime Broker?

It is a Windows process that runs on behalf of packaged apps, such as those from the Microsoft Store, and it handles their requests for things like location and the microphone. The file is `C:\Windows\System32\RuntimeBroker.exe`.

### Why is Runtime Broker using so much memory?

Usually an app it serves keeps asking for something, or memory has leaked in a copy that has run for a long time. Ending that copy is safe enough for a quick test. If it climbs again, close packaged apps one at a time to find which one drives it.

### Can I end Runtime Broker?

Yes for a single stuck copy, but the app it serves may close or misbehave, and Windows starts a new copy when needed. It is a test rather than a fix.

### Can I disable Runtime Broker?

Do not. Store apps need it, and the registry edits that claim to do this leave you with a broken app and the original cause still in place.

### Why are there multiple Runtime Broker processes?

Different apps get their own copy, so several at once is normal. Three were running on an idle test laptop when this page was checked.


Canonical: https://mole.fit/windows/blog/runtime-broker-high-cpu-memory