ntoskrnl.exe High CPU or Disk Usage on Windows 10 [Solved]

By Sophie Luo in Common Errors

If your Windows 10 is working slowly, and when you check your Task Manager and find that the System item is hogging much of your CPU (or Disk in some cases) usage, you’re not alone. Many Windows users are reporting this problem. No worries, it’s possible to fix. 

* Right-click the System item and click Properties, you’ll see a new item called ntoskrnl.exe

What is ntoskrnl.exe? 

Ntoskrnl.exe, short for Windows NT operating system kernel, is a fundamental part of the system. Usually, when you see the uncommon usage of high CPU or memory, you should shut down the possible programs that are causing the problem. 

If this happens a lot, you should see if there is something wrong with certain application settings or file in your system. 

How do I fix it? 

Here are 4 methods for you to try. You may not have to try them all; just work your way down until you find the one works for you. 

Method 1: Disable Windows Search Service
Method 2: Check Incompatible Programs 
Method 3: Run Command   
Method 4: Use Windows Performance Toolkit to Diagnose

NOTE: It is always suggested that you keep your device drivers updated so as to eliminate the possibility of such problems. 

Driver Easy is a tool that detects, downloads and updates drivers (if you go Pro). You can use it to fix any driver problems. If you go Pro, you can even update all drivers with just one-click. If the high system CPU usage problem is caused by drivers, you can use Driver Easy to fix it quickly. Download the Free version to have a try now! 

Method 1: Disable Windows Search Service

1) On your keyboard, press the Windows key and X at the same time, then click Computer management

2) Expand Services and Applications and click Services.

3) Double-click Windows Search

4) In General tab, click Stop

5) Wait for the service to stop, then press OK to save the change and exit. 

Method 2: Check Incompatible Programs 

Some users say that this only happens when they use certain programs. Especially when they have antivirus software running in the background. The antivirus software might have some conflicts with certain programs. The next time you ever encounter this situation, try to pay extra attention to see if you can find the program that is messing with your system. If such program can be located, try reinstall it or uninstall it completely. 

Method 3: Run Command

1) On your keyboard, press the Windows key and type cmd. Right-click Command Prompt and click Run as administrator

2) Type: Dism /Online /Cleanup-Image /RestoreHealth and press Enter. The process might take up a few minutes to complete. 

3) The problem should be gone after this. If problem persists, please try running this command one more time after a reboot. 

Method 4: Use Windows Performance Toolkit to Diagnose

1) Install Windows Performance Toolkit (WPT). Learn more from this page

2) On your keyboard, press the Windows key and type cmd. Right-click Command Prompt and click Run as administrator

3) Copy and paste the following command in: 

xperf -on latency -stackwalk profile -buffersize 1024 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d cpuusage.etl

4) Run this command for 60 seconds to capture the high CPU usage. The trace will run and then give you a warning then revert to a C:\prompt. 

5) The log will be stored in C:\Windows\system32 with the file name as cpuusage.etl.

6) You should be able to see from the diagnostic file which programs are causing the problem. 

  • Lusine Baghdasaryan

    I get error 87 when I try Method 3. the message says RestoreHealth command doesn’t exist. Also, when I try Method 4, I get another error saying xperf command doesn’t exist. Any clue? Thanks.

  • jimbro44

    When I tried diagnosis this is what happened:
    -on latency -stackwalk profile -buffersize 1024 -MaxFile 256 -FileMode
    Circular && timeout -1 && xperf -d cpuusage.etl
    ‘xperf’ is not recognized as an internal or external command,
    operable program or batch file.”

    Anyone else have this problem??

  • The New Guy

    Just realized I didn’t answer your main question! Sorry, got carried away… Still good rules for figuring out issues. Anyway, I started by checking my task manager processhacker and watched the interrupts process while checking which hardware was the issue. (as interrupts are for sending a sort of “do nothing” signal) I checked the hardware by disabling non-essential hardware like display, HIDs, and eventually audio devices. When I disabled the audio devices I found the interrupt signal decreased to a normal level. So, I followed that lead and started with the device manager. I started checking ANYTHING relating to the audio hardware. I found two audio controllers eventually, it seemed a bit strange only because they seemed to be the exact same. So, I had a thought: What if the interrupt is “confused” about which to send the signal too? (or something in that realm) At that point I went to disabling each controller separately and found the interrupt signal was corrected. However, the issue came back after a restart. So, I took a more “dramatic” route and uninstalled the audio controller I didn’t need and restarted. Obviously, that controller no longer factored into startup/audio function, and the interrupt problem was corrected. I made sure to mess it up again to make sure I fixed the problem using the exact method and not some random occurrence. (plus I didn’t want to post incorrect info here) In doing that I perfected the method and made it the most effective and dependable it could be using the least amount of effort to accomplish. And that’s how I found the issue/fix for my specific cause for the interrupt signal issue!

    Hope that helps!

