OfficeClickToRun.exe: Microsoft Office Process or Malware?

OfficeClickToRun.exe is normally a Microsoft Office component. It belongs to the Click-to-Run technology used by Microsoft 365 and modern Office installations to stream, update, repair, and manage Office apps. It can use CPU, disk, memory, and network while Office is installing updates or repairing itself. It becomes suspicious only when the file path, signature, or behavior does not match Microsoft Office.

OfficeClickToRun.exe using high CPU in Task Manager — OfficeClickToRun.exe can spike during Office update or repair work. Persistent high usage usually points to a stuck Office servicing task.

What does OfficeClickToRun.exe do?

Click-to-Run lets Office apps install and update in the background. The service can download update packages, stage new Office builds, repair damaged Office files, and keep subscription components working. If you use Word, Excel, Outlook, PowerPoint, Teams integrations, OneNote, or Microsoft 365 apps, this process can appear even when no document window is open.

Short spikes are normal during updates. A long CPU or disk spike, repeated fan noise, or a process that returns immediately after every reboot usually means Office update or repair is stuck.

Safe vs suspicious signs

Usually legitimate	Suspicious
Located under `Program FilesCommon FilesMicrosoft SharedClickToRun`.	Runs from AppData, Temp, Downloads, Startup, or a random folder.
Signed by Microsoft Corporation.	No trusted signature or a strange publisher.
Uses resources during Office update, install, repair, or first launch.	Uses high CPU constantly with no Office apps installed.
Stops after Office finishes updating.	Returns after Office is uninstalled or points to an unknown scheduled task.

Verify the file location

Open Task Manager, right-click OfficeClickToRun.exe, and choose Open file location. The legitimate file should live in a Microsoft Office ClickToRun folder and carry a Microsoft signature. If it is somewhere else, scan the exact file and inspect startup entries before removing anything.

Fix high CPU or disk usage

Wait a few minutes if Office has just updated or installed. Click-to-Run may be staging files.
Restart Windows and check whether the process settles after boot.
Open any Office app, go to account/update settings, and install pending Office updates.
Run an Office Quick Repair. If the loop continues, use Online Repair.
Check that Windows Update is not paused or stuck, because Office and Windows servicing can overlap.
If the process remains high after uninstalling Office, use Microsoft’s Office uninstall support tool, then reinstall Office from the official Microsoft account page.

Should you disable the service?

Disabling Microsoft Office Click-to-Run can break Office updates, licensing checks, streaming features, and repair operations. Use service stop only as a short diagnostic step. If stopping the service immediately improves the PC, repair Office rather than leaving the service disabled forever.

When to scan for malware

Scan if the file path is wrong, the signature is missing, Office is not installed, or a look-alike process launches from a user folder. Do not delete the Microsoft-signed ClickToRun file manually; repair or uninstall Office instead.

Decision tree

Office is installed and the file is in ClickToRun: update or repair Office.
Office was recently updated: wait, reboot, and confirm the update finished.
The process loops after every boot: run Quick Repair first, then Online Repair.
Office is not installed: treat the process as suspicious unless another Microsoft package clearly owns it.
The path is not Microsoft ClickToRun: scan the exact file and check startup entries.

Why Click-to-Run can look noisy

Microsoft 365 is not updated like old MSI Office installations. Click-to-Run can stream application files, switch Office channels, validate licensing, repair shared components, and stage updates in the background. That means the process can appear even when Word or Excel is closed. The key is duration: a short update window is normal, but a loop that lasts through multiple reboots is not.

What to check before repair

Open an Office app and check the account page for pending updates, product activation, and the current update channel. If Outlook add-ins or Office plugins were installed recently, disable them and retest. Also check whether antivirus software is scanning the Office ClickToRun folder too aggressively during updates; exclusions should be used carefully, but this can explain heavy disk activity on some systems.

What good looks like after repair

After Quick Repair or Online Repair, OfficeClickToRun.exe should still exist, but it should not sit at high CPU or disk usage. Office apps should open normally, updates should complete, and the ClickToRun service should return to idle. If it immediately loops again, use the official Microsoft uninstall support tool and reinstall from a clean Microsoft account installer.

Service checks for advanced users

Open Services and find the Microsoft Office Click-to-Run service. Its startup type is normally automatic. If the service is constantly starting and stopping, check the Windows Event Viewer for Office, ClickToRun, or Microsoft 365 update errors around the same time. This can reveal whether the issue is a failed update, damaged Office install, or licensing/service problem.

Also check Task Scheduler for Office update tasks. A task that runs repeatedly and fails can make OfficeClickToRun.exe look like a miner even though it is simply retrying broken maintenance work. Repairing Office should be done before disabling scheduled tasks.

Best practice for work PCs

On managed devices, do not switch Office update channels or disable Click-to-Run without checking company policy. Many organizations use Microsoft 365 Apps update channels, Intune, Group Policy, or Configuration Manager. A local “fix” can be undone by policy and create another update loop. Record the Office version, update channel, and error code before escalating.