{"id":19416,"date":"2020-10-20T16:56:57","date_gmt":"2020-10-20T11:26:57","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=19416"},"modified":"2023-08-08T20:05:49","modified_gmt":"2023-08-08T14:35:49","slug":"software-protection-platform-service-sppsvc-high-cpu-usage","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/software-protection-platform-service-sppsvc-high-cpu-usage\/","title":{"rendered":"[Fix] Microsoft Software Protection Platform (sppsvc) High CPU Usage"},"content":{"rendered":"<p>Your system may slow down to a crawl, and when you open Task Manager, you may find the Microsoft Software Protection Platform Service (<code>sppsvc<\/code>) utilizing very high CPU (ranging anywhere from 30% to 75%) for a considerably long time. You may be wondering why the Software Protection service is consuming enormous resources.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-19417 size-full\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppvc-high-cpu-usage.jpg\" alt=\"microsoft software protection service sppsvc high cpu usage\" width=\"661\" height=\"592\" \/><!--more--><\/p>\n<h2>Cause<\/h2>\n<p>The Microsoft Software Protection Platform Service (short name: <code>sppsvc<\/code>) enables the download, installation, and enforcement of digital licenses for Windows and Windows applications.<\/p>\n<p>The high CPU usage of the Microsoft Software Protection Platform Service is usually attributed to the pirated installation of Windows. The third-party Windows\/Office KMS-based (Key Management Service) activator tools like <strong>R@1n-KMS<\/strong> or <strong>KMSpico<\/strong> are employed by many users to illegally &#8216;activate&#8217; their non-genuine Windows or Office products.<\/p>\n<p>These activators claim to activate Windows or Office products by setting a local key management server, bypassing the Microsoft activation server.\u00a0These illegal KMS-based activators are often classified as malicious <em>HackTool<\/em> by various antivirus programs.<\/p>\n<ul>\n<li><a href=\"https:\/\/www.virustotal.com\/gui\/file\/7565255f0a28d065f8f30f876e7df3e46ef2e6fedf420eca7d454cf49887b2de\/detection\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">VirusTotal detection (KMS-R@1n.exe)<\/a><\/li>\n<li><a href=\"https:\/\/www.hybrid-analysis.com\/sample\/7565255f0a28d065f8f30f876e7df3e46ef2e6fedf420eca7d454cf49887b2de\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Free Automated Malware Analysis Service (KMS-R@1n.exe)<\/a><\/li>\n<li><a href=\"https:\/\/www.joesandbox.com\/analysis\/218150\/0\/html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Automated Malware Analysis Report for KMS-R@1n.exe &#8211; Joe Sandbox<\/a><\/li>\n<\/ul>\n<p>These illegal KMS programs often run as a service and\/or as a scheduled task that executes at frequent intervals. When the Microsoft Software Protection Platform Service (aka, Software Protection service) detects these kinds of programs, you&#8217;ll see a huge spike in CPU usage by this service.<\/p>\n<h2>[Fix] Microsoft Software Protection Platform (sppsvc) High CPU Usage<\/h2>\n<p>The resolve the Microsoft Software Protection Platform (<code>sppsvc<\/code>) high CPU usage issue, uninstall all the 3rd party KMS activators, or clean install Windows with a genuine product key.<\/p>\n<p>The KMSpico activator tool installs itself as a service.<\/p>\n<pre>Service KMSELDI\r\n(Not verified) @ByELDI\r\nc:\\program files\\kmspico\\service_kms.exe<\/pre>\n<figure id=\"attachment_19420\" aria-describedby=\"caption-attachment-19420\" style=\"width: 770px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-19420 size-full\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/kmspico-service.png\" alt=\"microsoft software protection service sppsvc high cpu usage\" width=\"780\" height=\"465\" srcset=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/kmspico-service.png 780w, https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/kmspico-service-768x458.png 768w\" sizes=\"auto, (max-width: 780px) 100vw, 780px\" \/><figcaption id=\"caption-attachment-19420\" class=\"wp-caption-text\">KMSpico service, as listed in the Windows SysInternals <a href=\"https:\/\/www.winhelponline.com\/blog\/clean-boot-windows-autoruns\/\">Autoruns<\/a> tool.<\/figcaption><\/figure>\n<p>The KMS-R@1n activator registers itself as a service in the following registry key:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19421\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/kms-service.png\" alt=\"microsoft software protection service sppsvc high cpu usage\" width=\"698\" height=\"390\" \/><\/p>\n<pre>HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\FirstBoot\\Services\\KMS-R@1n<\/pre>\n<p><em>(Note that Microsoft&#8217;s Autoruns utility may not cover the above registry startup launch point.)