How to fix Cryptographic Services high CPU or disk usage in Windows?

Cryptographic Services (CryptSvc) is the Windows service that checks the signatures of Windows files and installers and keeps root certificates up to date. It is busiest while Windows Update or a program installs, so short spikes are normal. If it stays high, let updates finish, restart the service, then reset the catroot2 folder it works in.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2, with the service description and the catroot2 reset read from Microsoft Learn.

What Cryptographic Services is and why it uses CPU or disk

Cryptographic Services is a built-in Windows service. Its short name is CryptSvc, it starts automatically, and it runs inside a shared Service Host process as Network Service. That is why Task Manager lists it as Service Host: Cryptographic Services and not by a file name of its own.

Why Cryptographic Services uses so much CPU or disk, from most to least common

Most often the load is an update or an install in progress, and it ends on its own. Less often the catalog folder catroot2 is damaged or very large, so the service keeps reading and writing it. Rarely the cause is another program, damaged system files, or malware using the svchost.exe name. Microsoft publishes no statistics; this order comes from its service description and the reports we read.

How to fix Cryptographic Services high CPU or disk usage

Fix 1 takes two minutes and shows whether an update is behind the load. Fix 2 to Fix 4 are specific to this service and solve most cases. Fix 5 is for a Windows Update that keeps failing. Fix 6 to Fix 8 are the general checks.

Fix 1. Confirm it is CryptSvc and check whether something is installing

3 minutesNo riskEveryone, before changing anything. It also tells you whether you only need to wait.

One Service Host line can hold several services, and CryptSvc does most of its work while something installs. Seeing the update or installer behind the load tells you whether to wait or to repair.

1. Press Ctrl + Shift + Esc to open Task Manager. On Windows 10, select More details if you see a short list.
2. On the Processes tab, select the CPU column header so the busiest process is on top. Do the same with Disk.
3. Expand Service Host: Cryptographic Services and check that the service inside is Cryptographic Services.
4. Open the Services tab, find CryptSvc and note its PID. Right-click it and select Go to details to see its svchost.exe.
5. Press Win + I and open Windows Update. Look for a download, an install or Restart required.
6. Check the Microsoft Store Downloads page and any installer you started yourself.

Fix 2. Let Windows Update finish and restart the PC

15 to 40 minutesLow riskWindows Update shows a download, an install or Restart required, or the load began right after an update.

Each update carries catalogs that CryptSvc must check before Windows trusts the new files. While an update is half done, the checks repeat. Finishing it and restarting ends that work for good.

1. Press Win + I and select Windows Update.
2. Select Check for updates and let every download and install finish. Do not stop it halfway.
3. If you see Restart now, save your work and select it.
4. After the restart, wait 10 minutes. Windows often finishes the update in the background.
5. Open Task Manager again as in Fix 1 and watch Service Host: Cryptographic Services.

Fix 3. Restart Cryptographic Services

2 minutesLow riskNothing is installing and the load started recently, often after sleep or a failed update.

A restart ends a CryptSvc session that is stuck on a catalog check and lets it open its database again from a clean state. Restarting is safe; disabling is not, because installs and updates depend on the service.

1. Close installers and pause Windows Update downloads if any are running.
2. Press Win + R, type services.msc and press Enter.
3. Find Cryptographic Services in the list and double-click it.
4. Check that Service name says CryptSvc and Startup type says Automatic.
5. Select Stop, wait until the status changes, then select Start.
6. Leave Startup type as it is. Do not set it to Disabled.
7. Open Task Manager and watch the CPU and Disk columns for two minutes.

From an administrator Command Prompt the same restart is two commands. Step by step for any service: Check and restart Windows services.

Command Prompt (administrator)

net stop cryptsvc
net start cryptsvc

Fix 4. Reset the catroot2 folder so Windows builds a fresh catalog

10 minutesLow riskThe Disk or CPU column stays high for hours with no update running, or updates install very slowly.

The Catalog Database Service keeps its catalog in C:\Windows\System32\catroot2. When that catalog is damaged or bloated, every check reads and rewrites it. Microsoft renames this folder in its own Windows Update reset, and Windows creates a new one.

1. Press the Windows key, type cmd, right-click Command Prompt and select Run as administrator.
2. Type net stop cryptsvc and press Enter. Wait for The Cryptographic Services service was stopped successfully.
3. Right away, type the rename command below and press Enter.
4. Type net start cryptsvc and press Enter.
5. Restart the PC, then open Windows Update and select Check for updates so the new catalog is filled.
6. Watch Task Manager. A short spike while the new catalog is built is normal.

