Ntoskrnl.exe Process Is Causing High CPU or Disk Usage. How to fix it?

How To Easily Fix High CPU Or Disk Usage Caused By The ntoskrnl.exe Process In Windows 10

Disk usage (DU) refers to the portion or percentage of computer storage that is currently in use. It contrasts with disk space or capacity, which is the total amount of space that a given disk is capable of storing. CPU usage indicates how much of the CPU a particular program or process is using. If a program or a process uses too many Disk or CPU resources, it might not be functioning properly. There are, for example, often problems with the ntoskrnl.exe process taking too many Disk or CPU resources.

To work correctly, Windows runs various processes in the background, including ntoskrnl.exe (Windows NT operating system kernel), which is also known as the kernel image. It is a fundamental part of the operating system responsible for various system services such as memory and process management, hardware virtualisation, etc. The process also provides the kernel and executive layers of the Windows NT kernel space.

As one of the process responsibilities is to manage memory, you may find it odd that a process that manages memory is the cause of excessive usage. When a program or a process takes too many CPU or Disk resources and slows down the computer, you can usually just close it or end the process. This is not the case with ntoskrnl.exe, since it is an important part of the Windows operating system - closing it could lead to more serious problems.

To address the ntoskrnl.exe CPU/Disk usage problem, read the guide below for possible solutions.

ntoskrnl.exe using too much of CPU or Disk

Table of Contents:

Edit Windows Registry

Windows Registry, usually referred to as just 'the registry', is a collection of databases of configuration settings in Microsoft Windows operating systems. It is used to store much of the information and settings for software programs, hardware devices, user preferences, operating system configurations, and much more. Many of the options exposed in the registry are not accessible elsewhere in Windows. To edit the registry, you will need to use Windows Registry Editor. To open Registry Editor, right-click the Start button and select "Run" from the contextual menu.

edit windows registry step 1

In the Run dialog box, type "regedit" and click "OK" or press Enter on the keyboard - this will open Registry Editor.

edit windows registry step 2

Now go to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management". You can simply copy and paste this path into Registry Editor's bar or go to it manually by expanding directories. Click the "Memory Management" folder icon. You will see a list of registry files on the right pane. Find "ClearPageFileAtShutdown" and double-click it.

edit windows registry step 3

In Edit DWORD (32-bit) Value window change "Value data" to 1. Click "OK" to save changes and see if this solves the problem with the ntoskrnl.exe process using too much CPU or Disk.

edit windows registry step 4

[Back to Table of Contents]

Improve Windows Performance

Adjust Windows 10 for best performance. Right-click the This PC (formerly "My Computer") icon and select "Properties" from the contextual menu. If you are not sure where to find it, open File Explorer - you should see it on the left pane of the window.

improve windows performance step 1

The System properties window will appear. Find and click "Advanced system settings".

Improve windows performance step 2

On the Advanced tab, find "Settings..." under Performance and click it.

Improve windows performance step 3

In the Performance Options window, select the "Adjust for best performance" option and click "Apply" to save the changes. Restart the computer and see if this solves the problem with the ntoskrnl.exe process using too much CPU or Disk.

Improve windows performance step 4

[Back to Table of Contents]

Disable Startup Programs

When you start Windows using a normal startup operation, several applications and services start automatically and then run in the background. These programs include basic system processes, antivirus software, system utility applications, and other software that has been previously installed. These applications and services can cause software conflicts and slow down the computer by taking too many resources. To disable startup programs, type "system configuration" in Search and click the "System Configuration" result.

disable startup programs step 1

In the System Configuration window, click the "Services" tab and then mark the "Hide all Microsoft services" checkbox. Then, click "Disable all".

disable startup programs step 2

Click the "Startup" tab and click "Open Task Manager".

disable startup programs step 3

Under the Task Manager Startup tab, select the first application and click "Disable" to disable it. Disable all applications one-by-one, repeating this step. Once you have disabled all programs, close Task Manager and click "OK" in the System Configuration Startup tab. Restart the computer to see if this solves the problem with the ntoskrnl.exe process using too much CPU or Disk.

disable startup programs step 4

[Back to Table of Contents]

Defragment Your Hard Drive

The ntoskrnl.exe process might use too many CPU or Disk resources if the hard drive requires defragmentation. The built-in Windows feature 'Defragment and Optimize Drives' optimizes your drives to help the system run more efficiently (or analyzes them to determine if they require optimization). To launch the defragmentation tool, type "defragment" in Search and click the "Defragment and Optimize Drives" result.

defragment your hard drive step 1

You will see a list of drives connected to the computer. Select the hard drive and click "Optimize". The optimisation process should take a while. Wait for it to finish. Then, restart the computer and see if this solves the problem with the ntoskrnl.exe process using too much CPU or Disk.

defragment your hard drive step 2

[Back to Table of Contents]

Scan Your System For Viruses

Malware can cause various issues on computers, including problems with high CPU or Disk usage. Perform a full system scan and see if it detects any malware on the computer. You can use Windows Defender (a built-in antivirus program) that protects computers from viruses, spyware, and other malicious software. Alternatively, you can use other third-party anti-virus software. To run a full system scan using Windows Defender, type "virus" in Search and click the "Virus & threat protection" result.

scan your system for viruses step 1

In the Virus & threat protection window, click "Advanced scan".

scan your system for viruses step 2

Select "Full scan" and click "Scan now". This will start scanning your system for malware. If there are any viruses found, delete them and see if the problem is fixed.

scan your system for viruses step 3

You can choose another virus and malware scanner from our Top anti-malware list. The list consists of well-known top spyware removers and will help you choose the right software for your computer's protection. You can find the list by clicking this link. 

