How to Find What's Using 100% CPU or Disk on Windows
Short answer
Open Task Manager with Ctrl+Shift+Esc, click the CPU or Disk column to sort, and watch for ten seconds rather than reading one snapshot. If the culprit is svchost.exe or System, switch to the Details tab or open Resource Monitor to see which service or which file is responsible — those two names are containers, not causes.
On this page
“100% disk usage” and “100% CPU” are symptoms with dozens of possible causes, and the generic advice — disable startup apps, run a cleanup, defragment — helps only when you happen to guess right.
Windows ships three tools that answer the question directly. Used in order, they take about ten minutes and they name the actual process, the actual file, and in most cases the reason.
Start with Task Manager
Press Ctrl+Shift+Esc. If it opens compact, click More details.
On the Processes tab, click the CPU or Disk column header to sort descending. Then wait — watch for ten to fifteen seconds rather than reading a single frame. Windows samples these figures on an interval, and a process that spikes momentarily looks identical to one that is stuck until you watch it.
The entry that stays at the top is your candidate.
Three names that mean “look deeper”
| Name | What it really is | Where to look next |
|---|---|---|
svchost.exe |
A container running Windows services | Details tab, or expand it |
| System | The Windows kernel and drivers | Resource Monitor → Disk |
| System Interrupts | Hardware signalling the CPU | Device Manager — a driver |
For svchost.exe, expand the arrow next to it on the Processes tab and Windows
names the services inside. Alternatively, right-click → Go to details,
right-click the highlighted line → Go to service(s), and the specific
services are selected for you.
The usual answers are wuauserv (Windows Update), DoSvc (Delivery
Optimisation, which uploads updates to other PCs), WSearch (Search indexing) or
BITS.
System Interrupts above a few percent is a driver problem, not a software one. Network, storage and chipset drivers are the usual causes, and updating from the hardware vendor’s site rather than Windows Update is the fix.
The processes that are almost always the answer
Five names account for most cases, and four of them are Windows doing legitimate work:
- Antimalware Service Executable (
MsMpEng.exe) — Defender scanning. Heavy during a scheduled scan and after large file operations. It finishes. - Windows Modules Installer Worker (
TiWorker.exe) — an update installing. Can run for an hour on a slow drive. Let it complete. - Microsoft Compatibility Telemetry (
CompatTelRunner.exe) — periodic data collection. Saturates a mechanical drive and finishes on its own. - SearchIndexer.exe — building the search index. Useful on an SSD, painful on an HDD.
- Runtime Broker — mediates app permissions. Sustained high CPU here usually points at one misbehaving Store app.
The distinction that matters is temporary versus permanent. Any of these running hard for twenty minutes is normal. Any of them running hard every hour, every day, is worth acting on.
Resource Monitor names the file
Task Manager tells you which process. When the answer is System or a disk problem with no obvious owner, you need to know which file — and that is Resource Monitor.
Press Win+R, type resmon, press Enter. Go to the Disk tab.
The top panel lists processes by disk activity. Expand Disk Activity below it and you get every file being read or written right now, with the process responsible and the bytes per second.
This is the single most useful diagnostic view in Windows. It tells you, for
example, that your 100% disk is a backup tool walking your photo library, or a
game launcher verifying assets, or pagefile.sys being hammered — which means
your real problem is memory, not disk.
The CPU tab has an equivalent detail view, and the Memory tab’s Hard Faults/sec figure is the one to watch: sustained hard faults mean Windows is paging to disk because you are out of RAM.
When “100% disk” actually means “out of memory”
This catches a lot of people. When physical memory fills, Windows moves memory
pages to pagefile.sys on disk. Disk usage hits 100%, everything stalls, and
Task Manager’s Disk column looks like the problem.
Check Performance → Memory. If Committed exceeds your physical RAM, or Resource Monitor shows sustained hard faults, the disk activity is a symptom. Adding disk speed helps marginally; adding RAM or closing applications fixes it.
The browser is usually the largest consumer, and Chrome’s per-process architecture makes it the most visible — how to fix Chrome using too much RAM covers finding the specific tab.
Rule out a failing drive
If disk usage sits at 100% while throughput is almost nothing — kilobytes per second, not megabytes — the drive itself may be failing, retrying reads until they succeed.
Open Terminal or PowerShell as administrator:
Get-PhysicalDisk | Select-Object FriendlyName, MediaType, HealthStatusAnything other than Healthy means back up now. For a fuller picture, install
the drive manufacturer’s utility and read the SMART attributes — reallocated
sector counts above zero on an HDD, or a low remaining-life percentage on an SSD,
are both reasons to replace it.
Event Viewer explains the pattern
If the spike happens on a schedule and you cannot see why, open Event Viewer
(eventvwr) → Windows Logs → System, and look at the timestamps around a
spike.
Task Scheduler (Win+R → taskschd.msc) is the companion: Task Scheduler
Library → Microsoft → Windows contains dozens of maintenance tasks, and a
misconfigured one running hourly instead of weekly is a real and reasonably
common cause.
Once you have the name
- A program you recognise — close it, update it, or reinstall it.
- A Windows service doing legitimate work — let it finish once. If it repeats daily, narrow its scope: exclude large folders from Search indexing, limit Delivery Optimisation under Settings → Windows Update → Advanced options → Delivery Optimisation, or schedule Defender scans for a time you are not using the machine.
- Something you do not recognise — right-click → Open file location. If it lives in a temp or AppData folder under a random name, run a full Defender offline scan.
- System Interrupts — update chipset, storage and network drivers.
What not to do
- Do not end processes at random. Ending a Windows service process can force a reboot mid-write.
- Do not disable Windows Update or Defender to stop the activity. You trade a temporary slowdown for a permanent security problem.
- Do not disable Search indexing wholesale when excluding two folders solves it.
- Do not install a “PC optimiser”. Everything in this guide is built in, and the optimiser becomes another process competing for your CPU.
Realistic expectations
Identifying the culprit takes about ten minutes with these three tools, and in most cases the answer is a Windows maintenance task that will finish on its own or one application behaving badly.
If nothing stands out and the machine is still slow, the bottleneck is capacity rather than a rogue process — not enough RAM, a mechanical hard drive, or thermal throttling. Why Windows is slow walks through telling those three apart.