What TiWorker.exe does and when high CPU is normal
When you click Check for updates, Windows Update downloads the packages and hands them to the servicing stack, where TiWorker unpacks, verifies and installs them into the component store — the WinSxS folder. A feature update keeps TiWorker and its parent TrustedInstaller busy for 20–60 minutes; a monthly cumulative update usually needs a few minutes on an SSD. In that window, 30–50% CPU on a quad-core machine is expected, and the load disappears the moment the installation finishes.
The red flags look different: the CPU stays hot a full day after the last update, TiWorker resurrects the instant you end it in Task Manager, or the spikes return at every boot. On an HDD machine the same work takes several times longer, so give it an hour before judging. You can confirm what it is doing in Task Manager — the process is listed there under the friendly name Windows Modules Installer Worker.
- Open Settings > Windows Update > Update history and check what landed recently and what is still pending
- In Task Manager, sort by CPU and confirm the friendly name Windows Modules Installer Worker on the TiWorker.exe entry
- A restart after a big update clears servicing queues that confuse TiWorker on machines with long uptimes
- Sustained load for days with no updates in the history means the component store or the cache needs repair
- An HDD machine honestly needs several times longer than an SSD for the same update
The repair sequence that actually stops it
First let Windows finish: run Windows Update to the end, reboot, and if a feature update is staged, let it install overnight. Then open an elevated command prompt and repair the component store with DISM /Online /Cleanup-Image /RestoreHealth, followed by sfc /scannow — a corrupted store is the single most common reason TiWorker spins in circles re-verifying packages. Both scans together take 15–30 minutes and need internet access to fetch clean copies of damaged files.
If the load persists, reset the update cache: in the elevated prompt run net stop wuauserv and net stop bits, delete the contents of C:\Windows\SoftwareDistribution\Download, then start both services again with net start. Windows re-downloads only what it truly needs and TiWorker usually goes quiet after one more check. As a last resort, run the Windows Update troubleshooter (Settings > System > Troubleshoot > Other troubleshooters) or do an in-place upgrade with the Windows 11 ISO, which rebuilds servicing without touching your files.
What not to do — and when to worry
Never disable the Windows Modules Installer service or Windows Update itself to silence TiWorker: the machine stops receiving security patches, and the next feature update runs into a wall that can no longer be repaired. Manually deleting files inside C:\Windows\WinSxS is equally off-limits — the folder is a database of hard links, and cutting pieces out of it corrupts the store faster than DISM can fix it. If the spikes only fall inside known update windows, the system is working as designed; glance at Task Manager occasionally and step in only when the pattern breaks the rules above.
Questions and Answers
Is TiWorker.exe a virus?
The genuine one is not: it is Microsoft's update installer, signed and living in the servicing stack. Run a scan only if Task Manager shows a TiWorker.exe from a folder outside Windows, or if your antivirus flags it — malware does occasionally borrow the name.
Can I just end the TiWorker.exe process in Task Manager?
You can, and Windows will restart it when the next update needs it — but the interrupted installation resumes from scratch and can loop. It is better to let it finish or run the repair sequence above.
Why does TiWorker run at high CPU every time I boot?
Usually a stuck or half-installed update that never completes. Check the Update history, run DISM /Online /Cleanup-Image /RestoreHealth and sfc /scannow, and clear the SoftwareDistribution\Download folder if the loop continues.
Know what is included before you buy.
The one-time 30-minute trial covers core tools. PRO-labelled features stay locked until a paid license is activated.
Read next
Write to us: [email protected]