System

Windows ProcessMicrosoft Corporation

Also called system process, ntoskrnl, pid 4

WindowsSystem Component

The kernel process, usually PID 4. It is ntoskrnl work showing up in Task Manager, not a program you installed.

What you need to know

PID 4 is the kernel. It is not an exe you can uninstall.

Task Manager labels kernel-mode work as System. High CPU here is often a driver, not a user app. You cannot end PID 4 and keep Windows.

Safe?: Yes. It is the kernel
Can I end it?: No
Is it System Idle?: No. Idle is leftover time

Feex says

If System is the hot row, I look at drivers and Interrupts next. I do not search for a System.exe to delete. There is not a safe one.

What is System?

System is the kernel process. On current Windows it is almost always PID 4. The image is ntoskrnl.exe, which you do not launch from Start.

What does it do?

It runs kernel threads, deferred procedure calls, and some driver work that has no user-mode host. Memory Compression and Interrupts are listed separately when Windows splits them out.

Why is it running?

The kernel is running. A high System row after you plug in a dock, update a GPU driver, or enable an antivirus filter is a driver lead, not a missing app.

Is it safe?

Usually safe

The System row is the OS. A download named System.exe is not this process. Do not replace PID 4 with a file from the web.

A legitimate copy normally runs from:

C:\Windows\System32\ntoskrnl.exe

Shown as System, not as ntoskrnl.exe, in Task Manager
Typical PID is 4
No End task on a healthy PC

Can I end it?

There is no supported End task for System. Windows will not let you kill the kernel from Task Manager.

Can I remove it?

You cannot uninstall the System process. Deleting ntoskrnl.exe from a running OS is not a cleanup step.

Should it start with Windows?

The boot loader starts the kernel. It is not a Startup Apps entry.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Should be low at idle. Driver storms show up here
Memory: Kernel pools. Not the same as a user app working set
Disk: Can rise during memory manager writeback
Network: Some NDIS work can appear as System

File information

System file information
Executable name	System
Common legitimate path	C:\Windows\System32\ntoskrnl.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

High CPU after a driver install

Roll back the last storage, network, or GPU driver before you reset Windows. System is the messenger.

Confused with System Idle Process

Idle at 95 percent means the CPU is free. System at 95 percent means kernel work is busy. They are opposites.

Troubleshooting

Diagnose before you change anything destructive.

Use the Interrupts and DPC rows as a split

If Interrupts is the hot name, look at hardware. If System stays hot with Interrupts quiet, look at a filter driver.

Do not download System.exe

Filename mills sell a fake fixer. The real process has no installer.

Technical details

System technical details
Display name	System
Typical PID	4
Image	ntoskrnl.exe

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Processes and threads · System process is the kernel
Microsoft Learn: Interrupt affinity · Interrupts are a different row
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.