What Is Runtime Broker? Is It Safe to Disable at Startup?

What Is Runtime Broker?

Runtime Broker (RuntimeBroker.exe) is a built-in Windows process from Microsoft. Its job is to help manage permissions and background behavior for Windows components and Microsoft Store apps. For example, it can be involved when an app wants access to things like notifications, microphone, location or other system features.

You will often see it start and stop on its own. That is normal. It is not usually a startup app you manage yourself, and it is not something you should remove.

Is It Safe?

Yes, the real Runtime Broker is a legitimate Windows process. It normally runs from the Windows system folder and is signed by Microsoft Corporation.

If you want to verify it, open Task Manager, right-click Runtime Broker, choose Open file location, and check that the file is in C:\Windows\System32. Then open the file properties and confirm the digital signature is from Microsoft.

Be careful: malware can use names that look like system processes. If runtimebroker.exe is running from another folder, has no valid Microsoft signature, or keeps reappearing after quarantine, treat it as suspicious and investigate it.

Should I Disable It at Startup?

No. Runtime Broker is part of Windows, not a normal startup item. It is started by the system when needed, and disabling it is not recommended.

Even if you could interfere with it, that may break parts of Windows or cause Microsoft Store apps and some built-in features to behave incorrectly. If you are reviewing startup items in Kudu, Runtime Broker is not something you should try to turn off.

Why Is It Using High CPU or Memory?

Short bursts of CPU or memory use are normal, especially after opening Settings, notifications, widgets, or Microsoft Store apps. It should usually settle down.

If usage stays high for several minutes, common causes include:

• a Store app stuck in the background
• repeated notification activity
• a permissions-related app problem
• a Windows component behaving badly after an update

Useful checks:

• Restart the PC and see if the usage returns.
• Close recently opened Store apps.
• Check whether notifications or widgets are constantly refreshing.
• Run Windows Update and install pending updates.
• If the file location is not C:\Windows\System32, investigate it as possible malware.

Do not end it repeatedly as a “fix.” Windows may just launch it again.

How to Disable or Remove It

You generally should not disable or remove Runtime Broker. It is part of Windows.

If you are troubleshooting high usage, focus on the app or feature triggering it rather than Runtime Broker itself. You can temporarily end the process in Task Manager, but Windows may restart it automatically. If the problem keeps coming back, check app permissions, recent app installs, and Windows updates.

If the file is outside the normal Windows folder or lacks a valid Microsoft signature, run a malware scan instead of trying to remove it like a normal startup app.

Where Kudu Helps

Kudu can help you confirm whether the issue is really Runtime Broker or something linked to it. In Performance Monitor, you can watch CPU and memory use live, identify the PID, and see whether the process keeps respawning. If a suspicious copy is running from the wrong location, Malware Scanner can check for persistence and quarantine supported threats.

Kudu’s Startup Manager is useful for reviewing actual startup items that may be triggering background app activity, but Runtime Broker itself is not a startup app you should disable. If system files may be damaged, Kudu’s Disk Repair can guide you through SFC and DISM.

Download Kudu Free →