<\/em><\/p>\n<p>And these programs add one or more scheduled tasks. Some of them are listed below:<\/p>\n<ul>\n<li>R@1n-KMS\\Windows64Professional<\/li>\n<li>R@1n-KMS\\Office16ProPlus<\/li>\n<li>R@1n-KMS\\Office16VisioPro<\/li>\n<li>R@1n-KMS\\Office16ProjectPro<\/li>\n<li>R@1n-KMS\\Windows63Professional<\/li>\n<li>R@1n-KMS\\Office15ProPlus<\/li>\n<li>R@1n-KMS\\Office365ProPlus<\/li>\n<li>R@1n-KMS\\Office14x64ProP<\/li>\n<li>R@1n-KMS\\Windows64Core<\/li>\n<li>R@1n-KMS\\Windows64Professional<\/li>\n<li>R@1n-KMS\\KMS-Restart<\/li>\n<li>AutoPico Daily Restart<\/li>\n<\/ul>\n<p>Some files you need to watch out for:<\/p>\n<ul>\n<li>C:\\Windows\\System32\\Tasks\\R@1n-KMS\\Windows64Professional<\/li>\n<li>C:\\Windows\\System32\\Tasks\\AutoPico Daily Restart<\/li>\n<li>C:\\Windows\\KMS-R@1n.exe<\/li>\n<li>C:\\Program Files\\KMSpico [folder]<\/li>\n<li>C:\\Program Files\\KMSpico\\Service_KMS.exe<\/li>\n<li>C:\\Program Files\\KMSpico\\Service_KMS.exe<\/li>\n<li>C:\\Program Files\\KMSpico\\WinDivert.sys<\/li>\n<\/ul>\n<p>After uninstalling these 3rd party KMS-based activators, be sure to run a thorough scan with Malwarebytes (Free) and eliminate malware.<\/p>\n<h3>Can I disable the Software Protection Service?<\/h3>\n<p>Some users tend to do some of the following things to disable <code>sppsvc<\/code> in an attempt to reduce CPU usage.<\/p>\n<ul>\n<li>Suspend <code>sppsvc.exe<\/code> using the built-in <a href=\"https:\/\/www.winhelponline.com\/blog\/find-process-locked-file-openfiles-utility\/\">Resource Monitor<\/a> (<code>resmon.exe<\/code>) utility.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19423\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppsvc-suspend-resmon.png\" alt=\"microsoft software protection service sppsvc high cpu usage\" width=\"700\" height=\"320\" \/><\/li>\n<li>Disable the Microsoft Software Protection Platform Service (<code>sppsvc<\/code>) via the Registry Editor.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19422\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sppsvc-disable-service.png\" alt=\"microsoft software protection service sppsvc high cpu usage\" width=\"700\" height=\"368\" \/><\/li>\n<li>Disable the task named <code>SvcRestartTask<\/code> located at the following branch in Task Scheduler:\n<pre>Task Scheduler Library \u2192 Microsoft \u2192 Windows \u2192 SoftwareProtectionPlatform<\/pre>\n<p><em>Note that there are 3 tasks by default (<code>SvcRestartTask<\/code>, <code>SvcRestartTaskLogon<\/code>, and <code>SvcRestartTaskNetwork<\/code>)<\/em><\/li>\n<\/ul>\n<p>If the Microsoft Software Protection Platform Service (<code>sppsvc<\/code>) is disabled, the operating system and licensed applications may run in a notification mode where you&#8217;ll see the watermark saying your copy of Windows is not activated. It is strongly recommended that you not disable the Software Protection service.<\/p>\n<h4>My verdict<\/h4>\n<p>One of the above three methods (to disable <code>sppsvc.exe<\/code>) may help improve the system performance for the time being. I&#8217;d generally advise against those methods.<\/p>\n<ul>\n<li>As a <strong>temporary<\/strong> measure to improve the performance of the computer, you may try suspending <code>sppsvc.exe<\/code>.<img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-6338 alignleft\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/07\/icotip.gif\" alt=\"tips bulb icon\" width=\"34\" height=\"34\" \/>You may also create a desktop shortcut (run as administrator) that will pause (using Windows SysInternals <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/pssuspend\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">PsSuspend<\/a>) sppsvc.exe, using the command-line <code>pssuspend64 sppsvc.exe<\/code>. To resume it back, create another shortcut with the command-line <code>pssuspend64 -r sppsvc.exe<\/code><\/li>\n<\/ul>\n<p>Even if your Windows installation is legitimate and still facing the above issues, the above methods are not officially recommended. Doing so would cause the activation watermark to show up on your desktop, and Windows and Office may behave as if they&#8217;re not activated.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19419\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/activate-windows.jpg\" alt=\"microsoft software protection service sppsvc high cpu usage\" width=\"296\" height=\"170\" \/><\/p>\n<p>If your copy of Windows 10 is genuine and still facing the problem, then see if installing\/upgrading to the latest available <a href=\"https:\/\/www.winhelponline.com\/blog\/find-windows-10-build-version-edition-bit\/\">Windows 10 build<\/a> helps. Does that work? Let&#8217;s know your comments.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Your system may slow down to a crawl, and when you open Task Manager, you may find the Microsoft Software Protection Platform Service (sppsvc) utilizing very high CPU (ranging anywhere from 30% to 75%) for a considerably long time. You may be wondering why the Software Protection service is consuming enormous resources.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6,8],"tags":[],"class_list":["post-19416","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows-10"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":70989,"url":"https:\/\/www.winhelponline.com\/blog\/defender-100-cpu-usage-full-scan\/","url_meta":{"origin":19416,"position":0},"title":"[Fix] Windows Defender 100% CPU Usage During Full Scan","author":"Ramesh","date":"January 26, 2024","format":false,"excerpt":"When you run a full scan using Microsoft Defender Antivirus, about 30 seconds to 1 minute into the scan, the CPU usage spikes and uses up all the remaining CPU. Its CPU usage remains at 100% throughout the full scan. The CPU fan becomes loud. Due to this issue, systems\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Windows Defender CPU usage during full scan - CPU throttle enabled","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/01\/defender-full-scan-cpu-throttle-on.