Windows Modules Installer — the process you know as TrustedInstaller.exe — has one of the worst reputations in Task Manager. It appears out of nowhere, seizes 30–80% of your CPU, and gives no indication of what it is doing or when it will stop. Most of the time, it is doing legitimate work: installing updates, configuring features, optimizing frameworks. But when it never stops, the line between “working” and “wedged” matters — and this guide shows you how to tell.

The troubleshooting order here is: verify it is genuine, check whether it has real work to do, give legitimate work a fair window, then unstick it if it is genuinely wedged. No disabling, no deleting — just diagnosis and targeted fixes.

Why this happens

  • Legitimate update installation: TrustedInstaller does the actual file replacement during Windows updates — heavy CPU is normal while it works.
  • A failed update retrying: A corrupted update package fails, Windows retries, it fails again — an endless high-CPU loop.
  • Corrupted component store: Damage in the WinSxS store makes every install operation struggle and retry.
  • Pending feature installations: Optional features, language packs, or .NET updates queued in the background keep the installer busy across reboots.
  • Post-feature-update optimization: After big updates, framework optimization (ngen) runs under the installer’s umbrella for a day or two.
  • Stuck update cache: A damaged SoftwareDistribution cache feeds the installer bad data indefinitely.
  • Third-party “debloating” damage: Aggressive debloat scripts that rip out system components leave the installer trying to service components that no longer exist properly.

How to fix it

Work through these in order — diagnose first, then act.

Fix 1: Verify the process is genuine

  1. In Task Manager, right-click Windows Modules Installer Worker → Open file location.
  2. The genuine executable is C:\Windows\servicing\TrustedInstaller.exe. Anything else is malware wearing the name.
  3. If genuine, check the Details tab to see if it is actually consuming CPU right now or just sitting in the list — reputation exceeds reality in many reports.
  4. If it is genuine and currently burning CPU, continue to determine whether it has legitimate work.

Fix 2: Check for real pending work

  1. Open Settings → Windows Update and look for anything downloading, installing, or pending restart.
  2. Check Update history for failed items — a failed update with retries scheduled is the single most common “wedged” cause.
  3. Go to Settings → Apps → Optional features and check for features stuck “installing.”
  4. If there is genuine pending work, give it a fair window (Fix 3) before treating it as stuck. Our post-update slowness guide covers the normal background workload that accompanies updates.

Fix 3: Give legitimate work a fair window

  1. Plug in the charger, close heavy apps, and let the laptop idle for 2–3 hours so the installer can work uncontested.
  2. Watch Windows Update progress — if the percentage or phase advances, it is working, not stuck. Patience is the fix.
  3. Check disk activity in Task Manager → Performance → Disk: real installer work shows sustained reads/writes; a wedged installer often shows high CPU with little disk activity.
  4. Only proceed to the unsticking fixes if hours pass with zero progress or the same failure repeating.

Fix 4: Run the Windows Update troubleshooter

  1. Go to Settings → System → Troubleshoot → Other troubleshooters → Windows Update → Run.
  2. Apply everything it recommends and restart when asked.
  3. The troubleshooter resets update components, re-registers DLLs, and clears common corruption — the gentle fix before manual surgery.
  4. After restarting, check whether TrustedInstaller settles within an hour of normal use.

Fix 5: Repair the component store with DISM

  1. Open an elevated Command Prompt and run: DISM /Online /Cleanup-Image /RestoreHealth.
  2. Let it complete (15–30 minutes) — this repairs the WinSxS component store the installer works from.
  3. Follow with sfc /scannow to repair protected system files.
  4. Restart and observe. A corrupted component store is the deep cause behind many “TrustedInstaller never finishes” cases, and DISM is the purpose-built fix. Component-store background is documented on the Microsoft support site .

Fix 6: Clear the update cache manually

  1. Elevated Command Prompt: net stop wuauserv, net stop bits, net stop cryptSvc, net stop msiserver.
  2. Rename the cache folders: ren C:\Windows\SoftwareDistribution SoftwareDistribution.old and ren C:\Windows\System32\catroot2 catroot2.old.
  3. Restart the services: net start wuauserv, net start bits, net start cryptSvc, net start msiserver.
  4. Check for updates again — Windows rebuilds fresh caches and the installer gets clean data. Delete the .old folders after a week of stable updates.

Fix 7: Set the service sanely and monitor

  1. Press Win + R → services.msc → find Windows Modules Installer — its startup type should be Manual (the default). If something set it to Disabled, restore Manual.
  2. If a specific KB keeps failing, download it manually from the Microsoft Update Catalog and install it directly — this bypasses whatever is wedging the automatic path.
  3. As a final check for companion symptoms, our Service Host CPU guide covers the svchost-side CPU spikes that often accompany installer trouble.
  4. If TrustedInstaller is calm but the system is still slow, the bottleneck moved — re-diagnose rather than assuming the installer is still at fault.

Closing

Windows Modules Installer high CPU is a question with two answers: it is either working (give it hours, plugged in, undisturbed) or wedged (troubleshooter, DISM, cache clear, manual KB install). Diagnose which one you have before touching anything, and the most-feared process in Task Manager becomes just another background worker that finishes its job and goes quiet.

The broader lesson applies to every mysterious Windows process: check what it is supposed to be doing before deciding it is misbehaving. Most of the scary entries in Task Manager are legitimate workers having a bad day, not malware or bloat. A few minutes of diagnosis — update history, event logs, a targeted troubleshooter — separates the bad days from the real problems, and saves you from “fixes” that break more than they repair.

Frequently asked questions

What is Windows Modules Installer and is it safe?
Windows Modules Installer — shown as TrustedInstaller.exe — is the Windows component that installs updates, optional features, and system components. It is completely legitimate and essential. High CPU from it usually means it is actively installing something, but if it never finishes, the installation is wedged and the steps in this guide will unstick it.
How long should Windows Modules Installer run at high CPU?
During an active update or feature installation, 30 minutes to a few hours is normal — it is doing real work. Beyond 3–4 hours with no progress in Windows Update, or high CPU at every single boot with nothing pending, it is stuck rather than working. The diagnostic steps below tell the difference definitively.
Can I disable Windows Modules Installer to stop the CPU usage?
You can set the service to Manual, but you should not disable it — Windows Update and optional-feature installs depend on it, and disabling it breaks updating entirely. The correct fix is un-wedging whatever it is stuck on, which returns it to idle without sacrificing updates. Disabling is a cure worse than the disease.
Why does TrustedInstaller run at startup every day?
It runs when Windows has pending work: updates to install, features to configure, or maintenance tasks like .NET optimization. If it runs briefly and exits, that is normal. If it runs at high CPU at every boot for weeks, something in its queue is failing and retrying — check Windows Update history for a repeatedly failing item.