What Is Runtime Broker in Windows 10 (and Is It Safe)

First appearing in Windows 8, the Runtime Broker process is an important system process that continues to serve an important purpose on Windows 10 PCs. Like other major system processes, such as unsecapp.exe, the Runtime Broker process can’t be switched off or disabled.

System processes like the Runtime Broker are usually hidden, so if it’s on your radar, there could be a problem. If you’re asking yourself “what is Runtime Broker?” and you don’t know the answer, then keep reading, as we explain what it is, whether it’s safe, and what you can do if it’s causing high CPU or RAM usage in Windows 10.

What Is Runtime Broker in Windows 10?

Some system processes are all encompassing, like ntoskrnl.exe, which is so important, it’s simply named System in Task Manager. The Runtime Broker (runtimebroker.exe) process, however, is a little less important, but still plays a major role in how Windows protects your system.

The Runtime Broker process monitors the permissions of apps you install and run from the Microsoft Store. This could be background permissions to access your local files, record your webcam, or monitor your location. This kind of data is sensitive, so it makes sense that you (and Microsoft) might want to limit access to it.

Not every app you install is what it seems, so by monitoring permissions, Windows can stop rogue apps from trying to claim permissions (and access) that it hasn’t been granted. That’s the purpose of Runtime Broker, so without it, any Microsoft Store app could put your data and privacy at risk.

It’s a core system process, and has been part of the Windows ecosystem since Universal Windows Platform (UWP) apps were introduced in Windows 8 (or Metro apps, as they were then known), acting as extra security for Windows that you shouldn’t need to worry about.

Is Runtime Broker Safe and Can It Be Disabled?

Runtime Broker (runtimebroker.exe) is a major system process, designed to keep your PC safe from rogue Microsoft Store apps. It’s entirely safe to run, playing an important part in the many countermeasures that Microsoft has deployed to protect your Windows operating system from major dangers, such as malware infections.

Unlike other major system processes like csrss.exe, ending the Runtime Broker process won’t break your PC, but Windows will automatically restart it after a few seconds. It can’t be permanently disabled, but disabling it isn’t something you should want to do, either.

As we’ve already mentioned, Runtime Broker is defensive, and acts to restrict access to your files and settings. The only exception to this rule is if malware is running on your PC, replacing the real Runtime Broker process with a fake version. While we stress that this is unlikely, it isn’t something that can be ruled out.

If you’re worried about this, you can check whether or not a system process like runtimebroker.exe is legitimate by following the steps below.

What Causes Runtime Broker High CPU Issues in Windows 10?

When a running process reports high CPU or RAM usage in Windows 10, it can often be a cause for concern. After all, you might be worried that you won’t have the resources to do other things, like playing games.

In most cases, Runtime Broker suffers high CPU usage only when a UWP app from the Microsoft Store is first launched. This is because the Runtime Broker process is checking that the app has the required permissions to run and that it isn’t trying to gain permissions that it shouldn’t have access to.

It can also be caused by other Windows system actions. For instance, tips and alerts for new Windows users that appear in the notifications area will be triggered as if a UWP app is running, activating the Runtime Broker process.

This may explain small spikes in the Runtime Broker process in Windows Task Manager. Depending on your current PC specifications, spikes in CPU usage should be minimal, and shouldn’t typically impact your overall system performance.

If the Runtime Broker process has high CPU usage for a longer period of time, then this would indicate an issue with a UWP app. If an app continually requested new permissions or opened and reopened repeatedly (if it was unstable, for instance), then this could cause the Runtime Broker process to become overwhelmed.

Unfortunately, there isn’t an easy way to trace what apps might be causing high CPU usage in the Runtime Broker process. You’ll need to monitor the Task Manager as you open UWP apps on your PC and, if any of those apps cause issues, you’ll need to troubleshoot them further.

How to Check Whether Runtime Broker Is a Legitimate System Process

Runtime Broker is a system process, but as we’ve mentioned, it isn’t impossible that malware on your PC has taken the same name, hiding in your Task Manager processes list while it causes all kinds of damage.

To help you protect against this kind of threat, you can check whether or not the Runtime Broker process (runtimebroker.exe) is the legitimate system process or whether it’s a nasty fake.

1. To do this, you’ll need to open the Windows Task Manager. To do this, right-click the taskbar and select the Task Manager option.

2. In the Task Manager window, find the Runtime Broker process in the Processes tab (or runtimebroker.exe in the Details tab). You may see several examples listed—this is normal, as Windows will run runtimebroker.exe several times, depending on the UWP apps you have running. Right-click the service name, then select the Open file location option.

3. Windows File Explorer will open, showing the location of the running process. This should be found in the C:WindowsSystem32 folder.

If Windows File Explorer doesn’t open to the System32 folder, then you can be confident that the process currently running on your PC is not the legitimate system process. You can then move to remove the malware that you find using specialist antimalware software or by using the built-in Windows Defender.

Exploring Windows System Processes Further

If you’ve installed non-Microsoft apps from the Microsoft Store, then you can thank the Runtime Broker process for keeping your PC that little bit safer. By monitoring and restricting app permissions, you can rest assured that your files and settings are safe from being monitored or accessed when they shouldn’t be.

Of course, if you’re unsure about any app, you shouldn’t think twice about uninstalling it. System apps like runtimebroker.exe and msmpeng.exe can’t typically be uninstalled, but if you do discover a fake process with the same name in Windows Task Manager, you’ll need to make sure you scan for malware to remove it instead.