[Back to Table of Contents]

Disable Runtime Broker

Runtime Broker is a Microsoft Windows process that first appeared in Windows 8 and is still present in Windows 10. This process determines whether the universal apps from the Microsoft Store are declaring all of their permissions (such as being able to access the microphone or location). To disable it, go to Settings and click "System".

disable runtime broker step 1

In System settings, select the "Notifications & actions" section and disable "Get tips, tricks, and suggestions as you use Windows" and "Get notifications from apps and other senders" features. Restart the computer and see if this solves the problem with the ntoskrnl.exe process using too much CPU or Disk.

disable runtime broker step 2

[Back to Table of Contents]

Disable Superfetch

Superfetch is a Windows service that is intended to speed up application launching and improve system responsiveness. It caches data so that it can be immediately available to your application. Superfetch achieves this by preloading frequently used programs into RAM so that they are not required to be called from the hard drive. This can sometimes affect performance and slow down the system. To disable Superfetch, open the Run dialog box by typing "run" in Search and clicking on the "Run" result. Alternatively, you can use the Windows key + R keyboard shortcut to open it. In the Run dialog box, type "services.msc" and press Enter on the keyboard or click "OK".

disable superfetch step 1

In the Services window, you will see a list of local services. Scroll down to find "Superfetch" and right-click it. Select "Stop" from the drop-down menu to stop the Superfetch service. Restart the computer for the changes to take effect. After disabling the Superfetch service and restarting the computer, the CPU and Disk usage should return to normal. If this does not solve the problem with the ntoskrnl.exe process, you might want to re-enable the Superfetch service: repeat the steps, but select "Start" where you previousy selected "Stop".

disable superfetch step 2

If you want to disable the Superfetch service permanently, right-click it and select "Properties". In the Superfetch Properties (Local Computer) window, set "Startup type" to "Disabled", click "Stop" and "Apply" to save the changes. If you want to re-enable it, change it from "Disabled" to "Automatic", click "Stop", and then "Apply".

disable superfetch step 3

[Back to Table of Contents]

Perform SFC and DISM Scans

System File Checker (SFC) is a utility in Windows that allows users to scan for corruptions in Windows system files and restore corrupted files. This guide describes how to run the System File Checker tool (SFC.exe) to scan your system files and repair missing or corrupted system files (including .DLL files). If a Windows Resource Protection (WRP) file is missing or is corrupted, Windows may not behave as expected. For example, some Windows functions might not work, or Windows will crash. The "sfc scannow" option is one of several specific switches available with the sfc command, the Command Prompt command used to run System File Checker. To run it, open Command Prompt by typing "command prompt" in Search and then right-click on "Command Prompt". Select "Run as administrator" from the drop-down menu to run Command Prompt with administrator privileges. You must run an elevated Command Prompt to be able to perform a SFC scan.

run sfc and dism scans step 1

In the Command Prompt window, type "sfc /scannow" and press Enter on the keyboard to execute this command. System File Checker will start and should take some time to complete the scan (about 15 minutes). Wait for the scanning process to complete and then restart the computer.

run sfc and dism scans step 2

If the SFC scan does not solve the solve the problem with the ntoskrnl.exe process using too much CPU or Disk, or for some reason you could not run the SFC scan, try to run a Deployment Image Servicing and Management (DISM) scan and then try to run the SFC scan again.

A DISM scan can be used to repair and prepare Windows images, including the Windows Recovery Environment, Windows Setup, and Windows PE. To run a DISM scan, open Command Prompt as administrator and type this command: "DISM /Online /Cleanup-Image /RestoreHealth". Press Enter on the keyboard to execute it.

run sfc and dism scans step 3

We hope that one of these solutions solves the problem and your CPU/Disk usages return to normal. If you know of other methods that solve the problem with the ntoskrnl.exe process using to many CPU or Disk recources, please share them with us by leaving a comment in the section below.

[Back to Table of Contents]

Video Showing How To Fix High CPU Or Disk Usage Caused By ntoskrnl.exe Process:

[Back to Top]

About the author:

Tomas Meskauskas

I am passionate about computer security and technology. I have an experience of 10 years working in various companies related to computer technical issue solving and Internet security. I have been working as an editor for pcrisk.com since 2010. Follow me on Twitter to stay informed about the latest tech news or online security threats. Contact Tomas Meskauskas.

Our guides are free. However, if you want to support us you can send us a donation.