What Is Runtime Broker in Windows 10 (and Is It Safe)?
The Runtime Broker process, first introduced in Windows 8, is an essential system process that continues to serve an important purpose on Windows 10 PCs. Like other core system processes such as unsecapp.exe, the Runtime Broker process cannot be disabled or disabled.
System processes like Runtime Broker are usually hidden, so if it’s on your radar it could be a problem. If you are asking yourself “What is Runtime Broker?” and you don’t know the answer, keep reading as we explain what it is, is it safe, and what you can do if it causes high CPU or RAM usage on Windows 10.
What is Runtime Broker in Windows 10?
Some system processes cover everything, for example, ntoskrnl.exe, which is so important that it is simply called System in the Task Manager. However, the Runtime Broker process (runtimebroker.exe) is slightly less important but still plays an important role in how Windows protects your system.
The Runtime Broker process tracks the permissions of applications that you install and run from the Microsoft Store. These can be background permissions for accessing your local files, webcam recording, or tracking your location. Such data is sensitive, so it makes sense that you (and Microsoft) can restrict access to it.
Not every app you install is what it appears, so by tracking permissions, Windows can stop unauthorized apps from trying to request permissions (and access) that weren’t granted to it. This is the purpose of Runtime Broker, so without it, any Microsoft Store app could compromise your data and privacy.
It is a core system process that has been part of the Windows ecosystem since Universal Windows Platform (UWP) apps were introduced in Windows 8 (or Metro apps, as they were then called), serving as additional security for Windows that you shouldn’t. need to worry.
Is Runtime Broker Safe And Can It Be Disabled?
Runtime Broker (runtimebroker.exe) is the main system process designed to protect your PC from malicious Microsoft Store apps. It is completely safe to run as it plays an important role in many of the countermeasures that Microsoft has deployed to protect your Windows operating system from serious threats such as malware infection.
Unlike other major system processes like csrss.exe, terminating the Runtime Broker process won’t break your computer, but Windows will automatically restart it after a few seconds. You can’t turn it off permanently, but you shouldn’t.
As we mentioned, the Runtime Broker is protective and restricts access to your files and settings. The only exception to this rule is if your computer is running malware that replaces the real Runtime Broker with a fake version. While we stress that this is unlikely, it cannot be ruled out.
If you are concerned about this, you can check if a system process like runtimebroker.exe is legitimate by following these steps.
What causes high CPU issues for Windows 10 Broker runtime?
When a running process reports high CPU or RAM usage in Windows 10, it can often be cause for concern. At the end of the day, you may be worried that you won’t have the resources to do other things, like games.
In most cases, Runtime Broker suffers from high CPU usage only the first time you launch a UWP app from the Microsoft Store. This is because the Runtime Broker process checks that the application has the necessary permissions to run and does not try to obtain permissions that it should not have access to.
It can also be caused by other Windows activities. For example, prompts and alerts for new Windows users that appear in the notification area will launch as if the UWP app were running, activating the Runtime Broker process.
This may explain the small spikes in the Runtime Broker process in the Windows Task Manager. Depending on your current PC specs, CPU spikes should be minimal and should generally not affect overall system performance.
If the Runtime Broker process has high CPU usage for a longer period of time, this could indicate a problem with the UWP app. If the application continually asks for new permissions, or is repeatedly opened and reopened (for example, if it was unstable), it could overload the Runtime Broker process.
Unfortunately, there is no easy way to track down which applications are causing high CPU usage during the Runtime Broker. You will need to keep an eye on the Task Manager when you open UWP apps on your PC, and if any of these apps are causing problems, you will need to troubleshoot them further.
How to check if Runtime Broker is a legitimate system process
Runtime Broker is a system process, but as we mentioned, it is possible that malware on your computer has received the same name, hiding in the task manager’s process list and causing all sorts of damage.
To help you protect yourself from these kinds of threats, you can check if the Runtime Broker (runtimebroker.exe) process is a legitimate system process or a nasty bogus.
- To do this, you need to open the Windows Task Manager. To do this, right-click the taskbar and select the Task Manager option.
- In the Task Manager window, find the Runtime Broker process in the Processes tab (or runtimebroker.exe in the Details tab). You can see a few examples in the list – this is fine as Windows will run runtimebroker.exe multiple times, depending on the UWP apps you are running. Right-click the service name and select the Open File Location option.
- Windows Explorer opens, showing the location of the running process. You need to find it in the C: Windows System32 folder.
If Windows Explorer does not open the System32 folder, you can be sure that the process currently running on your computer is not a legitimate system process. You can then remove the detected malware with dedicated anti-malware software or with built-in Windows Defender.
Explore Windows system processes further
If you’ve installed third-party apps from the Microsoft Store, you can thank the Runtime Broker process for making your computer a little safer. By tracking and limiting app permissions, you can be sure your files and settings are protected from control or access when they shouldn’t.
Of course, if you are unsure about an application, you shouldn’t think twice before uninstalling it. System applications like runtimebroker.exe and msmpeng.exe usually cannot be removed, but if you find a fake process with the same name in Windows Task Manager, you will need to run a malware scan to remove it.