Cryptographic Services

Windows ServiceMicrosoft Corporation

Also called cryptsvc, cryptographic services

WindowsMicrosoft

The Windows service that handles catalog database, certificate services, and some driver signing work. Windows Update needs it.

What you need to know

This maintains catalogs and certificates. It is not BitLocker and it is not Defender.

CryptSvc backs the catalog database Windows uses to trust drivers and updates. A busy Cryptographic Services during Update is expected work. Disabling it is a common reason Update fails.

Important?: Yes, for Update and catalogs
High CPU?: A catalog rebuild or a stuck Update
Safe to disable?: No

Feex says

If Update is stuck and CryptSvc is busy, I would let the catalog work finish. I would not disable Cryptographic Services to save a core.

What does this service do?

Display name: Cryptographic Services. Service name: CryptSvc.

It maintains the catalog files under Catroot, helps certificate propagation, and supports driver signature checks. BitLocker is a different feature set.

History on Windows

Still present

Cryptographic Services as CryptSvc has been part of Windows since the Windows 2000 era crypto and catalog work, and it remained required for driver signing and Windows Update through XP, Vista, and every later client release. The service is still CryptSvc on Windows 10 and Windows 11.

Cryptographic Services service history
First widely shipped as CryptSvc	Windows 2000 era catalog and crypto services
Still present	Yes, including Windows 10 and Windows 11
Discontinued	No

Why does Windows need it?

Windows Update, driver install, and some Store trust checks read catalogs. Without CryptSvc those checks fail.

When does it run?

It should run. CPU rises while rebuilding catroot2 or applying a cumulative update.

Should it always be running?

Automatic is the default. Disabled is a known Update-breaker.

Can I disable it?

Do not disable CryptSvc. If Update is stuck, restart the service and, after you confirm corruption, rebuild catroot2 using Microsoft's steps. Leaving it off is not a cleanup.

What happens if I disable it?

Windows Update and many signed driver installs fail. Event Log will fill with crypto and catalog errors.

Process host

CryptSvc commonly runs inside svchost.exe. See svchost.exe.

Dependencies

Cryptographic Services dependencies
Depends on	RPC
Used by	Windows Update, servicing, and driver setup

Resource behavior

CPU: Can rise during catalog work
Disk: Catroot and catroot2
Memory: Moderate during a rebuild
Network: Low here. Update is another service

Common problems

Stuck Update plus high CryptSvc

Wait, then restart Windows Update and CryptSvc. Rebuilding catroot2 is a documented repair after that.

People delete catroot2 in Explorer while the service runs

Stop the service first, follow Microsoft's rename steps, then start it.

Troubleshooting

Safe steps first.

Confirm CryptSvc is Running before you repair Update

services.msc. Startup type Automatic.

Do not download a CryptSvc.exe

There is no supported standalone installer. The service host is svchost.

Technical details

CryptSvc technical details
Display name	Cryptographic Services
Service name	CryptSvc

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: Cryptographic Services · Crypto stack
Microsoft Support: Windows Update and CryptSvc · Update dependencies
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.