[Fix] Microsoft Software Protection Platform (sppsvc) High CPU Usage

Your system may slow down to a crawl, and when you open Task Manager, you may find the Microsoft Software Protection Platform Service (sppsvc) utilizing very high CPU (ranging anywhere from 30% to 75%) for a considerably long time. You may be wondering why the Software Protection service is consuming enormous resources.

Cause

The Microsoft Software Protection Platform Service (short name: sppsvc) enables the download, installation, and enforcement of digital licenses for Windows and Windows applications.

The high CPU usage of the Microsoft Software Protection Platform Service is usually attributed to the pirated installation of Windows. The third-party Windows/Office KMS-based (Key Management Service) activator tools like R@1n-KMS or KMSpico are employed by many users to illegally ‘activate’ their non-genuine Windows or Office products.

These activators claim to activate Windows or Office products by setting a local key management server, bypassing the Microsoft activation server. These illegal KMS-based activators are often classified as malicious HackTool by various antivirus programs.

• VirusTotal detection ([email protected])
• Free Automated Malware Analysis Service ([email protected])
• Automated Malware Analysis Report for [email protected] – Joe Sandbox

These illegal KMS programs often run as a service and/or as a scheduled task that executes at frequent intervals. When the Microsoft Software Protection Platform Service (aka, Software Protection service) detects these kinds of programs, you’ll see a huge spike in CPU usage by this service.

[Fix] Microsoft Software Protection Platform (sppsvc) High CPU Usage

The resolve the Microsoft Software Protection Platform (sppsvc) high CPU usage issue, uninstall all the 3rd party KMS activators, or clean install Windows with a genuine product key.

The KMSpico activator tool installs itself as a service.

Service KMSELDI
(Not verified) @ByELDI
c:\program files\kmspico\service_kms.exe

The KMS-R@1n activator registers itself as a service in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Services\KMS-R@1n

(Note that Microsoft’s Autoruns utility may not cover the above registry startup launch point.)

And these programs add one or more scheduled tasks. Some of them are listed below:

• R@1n-KMS\Windows64Professional
• R@1n-KMS\Office16ProPlus
• R@1n-KMS\Office16VisioPro
• R@1n-KMS\Office16ProjectPro
• R@1n-KMS\Windows63Professional
• R@1n-KMS\Office15ProPlus
• R@1n-KMS\Office365ProPlus
• R@1n-KMS\Office14x64ProP
• R@1n-KMS\Windows64Core
• R@1n-KMS\Windows64Professional
• R@1n-KMS\KMS-Restart
• AutoPico Daily Restart

Some files you need to watch out for:

• C:\Windows\System32\Tasks\R@1n-KMS\Windows64Professional
• C:\Windows\System32\Tasks\AutoPico Daily Restart
• C:\Windows\[email protected]
• C:\Program Files\KMSpico [folder]
• C:\Program Files\KMSpico\Service_KMS.exe
• C:\Program Files\KMSpico\Service_KMS.exe
• C:\Program Files\KMSpico\WinDivert.sys

After uninstalling these 3rd party KMS-based activators, be sure to run a thorough scan with Malwarebytes (Free) and eliminate malware.

Can I disable the Software Protection Service?

Some users tend to do some of the following things to disable sppsvc in an attempt to reduce CPU usage.

• Suspend sppsvc.exe using the built-in Resource Monitor (resmon.exe) utility.
  
• Disable the Microsoft Software Protection Platform Service (sppsvc) via the Registry Editor.
  
• Disable the task named SvcRestartTask located at the following branch in Task Scheduler:

  Task Scheduler Library → Microsoft → Windows → SoftwareProtectionPlatform

  Note that there are 3 tasks by default (SvcRestartTask, SvcRestartTaskLogon, and SvcRestartTaskNetwork)

If the Microsoft Software Protection Platform Service (sppsvc) is disabled, the operating system and licensed applications may run in a notification mode where you’ll see the watermark saying your copy of Windows is not activated. It is strongly recommended that you not disable the Software Protection service.

My verdict

One of the above three methods (to disable sppsvc.exe) may help improve the system performance for the time being. I’d generally advise against those methods.

• As a temporary measure to improve the performance of the computer, you may try suspending sppsvc.exe.You may also create a desktop shortcut (run as administrator) that will pause (using Windows SysInternals PsSuspend) sppsvc.exe, using the command-line pssuspend64 sppsvc.exe. To resume it back, create another shortcut with the command-line pssuspend64 -r sppsvc.exe

Even if your Windows installation is legitimate and still facing the above issues, the above methods are not officially recommended. Doing so would cause the activation watermark to show up on your desktop, and Windows and Office may behave as if they’re not activated.

If your copy of Windows 10 is genuine and still facing the problem, then see if installing/upgrading to the latest available Windows 10 build helps. Does that work? Let’s know your comments.