  • The New Guy

    Glad to hear it helped a bit. Sorry it didn’t help completely! I can, however, give you a bit of diagnostic pointers. Just some rules to stand by whenever you’re trying to fix that “annoying little issue” that just won’t stop!! This type of thing isn’t really taught oddly enough. If so, I wish I saw it! Normally, in college, tech school, books, etc. you learn about the tools. They honestly should get users to screw up the classroom computers and make the students fix it! Regardless, I learned by trial and error. What a cliché, and no, that’s not going to be my answer. ; )
    So, to keep it all straight forward, here is a little list of what I can think of now. Not everything for sure, but basic guidelines. Not sure your skill level, but this should be general knowledge for all skill levels.

    1. Do ONE thing at a time! If you have an issue, you have to understand that trying to much at once, just trying to get to the problem quickly, is diagnostic suicide. Reduce the variables so you can see with precision what the cause is when the issue is changed or repaired. What I mean by “one thing at a time” is when you are trying things out; try it, look at the results of what you did, and then set it back to the original state if it did nothing or broke something.

    2. Always remember your changes. This is related to the above item, but merits some expanding on. Even if you find that the change you made “fixed” the issue or was “a step in the right direction”, remember what you changed. You may find later that there is a better solution or that you broke something completely unrelated in trying to fix the primary issue. Write it down or take screenshots if it helps.

    3. Assess the “threat level”. This Is a good one to know. If the issue is a big one, such as major hardware or major OS configuration issues, you may want to create a restore point before starting. Most OS’s have them, so use them!! If it is a small issue, just follow the guidelines in item 2.

    4. Learn everything! This is a two fold item:
    A.) This is obvious, but don’t assume your issue is special in some way. 99% of the time someone has had the problem before. “Google is your friend” you may have to word it a thousand different ways to find it, but I bet you’ll find something that helps a bit if not completely solves it. Side Note: Look up google search tricks. It’s basically a syntax to get more out of your searches using straight forward conditions. Things like — && for and, || for or, siteurl: to search within a specific site only. This is a game changer…
    B.) Research and learn constantly. Find out about things when you pass over them. Learn about what your messing with, how it works, what it’s for. Be curious. Also, if you’re in IT maybe learn networking and programming if you only do repairs or vice versa. Fill in those knowledge gaps! I dual majored in networking and software engineering, my career choice is programmer, but I’m so, so glad I learned both.

    4. Take breaks. Another seemingly obvious one, but it’s way harder than it sounds as persistence usually destroys your perception of time. This can leave you stressed, tired, and sick of trying it at all. More importantly, you eventually just zone out, and that “AHA!!” moment gets harder and harder to get to. Go get some coffee, eat something, watch TV, etc. Anything but fixing for at least 30 min., but I prefer an hour or more. : D

    5. Try the easy stuff first. This needs little explanation really. If you’re trying to turn on a light you don’t start with the fuse box, try replacing the light bulb…. DOH!!

    6. If you find the issue and a fix, don’t be selfish. Help others out. Like posting a solution here! Maybe stackexchange, reddit, etc. It helps you remember it, it helps others tortured by google search, and as a bonus you have a place to return to if you have the same problem and forgot how you fixed it.

    7. Restart. Don’t ever feel you’re above trying a good old restart. There is a reason you see it in manuals, help guides, and hear it from support calls/IT. Try this one every once in a while during your troubleshooting. Some settings don’t take effect right off. Usually because they can’t change while they’re running. This is extremely common among driver, hardware, and system changes. Also, sometimes a shutdown is different than a restart. This is rare, but occasionally, if the issue seriously involves so low level system components, shutdown vs. restart can matter. Save yourself, and just try it. (This kind of goes with item one. If it is a driver, hardware, system change you may want to restart every time you make a change just to make sure it didn’t work.)

    8. Keep your eye on the task manager. Especially with performance issues like your game issue. Those can be VERY hard to diagnose. I suggest getting “Process Hacker” great diagnostic tool. Light years ahead of the built in task manager in windows. This replaces it as the default task manager. It has a ton of other features. Play with it. It’s fun.

    9. Get CCleaner from piriform. Get the free download, it works great for most issues. It has an automatic registry fixer, startup configurations, cleanup options for browsers and system “space takers”, disk optimization/wiping. and file analysis for which file types use the most space. Plus many more handy little features.

    10. Get to know all your friends in control panel. Click on the “Advanced” button every once in a while and check it out. Learn how navigate quickly around all that stuff, so when you’re in the midst of solving world hunger you don’t have to fumble with configuration location. If you’re more advanced or just curious, learn to use the command line. Start with the commonly used stuff and work from that. Very handy when you get to know it. (Also, powershell is a GREAT tool if you’re interested in that sort of thing.) All that amounts to this: would you want your surgeon to just worry about fixing you or figuring out and fumbling with the tools while fixing you? (I know, surgery is a bit more time sensitive, but you get the point. Your time is valuable too!)