Command Prompt (administrator)

net stop cryptsvc
ren %systemroot%\System32\catroot2 catroot2.bak
net start cryptsvc

Renaming keeps the old folder as catroot2.bak. Once updates install and the load is gone for a few days, you can delete it. The old guide copied the folder and deleted its contents by hand; the rename does the same in one line and is easy to undo.

Fix 5. Reset Windows Update components when an update keeps failing

15 minutesLow riskThe same update fails every day, Windows Update loops, and CryptSvc gets busy each time it retries.

A failed update is downloaded and checked again and again, and each try sends CryptSvc through the same catalogs. Microsoft's reset stops BITS, Windows Update and CryptSvc together, renames SoftwareDistribution and catroot2, and starts them again so the update downloads cleanly.

First try the built-in troubleshooter, which resets what it needs on its own: Run the Windows Update troubleshooter. If that does not help, use the manual reset below.

1. Open Command Prompt as administrator. Type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Stop the update services. Type the commands below and press Enter after each one. If Windows says that other services depend on Cryptographic Services, it stops them too. A message that a service is not started is fine.

   net stop wuauserv
   net stop bits
   net stop cryptsvc

3. Delete the download queue files. This clears the list of downloads that the Background Intelligent Transfer Service keeps. If Windows says it cannot find the files, continue.

   del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"

4. Rename the update cache folders. Renaming keeps a copy in case you need it; Windows creates new, empty folders when the services start again. If you get Access is denied, a service is still running: repeat the previous step.

   ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
   ren %systemroot%\System32\catroot2 catroot2.old

5. Start the services again. Type the commands below and press Enter after each one. The requested service has already been started is fine: Windows started it on its own.

   net start cryptsvc
   net start bits
   net start wuauserv

6. Restart and check for updates. Restart the PC. Then select Start > Settings > Windows Update > Check for updates. The first check can take longer than usual because everything is downloaded again.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Reset Windows Update components

Fix 6. Find a program that keeps CryptSvc busy with a clean boot

15 minutesLow riskWindows is up to date, catroot2 is reset, and the load still comes back.

Updaters, backup tools and security suites from other makers can install or verify signed files all day, and every check goes through CryptSvc. A clean boot starts Windows with only Microsoft services, so you see whether one of them is behind it.

1. Open System Configuration. Select Search on the taskbar, type msconfig and select System Configuration from the results.
2. Hide Microsoft services. On the Services tab, select the Hide all Microsoft services check box. Only services from other companies stay in the list.
3. Disable the remaining services. Select Disable all, then select Apply.
4. Open Task Manager. On the Startup tab of System Configuration, select Open Task Manager.
5. Disable the startup apps. On the Startup apps tab in Task Manager, select each item whose status is Enabled and select Disable. Write down or take a screenshot of the items you disable: you need the list to turn them back on.
6. Confirm the changes. Close Task Manager. On the Startup tab of System Configuration, select OK.
7. Restart and test. Restart the PC. Windows now starts in a clean boot environment: try again the thing that failed (run the app, install the update, uninstall the program).

These steps were written for Windows 11 25H2 and 26H2. The full page with the other versions and what each result means: How to perform a clean boot in Windows

Fix 7. Repair Windows system files with SFC and DISM

20 minutesNo riskThe load stays in a clean boot, or other Windows services and updates fail too.

CryptSvc and the catalogs it checks are system files. If they or the component store are damaged, signature checks can fail and repeat, which shows up as steady CPU use. SFC and DISM replace damaged files with good copies.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

Fix 8. Check the svchost.exe file and scan for malware

15 minutesNo riskGo to Details shows a svchost.exe outside C:\Windows\System32, or the CPU stays high with CryptSvc stopped.

Malware likes the svchost.exe name because many copies of it run on every PC. The real one is always in C:\Windows\System32. A scan with Microsoft Defender rules out anything hiding behind that name.

1. In Task Manager, open the Services tab, right-click CryptSvc and select Go to details.
2. Right-click the highlighted svchost.exe and select Open file location.
3. Check that File Explorer opens C:\Windows\System32.
4. Run a full scan with Microsoft Defender as in How to scan for malware with Microsoft Defender.

Cryptographic Services still uses high CPU or disk: what to check next

If Windows is up to date, catroot2 is fresh, the clean boot is quiet and SFC is clean, collect evidence before you reinstall anything. Windows records what CryptSvc and Windows Update do in a few places.

