Quickfix AI
RuntimeBroker.exeUsually safe

What is RuntimeBroker.exe?

Publisher: Microsoft CorporationTypical location: C:\Windows\System32\RuntimeBroker.exe

RuntimeBroker.exe is a legitimate Windows system process from Microsoft. It helps Windows check and manage app permissions, especially for Microsoft Store apps, so they only access things like your microphone, camera, location, or files when allowed.

What it does

Runtime Broker acts like a security and permission checker between Windows and apps. You may see it briefly appear when an app starts, when you change app permissions, or when a Store app needs access to a protected feature. On a normal system it should not stay busy for long or use much CPU or disk activity.

Is it safe?

Yes, the real RuntimeBroker.exe is safe and part of Windows. However, malware can sometimes use the same name to look legitimate. To make sure it is real, check that the file is in C:\Windows\System32\RuntimeBroker.exe and that the publisher is Microsoft Corporation. If it is running from a different folder, has no valid signature, or the publisher looks wrong, treat it as suspicious.

Why it causes high CPU or disk usage

  • 1A Microsoft Store app is repeatedly requesting permissions
  • 2A buggy or stuck app is causing Runtime Broker to loop
  • 3Windows is applying or checking app permissions in the background
  • 4A fake file using the same name is running from an unusual location

How to check if it's legitimate

  1. In Task Manager, right-click Runtime Broker and choose Open file location.
  2. Confirm the file is in C:\Windows\System32.
  3. Right-click the file, open Properties, and check the Digital Signatures or Details tab for Microsoft Corporation.
  4. If it is not in System32, or the publisher/signature is missing or wrong, run a malware scan and avoid ending it repeatedly.
  5. If it is the real Windows file but CPU usage is high, restart your PC and close any recently opened Store apps.

How to remove it

You should not try to remove the real RuntimeBroker.exe; it is a core Windows component. If the legitimate process is using too much CPU or disk, restart your device, close recently used apps, and install Windows updates. If you find a copy outside C:\Windows\System32 or it is missing the Microsoft signature, treat it as suspicious and scan for malware instead of deleting Windows files manually.

Need more help?

Run a free diagnostic scan to identify and fix issues automatically.

Download Quickfix AI