What is Runtime Broker? (RuntimeBroker.exe process)

Runtime Broker process - what is it?
Written by Wilbur Woodham

Runtime Broker is one of dozens background apps running in Windows in the background. Its purpose is quite clear, and you may use it every day with no understanding of this fact. In this post, you will see the tips, tricks and suggestions about the mission of this service and reasons to keep it active. As a bonus, I will show you the ways of understanding that the Runtime Broker process is a malicious one.

Why do system needs the Runtime Broker?

This Windows process’ task is correct functioning of Windows applications from Windows Store, so-called Metro apps or Universal apps. Runtime Broker gives these applications access to the personal data according to the permissions on your PC (you set ones during the Windows installation)1.

While being inactive (i.e. you have no running Metro apps), it consumes tiny amounts of hardware capacities. It usually takes several megabytes of memory and tenths of a percent of CPU capacity. At the moment of Windows Store-related applications launch you may see high CPU usage and utilization of about a gigabyte of RAM, but only for seconds. In these seconds, the RuntimeBroker.exe transfers the information about your preferences.

RuntimeBroker.exe process in Task Manager

Sometimes, Runtime Broker may keep being active for a long time, until the Metro app you launched is closed. That usually means that this program has conflicts with your privacy settings. But the service will keep being active, thinking that it can complete its mission, sooner or later. Another reason for staying active is the suggestions as you use Windows; you can spectate them in the Start menu.

Do I need to disable the Runtime Broker?

You cannot disable this process, due to its deep integration with the OS. However, there is no need to do it: as it was mentioned, Runtime Broker consumes literally nothing. Its disabling will bring minimal benefits to your PC performance. And if you will try to launch the Metro app when this process is disabled, it will likely crash.

The times when you can disable Windows processes to increase the system performance have passed long ago. When Windows XP was the last actual OS version, computers were quite weak, and their upgrade was quite expensive. Hence, disabling several services could really make your PC faster without any significant problems. Nowadays, such tricks can make things even worse.

Can the RuntimeBroker.exe be malicious?

All legitimate system processes are listed in the Windows Processes category in Task Manager. If you see a duplicate of the process from Windows processes in the list of background processes, and your PC is running slowly, it may be malware. To check out the program the process belongs to, go to this process in Task Manager, click it with a right mouse button, and choose the “Open file location” option.

Right root directory of RuntimeBroker.exe process

If you see the source file somewhere in the Windows/System32 folder, it is 100% legit. Don’t be scared with a massive number of instances of this app running in the background. The majority of them are needed to decrease the time of programs opening. And none of these processes can malicious, because there is no malware in Microsoft Store.

You must raise suspicion if the location is wrong and Runtime Broker shows high CPU usage. Such a situation appears only if this process is a malware-related counterfeit. My choice for this case is GridinSoft Anti-Malware.

Removing the viruses with GridinSoft Anti-Malware

  • Download and install the GridinSoft Anti-Malware. After the installation, the program will offer you to perform the Standard scan. Apply this action.
  • GridinSoft Anti-Malware during the scan process

  • Standard scan lasts up to six minutes and checks the system files together with the files of the programs you have installed on your computer.
  • GridinSoft Anti-Malware scan results

  • When the scan is complete, press “Apply” to wipe out the malicious items that are present on your PC.
  • Malware removing with GridinSoft Anti-Malware

    User Review
    1 (2 votes)
    Comments Rating 0 (0 reviews)


    1. Information about the Runtime Broker from Microsoft.
    Runtime Broker process - what is it?
    Runtime Broker process - what is it?
    Runtime Broker is a Windows service that is needed to inform the Metro apps (apps from Windows Store) about your privacy preferences. Usually, this process cannot be exploited by malware, but the risk is still there.

    About the author

    Wilbur Woodham

    I was a technical writer from early in my career, and consider IT Security one of my foundational skills. I’m sharing my experience here, and I hope you find it useful.

    Leave a Reply