Your system may slow down to a crawl, and when you open Task Manager, you may find the Microsoft Software Protection Platform Service (
sppsvc) utilizing very high CPU (ranging anywhere from 30% to 75%) for a considerably long time. You may be wondering why the Software Protection service is consuming enormous resources.
The Microsoft Software Protection Platform Service (short name:
sppsvc) enables the download, installation, and enforcement of digital licenses for Windows and Windows applications.
The high CPU usage of the Microsoft Software Protection Platform Service is usually attributed to the pirated installation of Windows. The third-party Windows/Office KMS-based (Key Management Service) activator tools like R@1n-KMS or KMSpico are employed by many users to illegally ‘activate’ their non-genuine Windows or Office products.
These activators claim to activate Windows or Office products by setting a local key management server, bypassing the Microsoft activation server. These illegal KMS-based activators are often classified as malicious HackTool by various antivirus programs.
- VirusTotal detection ([email protected])
- Free Automated Malware Analysis Service ([email protected])
- Automated Malware Analysis Report for [email protected] – Joe Sandbox
These illegal KMS programs often run as a service and/or as a scheduled task that executes at frequent intervals. When the Microsoft Software Protection Platform Service (aka, Software Protection service) detects these kinds of programs, you’ll see a huge spike in CPU usage by this service.
[Fix] Microsoft Software Protection Platform (sppsvc) High CPU Usage
The resolve the Microsoft Software Protection Platform (
sppsvc) high CPU usage issue, uninstall all the 3rd party KMS activators, or clean install Windows with a genuine product key.
The KMSpico activator tool installs itself as a service.
Service KMSELDI (Not verified) @ByELDI c:\program files\kmspico\service_kms.exe
The KMS-R@1n activator registers itself as a service in the following registry key:
(Note that Microsoft’s Autoruns utility may not cover the above registry startup launch point.)
And these programs add one or more scheduled tasks. Some of them are listed below:
- AutoPico Daily Restart
Some files you need to watch out for:
- C:\Windows\System32\Tasks\AutoPico Daily Restart
- C:\Windows\[email protected]
- C:\Program Files\KMSpico [folder]
- C:\Program Files\KMSpico\Service_KMS.exe
- C:\Program Files\KMSpico\Service_KMS.exe
- C:\Program Files\KMSpico\WinDivert.sys
After uninstalling these 3rd party KMS-based activators, be sure to run a thorough scan with Malwarebytes (Free) and eliminate malware.
Can I disable the Software Protection Service?
Some users tend to do some of the following things to disable
sppsvc in an attempt to reduce CPU usage.
sppsvc.exeusing the built-in Resource Monitor (
- Disable the Microsoft Software Protection Platform Service (
sppsvc) via the Registry Editor.
- Disable the task named
SvcRestartTasklocated at the following branch in Task Scheduler:
Task Scheduler Library → Microsoft → Windows → SoftwareProtectionPlatform
Note that there are 3 tasks by default (
If the Microsoft Software Protection Platform Service (
sppsvc) is disabled, the operating system and licensed applications may run in a notification mode where you’ll see the watermark saying your copy of Windows is not activated. It is strongly recommended that you not disable the Software Protection service.
One of the above three methods (to disable
sppsvc.exe) may help improve the system performance for the time being. I’d generally advise against those methods.
- As a temporary measure to improve the performance of the computer, you may try suspending
sppsvc.exe.You may also create a desktop shortcut (run as administrator) that will pause (using Windows SysInternals PsSuspend) sppsvc.exe, using the command-line
pssuspend64 sppsvc.exe. To resume it back, create another shortcut with the command-line
pssuspend64 -r sppsvc.exe
Even if your Windows installation is legitimate and still facing the above issues, the above methods are not officially recommended. Doing so would cause the activation watermark to show up on your desktop, and Windows and Office may behave as if they’re not activated.
If your copy of Windows 10 is genuine and still facing the problem, then see if installing/upgrading to the latest available Windows 10 build helps. Does that work? Let’s know your comments.
One small request: If you liked this post, please share this?One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!