PROCESSMicrosoft-signed
RuntimeBroker.exeRuntime Broker
RuntimeBroker.exe (Runtime Broker) is a Windows process that checks and enforces permissions for Microsoft Store and other packaged (UWP) apps, for example access to the camera, microphone or files. Several copies are normal, one per app or group. Brief CPU spikes are expected; sustained high usage usually traces to a specific app or live tile.
What Runtime Broker does
When a Microsoft Store or other packaged (UWP) app wants to use a protected capability, such as the camera, microphone, location or your files, Runtime Broker is the process that checks whether the app has been granted that permission and enforces the boundary. It sits between the sandboxed app and the resources it requests, which is why it exists separately from the apps themselves.
Why several copies run
Windows may run one RuntimeBroker.exe per packaged app or group of apps, so seeing several in Task Manager is normal. Each brokers permissions for the apps it is associated with.
Fixing high CPU or memory
Runtime Broker is usually idle, using a few megabytes. Spikes accompany app launches and permission checks. Sustained high usage points to an app rather than to Runtime Broker itself:
- Live tiles. The Start menu's animated tiles refresh through packaged-app code; turning off tile animations or clearing troublesome tiles reduces the load.
- Notifications. An app pushing frequent notifications keeps the broker busy. Settings → System → Notifications lets you disable per-app.
- A specific misbehaving app. Close Store apps one at a time and watch which one drops the CPU. The Photos app, some feed or news apps, and buggy third-party Store apps are common causes.
- Reset the culprit app via Settings → Apps → the app → Advanced options → Reset.
Ending the process (taskkill) resets it momentarily but does not address the app driving it.
Confirming it is genuine
Path C:\Windows\System32\RuntimeBroker.exe, Microsoft-signed. Multiple instances are expected.
Frequently asked questions
Why is RuntimeBroker.exe using high CPU?
A packaged app is doing something that needs permission checks, often a live tile refreshing, a notification, or an app misbehaving. Close Store apps one at a time to find the cause; the Start menu's live tiles and the Photos app are frequent offenders. Turning off tile animations or notifications for that app helps.
Can I end RuntimeBroker.exe?
You can, and Windows restarts it when a Store app next needs it. Ending it is a temporary reset, not a fix; if a specific app drives it, address that app.
Is RuntimeBroker.exe a virus?
The genuine process is in C:\Windows\System32 and signed by Microsoft. Malware occasionally uses the name from another location; check the path and signature.