Wednesday, April 10, 2019

What is the RuntimeBroker.exe process in Windows 8?


I was looking through my Task Manager today and saw something called Runtime Broker running:


enter image description here
enter image description here




I've never seen this in previous versions of Windows.
What is it? What does it do?


Answer



Runtime Broker process was created by Microsoft and is a core process in Windows 8.


RuntimeBroker.exe is a safe Microsoft process included in Windows 8 to assist with Metro app permissions. With a light system footprint of more or less 5,000 K of RAM being used, it does not affect performance.


RuntimeBroker.exe is triggered by Metro apps. If there are no Metro apps open, this process won't run.


What does it do?


The Runtime Broker is responsible for checking if a Metro app is declaring all of its permissions (like accessing your Photos) and informing the user whether or not its being allowed. In particular it is interesting to see how it functions when paired with access to hardware, such as an app’s ability to take webcam snapshots. It's serves as a middleman between your apps and your privacy/security.


A quick look through the strings of the process shows the Microsoft definition of Runtimebroker.exe to be part of “Processes for Windows Partial Trust Components.”
Most of its related registry entries and the process itself can be found at:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime
C:\Windows\System32\RuntimeBroker.exe



References: 1, 2


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...