# TrustedInstaller.exe

Windows Process: Microsoft Corporation

Also called trustedinstaller, windows modules installer, trusted installer

Windows, System Component

Windows Modules Installer. It owns protected system files and applies component-store changes during updates.

## What you need to know

This account owns System32. High CPU often means an update is writing components.

TrustedInstaller.exe is Windows Modules Installer. It changes the component store. TiWorker.exe does much of the heavy install work. Ending it mid-update can leave a pending reboot stuck.

- **Safe?**: Yes, from servicing

  **High CPU?**: During a component install, yes

  **Should I end it?**: Not while an update is applying

Feex says

If TrustedInstaller is busy after Patch Tuesday, I would let the servicing stack finish. I would not take ownership of System32 to "beat" it.

## What is TrustedInstaller.exe?

TrustedInstaller.exe is the Windows Modules Installer host. The TrustedInstaller account is also the owner of many System32 files, which is why Explorer asks for permission.

## What does it do?

It starts the servicing stack that adds or removes Windows components and cumulative updates. TiWorker.exe is the worker that often shows the CPU spike.

## Why is it running?

An update, a feature on demand, or a component cleanup is running. You should not see it pegged for days on a healthy SSD after updates are idle.

## Is it safe?

Usually safe

The legitimate binary lives under C:\Windows\servicing. A TrustedInstaller.exe on the desktop is not the Modules Installer.

A legitimate copy normally runs from:

`C:\Windows\servicing\TrustedInstaller.exe`

- Expected publisher: Microsoft Corporation
- Related service: TrustedInstaller / TrustedInstaller
- Owns many system ACL entries

## Can I end it?

Only after servicing is idle

Stopping it while CBS is writing can leave the component store dirty. Wait for Windows Update to finish, then reboot if it asks.

## Can I remove it?

No

Do not delete TrustedInstaller.exe and do not take ownership of System32 as a performance tip. That breaks servicing.

## Should it start with Windows?

The TrustedInstaller service starts on demand when servicing needs it. It is not a chat app in Startup.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Can rise with TiWorker during an install

  **Memory**: Moderate during a large cumulative update

  **Disk**: High while WinSxS is changing

  **Network**: Low here. The download is usually Windows Update

## File information

| Executable name        | TrustedInstaller.exe                      |
| ---------------------- | ----------------------------------------- |
| Common legitimate path | C:\Windows\servicing\TrustedInstaller.exe |
| Publisher              | Microsoft Corporation                     |
| Signature expectation  | Signed by Microsoft Windows               |

## Related services

TrustedInstaller is the service name. TiWorker.exe does much of the file work.

Windows Update Windows Service

## Common problems

### Hours of disk use

A feature update or a stuck CBS session can run long on an HDD. Check Windows Update history before you kill the process.

### Access denied on System32

That ACL is by design. Taking ownership to delete a driver is a last-resort repair, not a weekly habit.

## Troubleshooting

Diagnose before you change anything destructive.

### See if TiWorker is the CPU

TrustedInstaller is the contract. TiWorker is often the worker. Let both finish or reboot if Update says it needs to.

### Do not run random "Unlock TrustedInstaller" scripts

Those scripts rewrite system ACLs. That is how PCs stop updating.

## Technical details

Technical details

| Image name | TrustedInstaller.exe |
| ---------- | -------------------- |
| Service    | TrustedInstaller     |

## Related

These entities connect to this article. Type is shown on every link.

[Windows Update: Windows Service](https://feex.it/wiki/service/windows-update)[TiWorker.exe: Windows Process](https://feex.it/wiki/process/tiworker.exe)[Windows Update: Windows Service](https://feex.it/wiki/service/windows-update)[When high CPU is normal: Guide](https://feex.it/wiki/software/system/when-high-cpu-is-normal)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: TrustedInstaller ](https://learn.microsoft.com/windows/win32/wua_sdk/portal-client)· Servicing and update client stack
- [Microsoft Support: Windows Modules Installer ](https://support.microsoft.com/windows)· Public servicing name
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: TrustedInstaller.exe

  **Typical path**: C:\Windows\servicing\TrustedInstaller.exe

  **Related service**: TrustedInstaller

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/trustedinstaller.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)