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/01\/defender-full-scan-cpu-throttle-on.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/01\/defender-full-scan-cpu-throttle-on.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/01\/defender-full-scan-cpu-throttle-on.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/01\/defender-full-scan-cpu-throttle-on.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":75787,"url":"https:\/\/www.winhelponline.com\/blog\/wmi-high-cpu-and-memory\/","url_meta":{"origin":19416,"position":1},"title":"Fix: WMI consuming High CPU and Memory","author":"Ramesh","date":"July 2, 2024","format":false,"excerpt":"When you open Task Manager to investigate a sluggish computer, you may see that the WMI Provider Host (WmiPrvSE.exe) process uses a lot of CPU and memory. Here's a screenshot from another computer where the Windows Management Instrumentation service (Winmgmt) occupies more CPU usage on some systems than on a\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"ASUS lightingservice.exe high cpu usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/lighting-service-high-cpu.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":18635,"url":"https:\/\/www.winhelponline.com\/blog\/pc-doctor-module-high-cpu-memory-and-disk-usage-and-slowdown\/","url_meta":{"origin":19416,"position":2},"title":"&#8220;PC-Doctor Module&#8221; High CPU, Memory, Disk Usage and Slowdown","author":"Ramesh","date":"September 16, 2020","format":false,"excerpt":"Occasionally, your system may slow down to a crawl due to the PC-Doctor Module process that runs in the background. When this happens, it can take several seconds to open the Task Manager or any program. The Task Manager may show that a process named PC-Doctor Module is occupying 100%\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"dell pc-doctor module 100% cpu and memory usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/09\/dell-pc-doctor-high-cpu-7.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":26889,"url":"https:\/\/www.winhelponline.com\/blog\/disable-filtering-platform-connection-audit-event-logging\/","url_meta":{"origin":19416,"position":3},"title":"Disable &#8220;Filtering Platform Connection&#8221; (Event ID 5156, 5158) Security Logging","author":"Ramesh","date":"July 19, 2022","format":false,"excerpt":"When you open the Security Event log, the log may contain many \"Filtering Platform Connection\" events. The event ID of these entries maybe 5156 or 5158. The security log may record close to 100 events per minute, containing the event ID 5156 or 5158. This causes the security event log\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"malwarebytes brute force 5156 5158 wfp event log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/malwarebytes-brute-force-wfp-5156-event.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/malwarebytes-brute-force-wfp-5156-event.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/malwarebytes-brute-force-wfp-5156-event.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/07\/malwarebytes-brute-force-wfp-5156-event.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5125,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/","url_meta":{"origin":19416,"position":4},"title":"Microsoft Defender: &#8220;Managed by your administrator&#8221; or &#8220;Your IT administrator has limited access&#8221;","author":"Ramesh","date":"January 23, 2017","format":false,"excerpt":"In the aftermath of a malware attack, the Windows Defender Security settings page may show the message Some settings are managed by your organization\u00a0or This setting is managed by your administrator. The real-time protection and cloud-based protection options may remain disabled or grayed out. Here is what the Windows Defender\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Microsoft Defender Antivirus group policy settings","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":26773,"url":"https:\/\/www.winhelponline.com\/blog\/kb5007651-0x80070643-security-platform-update\/","url_meta":{"origin":19416,"position":5},"title":"Error 0x80070643 Installing KB5007651 (Update for Windows Security platform)","author":"Ramesh","date":"June 17, 2022","format":false,"excerpt":"Windows 11 users are seeing the error 0x80070643 (\"Fatal error during installation\") when installing KB5007651 (Update for Windows Security platform) via Windows Update. Here's the error message verbatim: Updates failed Update for Windows Security platform - KB5007651 (Version 1.0.2109.27002) Install error - 0x80070643 [Fix] Error 0x80070643 Installing KB5007651 Many users\u2026","rel":"","context":"In &quot;Windows 11&quot;","block_context":{"text":"Windows 11","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-11\/"},"img":{"alt_text":"kb5007651 error 80070643","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/06\/kb5007651-error-80070643-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/19416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=19416"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/19416\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=19416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=19416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=19416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}