• Windows Update history: Settings > Windows Update > Update history lists failed updates with their KB numbers and error codes. A failed update that repeats every day is the most common driver of load.
• Event Viewer: press Win + R, type eventvwr.msc, open Windows Logs > System and filter for Service Control Manager. Errors for Cryptographic Services show that it fails to start or stop. Windows Logs > Application holds entries from the CAPI2 source, which belongs to the crypto system.
• Reliability Monitor: type reliability in Start and open View reliability history. A red cross on the day the load began often names the update or app behind it.
• Repair install: as a last step, reinstall Windows over itself and keep your files and apps: Reinstall Windows without losing files.

How to keep Cryptographic Services from flaring up again

• Install updates when Windows offers them and restart when asked. Half-installed updates are what keep CryptSvc checking.
• Leave the PC on and plugged in while a large update installs, instead of putting it to sleep in the middle.
• Keep a few GB free on the C: drive so updates do not fail for lack of space: Free up disk space and delete temporary files.
• Avoid running several updaters and installers of other makers at startup. Turn off the ones you do not need: Stop apps from opening at startup.
• Do not disable CryptSvc or delete catroot2 to save resources. Installs and updates break, and the gain is nothing.

Frequently asked questions

What is Cryptographic Services in Windows?

It is a built-in Windows service, short name CryptSvc, that Microsoft describes as three management services. The Catalog Database Service confirms the signatures of Windows files and allows new programs to be installed. The Protected Root Service adds and removes trusted root certificates. The Automatic Root Certificate Update Service gets root certificates from Windows Update for secure connections such as SSL. It is not malware and it does not encrypt your files. Task Manager shows it as Service Host: Cryptographic Services because it runs in a shared svchost.exe process.

Why does Service Host: Cryptographic Services use so much CPU or disk?

Most often because Windows Update, a Store app, a driver or a program is installing, and every signed file is checked against its catalog. That load ends when the install does. When it does not end, the usual reasons are a service stuck after sleep, a damaged or oversized catalog in the catroot2 folder, or an update that fails and retries. Fix 1 tells you which one is yours in a few minutes.

Is it safe to disable Cryptographic Services?

No. Microsoft says that if you stop it, its management services are unable to function properly and any services that depend on it are unable to start. In practice, Windows Update, Store updates and many installers fail or hang. Users also report that it starts again on its own a few seconds after they stop it, because Windows calls it often. The old version of this guide offered to disable it; we no longer recommend that. Restarting it is safe, as in Fix 3.

Cryptographic Services high disk usage: what helps?

First check whether an update is installing and let it finish, as in Fix 1 and Fix 2. If the Disk column stays high for hours with nothing installing, reset the catroot2 folder as in Fix 4: stop the service, rename the folder to catroot2.bak and start the service again. Windows then builds a fresh catalog. If the disk is busy because the same update keeps failing, use the Windows Update reset in Fix 5.

Is Cryptographic Services different on Windows 11 and Windows 10?

No. The service, its short name CryptSvc, its three jobs and the catroot2 folder are the same on Windows 11 and Windows 10. Only the Settings pages look different. Windows 10 22H2 left support on 14 October 2025, so only PCs enrolled in Extended Security Updates still get updates. On a Windows 10 PC that no longer updates, update-driven load becomes rare, and a stuck catalog (Fix 4) or another program (Fix 6) is the more likely cause.

What does the error the Cryptographic Services service could not be stopped mean?

It means CryptSvc did not stop within the time Windows allows, usually because it is in the middle of a catalog check or another service is using it. Wait a minute and try net stop cryptsvc again from an administrator Command Prompt. If it still will not stop, restart the PC and try again before anything else starts installing. Do not force it by ending svchost.exe in Task Manager; that process hosts other Network Service services too.

Can I delete the catroot2 folder?

Do not delete it while the service is running, and there is no need to delete it at all. Microsoft's Windows Update reset renames it to catroot2.bak after stopping CryptSvc, and Windows builds a new folder when the service starts and updates run again. Renaming keeps a copy you can put back. Once updates install and the PC is calm for a few days, you can delete the .bak folder to get the space back. Fix 4 has the exact commands.

What is Kryptografiedienste?

Kryptografiedienste, also searched as Kryptographiedienst, is the German name of Cryptographic Services in German Windows. It is the same service, CryptSvc, and this page applies to it unchanged. Task Manager and services.msc show the translated name, but the short name CryptSvc, the commands net stop cryptsvc and net start cryptsvc, and the catroot2 folder path are the same in every language of Windows.

What does Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object mean?

It is an Event Viewer entry, not the cause of high CPU. The System Writer is part of the Volume Shadow Copy service that backup tools and System Restore use, and the message says CryptSvc failed to answer it during a backup. We could not confirm the exact cause from a Microsoft page today. If backups also fail, run SFC and DISM as in Fix 7, then check whether your backup tool has an update.