TiWorker.exe

Windows ProcessMicrosoft Corporation

Also called tiworker, windows modules installer worker

WindowsSystem Component

Windows Modules Installer Worker. It does the heavy file work when TrustedInstaller applies an update.

What you need to know

This is the update worker. The CPU spike is the files changing, not a download named TiWorker.

TiWorker.exe is Windows Modules Installer Worker. It extracts and registers components. High CPU or disk after "Updates are available" is the install, not Defender.

Safe?: Yes, from WinSxS
High CPU after updates?: Common while it installs
Should I end it?: Not mid-install

Feex says

If TiWorker is loud and Windows Update just started a reboot countdown, I would let it work. Ending the worker is how you get a failed cumulative update.

What is TiWorker.exe?

TiWorker.exe is the Windows Modules Installer Worker. TrustedInstaller starts it to change the component store. The path lives under WinSxS, which is why the folder name looks ugly.

What does it do?

It stages payloads, updates catalogs, and can trigger a reboot when the stack requires it. It is not the scan engine and it is not the Start menu.

Why is it running?

A quality update, a feature on demand, or a cleanup after a failed install is running. Idle TiWorker should exit when the session ends.

Is it safe?

Usually safe

A signed TiWorker under WinSxS is expected. A TiWorker.exe in Downloads is not the servicing worker.

A legitimate copy normally runs from:

C:\Windows\WinSxS\<arch>_microsoft-windows-servicingstack\<version>\TiWorker.exe

Expected publisher: Microsoft Corporation
Path includes a servicing-stack version folder
Parent role: TrustedInstaller

Can I end it?

Not during an install

Ending TiWorker mid-write can mark the update failed. If it has been pegged for many hours with no Update activity, reboot once, then look at CBS.log.

Can I remove it?

Do not delete TiWorker.exe from WinSxS. Component Store cleanup is DISM, not Explorer.

Should it start with Windows?

It starts on demand from servicing. You should not add it to Startup Apps.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Often high during the apply phase
Memory: Moderate
Disk: Very high on HDD while WinSxS changes
Network: Usually none. The download already happened

File information

TiWorker.exe file information
Executable name	TiWorker.exe
Common legitimate path	C:\Windows\WinSxS\<arch>_microsoft-windows-servicingstack\<version>\TiWorker.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Stuck at 100% disk

An HDD and a large cumulative update can take hours. An SSD that stays maxed for a day with no Update progress needs CBS troubleshooting.

Confused with MsMpEng

Defender scans after new files land. TiWorker is the writer. They can overlap, but they are different binaries.

Troubleshooting

Diagnose before you change anything destructive.

Open Windows Update history first

If an update is installing, wait or reboot when asked. Process Explorer is optional after that.

DISM restore health only after a failed state

Do not run DISM weekly because TiWorker ran once.

Technical details

TiWorker.exe technical details
Image name	TiWorker.exe
Role	Windows Modules Installer Worker

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Support: high CPU during updates · Servicing worker during install
Microsoft Learn: Windows · Primary Windows documentation
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.