TrustedInstaller.exe

Windows ProcessMicrosoft Corporation

Also called trustedinstaller, windows modules installer, trusted installer

WindowsSystem Component

Windows Modules Installer. It owns protected system files and applies component-store changes during updates.

What you need to know

This account owns System32. High CPU often means an update is writing components.

TrustedInstaller.exe is Windows Modules Installer. It changes the component store. TiWorker.exe does much of the heavy install work. Ending it mid-update can leave a pending reboot stuck.

Safe?: Yes, from servicing
High CPU?: During a component install, yes
Should I end it?: Not while an update is applying

Feex says

If TrustedInstaller is busy after Patch Tuesday, I would let the servicing stack finish. I would not take ownership of System32 to "beat" it.

What is TrustedInstaller.exe?

TrustedInstaller.exe is the Windows Modules Installer host. The TrustedInstaller account is also the owner of many System32 files, which is why Explorer asks for permission.

What does it do?

It starts the servicing stack that adds or removes Windows components and cumulative updates. TiWorker.exe is the worker that often shows the CPU spike.

Why is it running?

An update, a feature on demand, or a component cleanup is running. You should not see it pegged for days on a healthy SSD after updates are idle.

Is it safe?

Usually safe

The legitimate binary lives under C:\Windows\servicing. A TrustedInstaller.exe on the desktop is not the Modules Installer.

A legitimate copy normally runs from:

C:\Windows\servicing\TrustedInstaller.exe

Expected publisher: Microsoft Corporation
Related service: TrustedInstaller / TrustedInstaller
Owns many system ACL entries

Can I end it?

Only after servicing is idle

Stopping it while CBS is writing can leave the component store dirty. Wait for Windows Update to finish, then reboot if it asks.

Can I remove it?

Do not delete TrustedInstaller.exe and do not take ownership of System32 as a performance tip. That breaks servicing.

Should it start with Windows?

The TrustedInstaller service starts on demand when servicing needs it. It is not a chat app in Startup.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Can rise with TiWorker during an install
Memory: Moderate during a large cumulative update
Disk: High while WinSxS is changing
Network: Low here. The download is usually Windows Update

File information

TrustedInstaller.exe file information
Executable name	TrustedInstaller.exe
Common legitimate path	C:\Windows\servicing\TrustedInstaller.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Hours of disk use

A feature update or a stuck CBS session can run long on an HDD. Check Windows Update history before you kill the process.

Access denied on System32

That ACL is by design. Taking ownership to delete a driver is a last-resort repair, not a weekly habit.

Troubleshooting

Diagnose before you change anything destructive.

See if TiWorker is the CPU

TrustedInstaller is the contract. TiWorker is often the worker. Let both finish or reboot if Update says it needs to.

Do not run random "Unlock TrustedInstaller" scripts

Those scripts rewrite system ACLs. That is how PCs stop updating.

Technical details

TrustedInstaller.exe technical details
Image name	TrustedInstaller.exe
Service	TrustedInstaller

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: TrustedInstaller · Servicing and update client stack
Microsoft Support: Windows Modules Installer · Public servicing name
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.