    11. Play with virtual machines if you want to learn or try things and see what happens. You can absolutely DESTROY it in any manner you please and within seconds revert back to a snapshot you took. All without a restart or anything. The snapshot will be exactly where you set it. Mouse position, windows open, etc. all as you left it at that moment. Try VirtualBox or the free version of VMWare. (Gaming issues are harder to diagnose in a VM mainly because much of the hardware is virtual. Which means it’s just software acting like hardware to interface with real hardware. There are options to “pass through” your hardware directly, network adapters are easy to handle that way, but it’s not always that straight forward for all hardware. Paid versions of VMWare tend to get closer to actually working in that respect, but I’ll leave those issues up to you.)

    That’s all I got. I hope it helps. Those seem important to me, so it should help. I’m not an “audio hardware specialist”, but I am now! Think of all this as a learning experience. Repairing something can be quite enlightening. Not to mention that high you get when you see the issue fixed for the first time in a long time, or maybe ever!

    Hope you read this. I know it has been a month or so since you posted. If you do read it let me know how it all worked out!

    Peace out

  • Nipun

    you need to install Windows Performance Toolkit (WPT)

  • The New Guy

    Actually, just got back on to clarify with you that wasn’t a permanent
    fix. I couldn’t leave it like this! I’m too nice. I noticed it getting
    worse again after I closed the sound config dialog. (this very well will
    happen to you also. If so, here you go! You might want to do this
    anyway, however, just in case. unless you don’t want to “rock the boat”
    until it rocks itself…) After this, I narrowed it down to the
    recording device tab in the audio dialog. Every time I opened the tab
    for recording the interrupt issue would stop. So I figured, hey I’ll
    disable all my sound devices in device manager. After doing this, the
    interrupt was still running at 20%. So I went deeper. I opened up the
    sound controller by expanding System Devices in the device manager,
    checked the “High Definition Audio Controller”. (there were two listed,
    because I had multiple audio sources, with different manufacturers, and
    several different audio devices from each of these. This included
    playback and recording devices.) I disabled both (Not sure if it’s
    necessary, but I uninstalled one of them if you want to take the EXACT
    same path as me; I would suggest disabling both first) After disabling
    the second audio controller it asks for a reboot. Go ahead and reboot,
    and when it starts up again re-enable the two audio controllers, since
    you will have no audio devices in the sound manager. After this, all is
    well. Interrupt process, at least so far, is normal and the audio
    devices can be “played with” however you please!! New theory though,
    although my original post is a good diagnosis tool for the issue, the
    real problem seems to be conflicting audio controllers. For some reason
    they seem to “shape up” after they’re disabled, and work perfect in
    every aspect when you re-enable both after the restart. Maybe one didn’t
    get configured properly when the other sound driver and controller was
    installed and created. Either way, seems to be a bug in multiple audio
    drivers/devices which use different audio controllers. Regardless of
    theory, it was a long track down for sure, but there you go!! (at least for me, a conflicting device issue nonetheless)

  • The New Guy

    For me it was the audio configuration. In my case, I had to enable at
    least one of the microphone devices as well as one of the playback
    devices. It had to be an available device (not marked as unplugged) and
    it had to be marked as the default device. After each change you make,
    enabling devices and setting them as the default, you may notice the CPU
    usage for the interrupt process drop. However, you should wait ten to
    twenty seconds to make sure it stays that way. If it doesn’t then enable
    another (plugged in/available device) device. Just use the “process of
    elimination” to find the culprit audio device. If you want to quickly
    test if audio is your issue like mine, just enable every device to see
    if the interrupt process drops to a reasonable level. (mine dropped to
    roughly 1%) Remember to wait around 20 seconds to make sure the process
    stays this way. If it isn’t an audio device maybe check other device
    types that can be enabled/disabled and go the same process as the audio
    instructions. My guess is the interrupt was being sent to my device/s,
    because the device was disabled and needed to stay disabled. So, the
    processor was instructed to do this with interrupt signals. Hope this
    helps someone!


  • Yuvaraaj Sreenivasen

    Thanks a lot for your inputs friend!!!

  • Ingvar Olsén

    I inactivated Micorosoft Bing Service at Autostart in Windows Task Manager and I understood that something was wrong. I activated MBS After that is the Task Manager very slow. It will take minutes to start.

  • Stefan Zegers

    I get error 740 when trying to perform above mentioned solutions. My problems starten at 20-11-2016 after the Windows Update replaced my ntoskrnl.exe file with a new one. The system was running smooth and perfect before in Windows 10 for two years… How can I replace the ntoskrnl.exe with the old one ? Please help

    • Sophie Luo

      Hi, could you please take a screen shot of the error 740 that you mentioned and then post the link to the screenshot here? We would have a better idea of what you currently encounter at the moment and better assist you. Thanks in advance.