What is Runtime Broker? Fixing High CPU Usage the Easy Way

One of the first instincts of any IT professional when a Windows system slows down is to open Task Manager and start analysing resource usage. CPU pegged at 100%, memory pressure climbing, fans spinning up—and then you see it:

Runtime Broker

For many users, this process is unfamiliar. It’s not something you installed, it doesn’t have a UI, and it doesn’t correspond to a traditional application. Yet in some cases, runtimebroker.exe can consume hundreds of megabytes of RAM or spike CPU usage enough to noticeably degrade performance.

So what exactly is Runtime Broker, why does it exist, and—most importantly—how do you deal with it when it starts misbehaving?

What Is Runtime Broker?

Runtime Broker (runtimebroker.exe) is a legitimate Microsoft core process introduced with Windows 8 and still present in Windows 10 and Windows 11.

Its primary role is security and privacy enforcement for UWP (Universal Windows Platform) / Microsoft Store apps.

In simple terms, Runtime Broker acts as a permission gatekeeper.

Whenever a Store app:

• Requests access to your microphone
• Reads location data
• Uses your webcam
• Accesses files, notifications, or background services

Runtime Broker steps in to:

1. Verify the permission declaration
2. Enforce what the user has allowed
3. Prevent apps from silently exceeding their granted access

From a Windows security model perspective, this is a critical safeguard.

Why You Don’t See Runtime Broker Until Something Goes Wrong

Under normal conditions:

• Runtime Broker uses very little CPU
• Memory usage usually sits between 5–20 MB
• It appears briefly and disappears when apps close

Most users never notice it.

Problems arise when:

• A UWP app enters a permission loop
• A Store app crashes repeatedly in the background
• Windows notifications or live tiles misbehave
• System features repeatedly trigger permission checks

At that point, Runtime Broker becomes visible—not because it’s faulty, but because something else is abusing it.

Why Does Runtime Broker Cause High CPU or Memory Usage?

This is an important distinction:

Runtime Broker itself is rarely the root cause.

It’s a broker, not the workload.

In real-world troubleshooting, high CPU or RAM usage is almost always caused by:

• A buggy Microsoft Store app
• A corrupted UWP package
• Excessive background permissions checks
• Notification-related services firing repeatedly

I’ve seen this most often on systems where:

• Store apps were preinstalled but never used
• Windows upgrades left behind broken app registrations
• Enterprise images disabled Store access inconsistently

Can You Disable Runtime Broker?

Short answer: No—and you shouldn’t try.

Runtime Broker is:

• A protected Windows process
• Tightly integrated with the Windows security model
• Required for safe execution of Store apps

Disabling it permanently would:

• Break Microsoft Store apps
• Reduce OS security
• Cause unpredictable behaviour

If you see guides suggesting registry hacks or service removal, treat them as unsafe advice.

How to Fix Runtime Broker High CPU Usage (Safely)

The goal isn’t to kill Runtime Broker—it’s to reduce the triggers that cause it to overwork.

1. Disable Windows Tips, Tricks, and Suggestions (Surprisingly Effective)

This is one of the most overlooked causes of Runtime Broker activity.

Windows “tips” are delivered via UWP notification infrastructure, which constantly checks permissions in the background.

Steps:

1. Press Windows + I
2. Go to System → Notifications
3. Disable:
   • Get tips and suggestions when using Windows
   • Show me the Windows welcome experience
   • Suggest ways to get the most out of Windows

In enterprise environments, I’ve seen this single change drop Runtime Broker CPU usage to near zero.

2. Temporarily Restart Runtime Broker (Short-Term Relief)

This doesn’t fix the underlying cause, but it’s useful for diagnostics.

Steps:

1. Press Ctrl + Shift + Esc
2. Find Runtime Broker
3. Right-click → End task
4. Reboot the system

If CPU usage stays normal after reboot, it strongly suggests an app or background trigger rather than a system-level issue.

3. Disable Unnecessary Background Apps

Many Store apps are allowed to run in the background even when never used.

Steps:

1. Press Windows + I
2. Go to Privacy → Background apps (Windows 10)
   or Apps → Installed apps → App permissions (Windows 11)
3. Disable background access for:
   • News
   • Weather
   • Xbox services (if unused)
   • Consumer apps not required in your environment

This is especially important on laptops and VDI systems.

4. Identify the Offending App

Advanced troubleshooting approach:

1. Watch Runtime Broker CPU spikes
2. Check which Store app launches at the same time
3. Remove or reset that app

You can reset apps via:
Settings → Apps → Installed apps → Advanced options → Reset

In stubborn cases, removing and reinstalling the app entirely is often faster.

5. Keep Windows and Store Apps Updated

Outdated UWP frameworks are a frequent cause of permission loops.

Ensure:

• Windows is fully patched
• Microsoft Store apps are updated
• No partially failed Windows feature upgrades exist

In enterprise environments, mismatched servicing baselines can easily trigger Runtime Broker issues.

Is Runtime Broker a Virus?

No.

runtimebroker.exe is:

• Digitally signed by Microsoft
• Located in C:\Windows\System32
• Part of the Windows security architecture

If you see a Runtime Broker process running from another location, then it’s worth investigating—but the legitimate process is safe.

Runtime Broker in Windows 11: Any Different?

Functionally, no.

Windows 11 still relies heavily on:

• UWP frameworks
• Background permissions
• Notification-based triggers

However, Windows 11’s UI and app model makes Runtime Broker more visible, especially on fresh installs where many apps are preloaded.

The fixes remain the same.

Real-World IT Perspective: Why Runtime Broker Gets Blamed

From years of troubleshooting Windows performance issues, Runtime Broker often becomes the messenger that gets shot.

It’s visible.
It’s named.
It’s measurable.

But the real culprit is usually:

• Poorly maintained UWP apps
• Aggressive notification features
• Consumer-focused defaults in professional environments

Once you treat it as a symptom, not the disease, the fixes become straightforward.

Conclusion: Runtime Broker Isn’t the Enemy—Misbehaving Apps Are

Runtime Broker plays a vital role in keeping Windows secure by enforcing app permissions. When it uses high CPU or memory, it’s almost always reacting to another component behaving badly.

By:

• Disabling unnecessary background features
• Reducing Store app permissions
• Identifying problematic UWP apps
• Keeping systems updated

You can restore system performance without compromising security.

In a healthy Windows environment, Runtime Broker should be invisible—and once properly tuned, it usually is.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.