WINDOWS PROCESS

RuntimeBroker.exe: Runtime Broker

Q: Is RuntimeBroker.exe safe, or could it be a virus?

The genuine file is in C:\Windows\System32 and is signed by Microsoft Windows. A program can borrow a familiar name, so check where your copy runs from and who signed it with the commands in “Check it yourself”. A file with this name anywhere else, or with another signer, deserves a closer look.

Microsoft describes Runtime Broker as a Windows process that helps manage permissions on your PC for apps from Microsoft Store. It normally uses only a few megabytes of memory.

TECHNICAL SUMMARY

Process	RuntimeBroker.exe
Display name	Runtime Broker
File	C:\Windows\System32\RuntimeBroker.exe
Signed by	Microsoft Windows
Verdict	Leave it alone

Paths, signer and service account observed on Windows 11 build 26300 on 5 November 2026. Run the commands below to check your own PC.

Should you touch it?

Leave it alone

Store apps rely on it for their permissions, so leave it running. Several copies are normal: four were running on the PC used for this page, each started by svchost.exe. Ending a copy that uses too much memory, then restarting, is Microsoft's own fix; disabling it is not.

What PC Tweaker does with it

PC Tweaker's priority rules refuse programs in the Windows folder and security software, so the app never changes this process's priority, and no control in the catalogue stops or edits it.

Check it yourself

01
See where it runs from
Protected processes hide their path from a normal window; run PowerShell as administrator to see it.
```
Get-Process RuntimeBroker -ErrorAction SilentlyContinue | Select-Object Id, Path
```
PowerShell
02
Check who signed the file
Expect Status: Valid and a certificate issued to Microsoft Windows. A file with this name anywhere else, or with another signer, deserves a closer look.
```
Get-AuthenticodeSignature "C:\Windows\System32\RuntimeBroker.exe" | Format-List Status, SignerCertificate
```
PowerShell

Common questions

Is RuntimeBroker.exe safe, or could it be a virus?

The genuine file is in C:\Windows\System32 and is signed by Microsoft Windows. A program can borrow a familiar name, so check where your copy runs from and who signed it with the commands in “Check it yourself”. A file with this name anywhere else, or with another signer, deserves a closer look.

Can I end RuntimeBroker.exe?

Leave it alone. Store apps rely on it for their permissions, so leave it running. Several copies are normal: four were running on the PC used for this page, each started by svchost.exe. Ending a copy that uses too much memory, then restarting, is Microsoft's own fix; disabling it is not.

Why is Runtime Broker using so much memory?

Microsoft says it should use only a few megabytes, and that a faulty app can make it use up to a gigabyte of RAM or more. If it takes more than 15% of your memory in Task Manager, Microsoft suggests an app on your PC may be the cause. Its fix is to select Runtime Broker in Task Manager, choose End task, and restart the PC. If the problem returns, the Store app you started using most recently is the first one to check.