# Windows Modules Installer Worker High CPU: Wait or Fix

Windows Modules Installer Worker high CPU usually means Windows is installing or cleaning up an update: `TiWorker.exe` is the worker that the Windows Modules Installer service (service name `TrustedInstaller`) starts to add, change and remove updates and optional components, and that work is CPU- and disk-heavy for a while after Patch Tuesday, a feature update or a new optional feature. In most cases the right move is to keep the PC plugged in, let it finish and restart when Windows asks.

It only becomes a problem when the same activity comes back after every restart, Windows Update shows no progress for hours, or updates keep failing. Then the fix is to repair the component store that the worker reads from, not to stop the worker. The sections below go through how to tell the two cases apart and what to run, in Microsoft's order.

## What TiWorker.exe and TrustedInstaller are

Microsoft's [service reference](https://learn.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server) lists Windows Modules Installer with the service name `TrustedInstaller` and describes it as the service that "enables installation, modification, and removal of Windows updates and optional components." Its startup type is Manual, which is why it is not running most of the time and appears only when there is servicing work. In Task Manager the Processes tab shows the worker as Windows Modules Installer Worker, and the Details tab shows the file name `TiWorker.exe`.

The worker is part of the servicing stack. Microsoft's [servicing stack page](https://learn.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates) describes the servicing stack as "the component that installs Windows updates", built on component-based servicing (CBS), which also sits under DISM, System File Checker, turning Windows features on or off, and component repair. So the same process can light up for several reasons that look unrelated from the outside: a monthly update, a feature you added, or Windows tidying old component versions.

## Why it spikes when it does

| Trigger | When it happens | What you see |
| --- | --- | --- |
| Monthly security update | Second Tuesday of each month | Download, then a long install phase and a restart |
| Optional preview update | Fourth week of the month, only if you choose to install it | Same pattern, smaller audience |
| Annual feature update | Once a year, second half of the calendar year | The longest run, often across more than one restart |
| Adding an optional feature | Right after you click Add in Settings | Worker starts as soon as the download finishes |
| Component cleanup | When the PC is idle | Activity while you are away, sometimes still running when you return |

The dates come from Microsoft's [release cycle page](https://learn.microsoft.com/en-us/windows/deployment/update/release-cycle): the monthly security update, also called Patch Tuesday or Update Tuesday, is published on the second Tuesday of each month, typically at 10:00 AM Pacific Time, and is cumulative, so each one carries all earlier fixes. Since February 2021 the servicing stack update is folded into that cumulative update, so there is one combined package to install rather than two.

Optional features run through the same path. Microsoft's [optional features guide](https://learn.microsoft.com/en-us/windows/client-management/client-tools/add-remove-hide-features) says Windows Update is used to add them, and the device needs to be online to download the content. Adding something under Settings › System › Optional features, or turning a feature on under Turn Windows features on or off, therefore starts the worker even when no update is pending.

The idle-time spike is usually component cleanup. Microsoft's [WinSxS cleanup page](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/clean-up-the-winsxs-folder) describes the StartComponentCleanup task: it cleans up components when the system is not in use, waits at least 30 days after an updated component is installed before removing the previous version, and has a one-hour timeout. You can see it in Task Scheduler under Task Scheduler Library › Microsoft › Windows › Servicing. Microsoft also strongly recommends not disabling component cleanup. If what you actually care about is the disk space this frees, [WinSxS folder cleanup](/windows/blog/winsxs-folder-cleanup-windows) covers the DISM switches and what `/ResetBase` gives up.

## Tell progress from a stall

Look at three things before deciding anything is wrong.

1. **Windows Update itself.** Open Settings › Windows Update. If the page shows a percentage that moves, a pending restart or "Check for updates" with nothing listed, you know which phase you are in. Settings › Windows Update › Update history lists what installed and what failed, according to Microsoft's [Windows Update FAQ](https://support.microsoft.com/en-us/windows/windows-update-faq-8a903416-6f45-0718-f5c7-375e92dddeb2).
2. **Task Manager over a few minutes.** Press `Ctrl + Shift + Esc`, sort by CPU, then by Disk. A worker that alternates between CPU and disk and then drops away is doing its job. Note how long it lasts rather than the peak: a few minutes to an hour after an update is normal, and a feature update takes longer.
3. **Reliability Monitor.** Run `perfmon /rel` ([Microsoft's `perfmon` reference](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/perfmon) documents the switch). Repeated failed update installations on consecutive days are the clearest sign of a loop rather than a long job.

If you want the detail, the servicing log is at `%windir%\Logs\CBS\CBS.log`. It is large and written while the worker runs, so read it rather than edit or delete it. A log whose last lines keep changing means work is happening, even if the percentage in Settings has not moved yet.

A laptop on battery deserves a note. The FAQ recommends keeping laptops and tablets plugged in when you are not using them so installs outside active hours have enough power to finish, and the [update troubleshooting article](https://support.microsoft.com/en-us/windows/troubleshoot-problems-updating-windows-188c2b0f-10a7-d72f-65b8-32d177eb136c) lists being plugged in and connected as the first check. An install that keeps stopping on battery looks like a stall but is really a job that never gets the time it needs.

## When it really is stuck

Work through these in order and stop as soon as one fixes it.

