What Is SysMain and Should You Disable It on Windows
SysMain is the Windows service that used to be called Superfetch. It watches which programs you use and keeps what they need ready in memory so that they open faster. In Task Manager it shows as Service Host: SysMain. Brief disk or CPU use after you sign in is normal. If it stays high for a long time you can stop it to test, and on a PC with a fast SSD you may notice little difference, but it is a test to run first and not a tweak that speeds up every PC.
What it is
The service runs inside svchost.exe. On a test ThinkPad with Windows 11 it looked like this:
Name: SysMain Status: Running StartType: Automatic
Path: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
Microsoft's services guide for Windows Server 2016 lists it under the name Superfetch, with the description "Maintains and improves system performance over time" and a recommendation of "No guidance". So that guide neither asks you to disable it nor warns against it, and it gives no support to the common claim that it should always be turned off.
Check whether it is really the cause
- Open Task Manager with
Ctrl + Shift + Esc, go to Processes and sort by Disk. - Expand Service Host: SysMain, or look it up with PowerShell:
Get-Service SysMain | Select-Object Status, StartType
Get-Process -Id (Get-CimInstance Win32_Service -Filter "Name='SysMain'").ProcessId | Select-Object Id, CPU, WorkingSet64
- Give it ten to fifteen minutes after startup or a large update, when this work is expected.
- Note what else is busy. On a nearly full drive or an old hard disk, a lot of things look like SysMain's fault, see 100% disk usage.
| You see | What it usually means | Try |
|---|---|---|
| Busy for a few minutes after sign-in | Normal preparation | Wait |
| Disk at 100% for a long time on a hard disk | The drive cannot keep up | Test with the service stopped, and consider an SSD |
| Busy all day on an SSD | Unusual, may be another cause | Restart, install updates, then test |
| Memory shows as Cached | Normal use of spare memory | Nothing, Windows releases it when it is needed |
| Lag in games or video work | Possibly something else | Test with the service stopped for a few days |
How to stop it, and how to undo it
Stop it first without changing the startup type. It comes back after a restart, which makes this the safe test. Run PowerShell as administrator:
Stop-Service SysMain
If that clearly helps, keep it off across restarts:
Set-Service SysMain -StartupType Disabled
Stop-Service SysMain
To undo:
Set-Service SysMain -StartupType Automatic
Start-Service SysMain
You can also do this in services.msc, where it is listed as SysMain. Use the PC for a few days. If apps open more slowly or the disk is no calmer, turn it back on.
What not to do
- Do not disable it because a list of tweaks said so. Without a measured symptom you have no way to know if it helped.
- Do not disable it as a fix for low memory. Cached memory is given back when something needs it, see high memory usage.
- Do not delete
C:\Windows\Prefetchto go with it. Windows rebuilds it, and the next launches are slower until it does. - Do not stop every Service Host you see. Each one hosts different services, and some keep the network and sound working.
Is it a virus
SysMain is a Windows service, not a separate program, and it runs inside the real svchost.exe in C:\Windows\System32. An svchost.exe running from another folder, or a file with a similar spelling, deserves a scan with Microsoft Defender.
Where Mole fits
Mole for Windows' Status page folds the service hosts in session 0 into one row. Why is this running? in the row's menu names the first two services, busiest copy first, and counts the rest, so SysMain may be hidden behind that count. It also lists the heaviest copies, and clicking one shows that copy's services. A single busy service is not separated out on its own, so use Task Manager to read SysMain's own numbers. Mole marks service hosts as System and offers no Terminate or Force Quit. Its startup list leaves out services hosted from the Windows folder, so SysMain does not appear there, and Mole has no switch for it. For wider background, see what common Windows processes do.
FAQ
What is SysMain?
It is the Windows service that used to be called Superfetch. It keeps data for the programs you use in memory, ready to go, so that they open faster.
Is it safe to disable SysMain?
Yes, it can be turned back on at any time and Windows keeps working. Apps may open a little slower, especially on a hard disk, so measure before and after.
Why is Service Host: SysMain using so much disk?
Brief use after startup is expected. Long periods at 100% are most common on a hard disk or a nearly full drive, where anything can look slow.
Should I disable SysMain on an SSD?
Only if you can measure a problem. There is no official advice to disable it on SSDs, and a healthy SSD rarely shows trouble from it.
Is SysMain the same as Superfetch?
Yes. Older guides use the name Superfetch. Windows now lists the service as SysMain.