**Plug in and wait once.** Leave the PC on AC power and online, close what you can, and give it an hour without sleeping. Many "stuck" reports are a cumulative update that was interrupted twice by the lid closing.

**Restart once.** Microsoft's troubleshooting article suggests restarting so that no other app is blocking the update. Use Start › Power › Update and restart if it is offered, then check Settings › Windows Update again. Restart once, not repeatedly in the middle of an install.

**Run the Windows Update troubleshooter.** On Windows 11, the same article points first to the automated troubleshooter in the Get Help app. The manual route is Settings › System › Troubleshoot › Other troubleshooters, then Run next to Windows Update. On Windows 10 it is Settings › Update & Security › Troubleshoot › Additional troubleshooters › Windows Update. The article also notes that a 64-bit upgrade needs at least 20 GB of free space, so check that C: has room before retrying.

**Look at the download cache only if downloads keep failing.** Clearing `C:\Windows\SoftwareDistribution\Download` is a fix for a broken download, not for a busy worker, and it is unsafe while an update installs. [Deleting Windows Update files](/windows/blog/delete-windows-update-files) explains when it applies and how to stop the services first.

## Repair the component store: DISM, then SFC

If updates fail repeatedly and the worker keeps returning to the same job, the files it installs from may be damaged. Microsoft's [System File Checker article](https://support.microsoft.com/en-us/topic/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files-79aa86cb-ca52-166a-92a3-966e85d4094e) is explicit about the order: run DISM before System File Checker. Open Command Prompt as administrator and run:

```cmd
DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow
```

DISM uses Windows Update as its source for replacement files, so stay online; the article says it may take several minutes, and on a slow connection it takes longer. `sfc /scannow` then checks protected system files against that repaired store. If you want to know first whether repair is needed at all, Microsoft's [image repair guide](https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image) describes `/CheckHealth`, which reports the image as healthy, repairable or non-repairable, and `/ScanHealth`, a longer scan that takes several minutes:

```cmd
Dism /Online /Cleanup-Image /CheckHealth
```

SFC writes its results to the same `CBS.log`. To pull out only its lines, the SFC article gives:

```cmd
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt"
```

These commands repair, they do not remove anything you installed, so there is nothing to undo. If DISM cannot finish because Windows Update itself is broken, the SFC article describes pointing `/Source` at a working Windows installation or Windows media with `/LimitAccess`.

## What not to do

- **Do not disable the Windows Modules Installer service.** Microsoft's own description says that if you disable it, install or uninstall of Windows updates might fail. The CPU goes away, and so does patching.
- **Do not disable Windows Update to stop the worker.** The worker also handles optional features and component repair, and a PC that stops patching does not stop needing the patches; the work simply piles up for later.
- **Do not end TiWorker.exe in Task Manager.** Stopping it in the middle of an install leaves the update half-applied, which is how a long job turns into a failure loop.
- **Do not delete `SoftwareDistribution` while an update installs,** and do not take ownership of `C:\Windows\WinSxS` to delete files. Microsoft warns that deleting files from WinSxS can leave the PC unable to boot or update.
- **Do not cut power while an update restart is finishing.** Microsoft's FAQ notes the restart is part of finishing the install, so let it complete even if it takes a while.

## Where Mole fits

Mole for Windows does not change Windows Update, the TrustedInstaller service or the cleanup schedule. Its Optimize page has a task named Check and repair system files: it asks Windows' own image servicing API for the same healthy, repairable or non-repairable verdict that `DISM /CheckHealth` gives, at most once every 30 days. If the image is repairable, the result offers Repair system files as a separate step, which runs the same restore-health repair from Windows Update, and is labelled as taking up to about 30 minutes. Both the check and the repair ask for administrator access, the repair is refused on a low battery, and it re-checks the disk before writing. A second task, Reset stuck update downloads, waits while Windows Update is installing or a restart is pending, which is what the [Help page](/windows/help) means when it says an update in progress can hold back some maintenance.

Doctor, opened from the Mole mark at the top left of the window, reports when Windows is waiting for a restart to finish installing updates, and suggests a restart when the PC has been up for days while a Windows process is stuck using heavy CPU. For high CPU that is not servicing, see [High CPU usage on Windows](/windows/blog/windows-high-cpu-usage).

## FAQ

### Is Windows Modules Installer Worker a virus?

The genuine process is `TiWorker.exe`, started by the Windows Modules Installer service (`TrustedInstaller`) to install updates and optional features. In Task Manager, right-click it and choose Open file location; it should be inside the Windows folder.

### How long does TiWorker.exe high CPU last?

After a monthly update it usually settles within the install and the restart that follows; a feature update takes longer. Activity while the PC is idle is often the component cleanup task, which stops after an hour.

### Can I disable TrustedInstaller to stop high CPU?

Not safely. Microsoft states that disabling it can make installing or uninstalling Windows updates fail. Let the job finish, restart once, then repair with DISM and SFC if it keeps returning.

### Why does TrustedInstaller cause high disk usage?

Installing an update or adding a feature writes many files into the component store and reads the old ones it replaces. On a slow or nearly full drive that shows as 100% disk; [Disk at 100% in Task Manager](/windows/blog/windows-disk-100-percent) covers the disk side.


Canonical: https://mole.fit/windows/blog/windows-modules-installer-worker-high-cpu