Recently I noticed some of our machines are getting sluggish, mainly after boot-up. Using the Resource Monitor I detected excessive disk access from the system process with PID 4. Following some tips, I disabled the anti-virus on the System Volume Information folder, hoping it will help (I don't want to disable system restore).

However, it seems like PID 4 is accessing everything. When running a simple extraction of a ZIP file, I can see the WinRAR reading a few hundreds KBs per second from the file, but PID 4 reads dozens of MBs per second from the same file. After cancelling the operation, PID 4 keeps accessing the file for around 30 seconds, reading many MBs per second. This is not a Resource Monitor bug, as the disk is clearly active, and stops once resource monitors says PID 4 is finally resting.

Why is this miraculous process accessing everything every other process accesses?

I'm using the AVG antivirus. Disabling it did not change this behavior/

What is going on here?

  • 1
    PID 4 is the Process ID for the Windows SYSTEM process. It's a lot like PID 1 on Unix systems, in fact. A lot of services run under PID 4.
    – sysadmin1138
    Aug 19, 2012 at 13:13
  • Don't services run under their own processes? Anyway, even if that is so, why is it ordinary file accesses in regular non-service processes are mostly done under PID 4?
    – zmbq
    Aug 19, 2012 at 19:30
  • I have the same problem and can't find any solution too. By any chance, do you use TrueCrypt? I use TrueCrypt system-wide encryption and I suspect that might be the cause, as it is running under "System" as a driver, and it needs to encrypt/decrypt every file access.
    – user132740
    Aug 20, 2012 at 0:15
  • No, no TrueCrypt or any form of encryption here.
    – zmbq
    Aug 20, 2012 at 4:57
  • Related question here: superuser.com/questions/349349/…
    – user132740
    Sep 5, 2012 at 21:03

7 Answers 7


This is an older question, but I had this issue, and for me it was SuperFetch. I tried everything I could find on PID 4 excessive hard drive usage, and some of it helped. A RAM upgrade from 4GB to 8GB only made the issue more obvious - RAM usage was low, no paging, but yet the hard drive was lit up for ~10 minutes after my laptop booted.

Long story short, there's a registry setting that controls what level of SuperFetch is appropriate. You can see below the EnableSuperfetch value is now set to 1, which seems to be "prefetch all executables and libraries". The default is a 3, which seems to mean "prefetch all executables, libraries, and documents". I have many documents, so I think this was taking way too long. Every document opened is another one that SuperFetch has to "analyze" to see how you're using it.

The registry key/value in question is: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\EnableSuperfetch

So far the only downside is that my outlook folders take a few extra seconds to open, and some commonly used documents like MS Project files take longer. But those delays pale in comparison to the disk thrash I was getting before!

SuperFetch Registry Key


A lot of system services (I don't mean Windows Services) run under PID 4, the "System" process. Every time you open a file, you trigger a slew of background mechanisms such as the virtual memory manager caching the file in memory, moving other things around in memory, servicing page faults, etc. That activity is separate from the disk activity charged against the process that originally accessed the file, e.g. WinRAR.

That said, what you're describing still doesn't sound like normal behavior to me. You should see a quick bump in disk activity from the System process when the file is accessed, and then it should go back to 0 rather quickly - within a couple seconds.

I did a little testing on my own machine using Windows Resource Monitor, and I saw somewhat similar behavior. What I think we're witnessing is Resource Monitor showing us some sort of rolling average that is slow to drop off.

Try looking at PID 4 disk activity using another tool such as Sysintenals' Process Explorer. I got a much different impression from it, as the Read Delta and Read Bytes Delta by the System process seem to return to 0 much faster than when viewed through ResMon.

Edit: If that's not it, then I think a more in-depth analysis is going to be needed in order to answer the question. For instance, you can list the currently-loaded file system filter drivers with fltmc.exe, and kernrate.exe can help you isolate those modules which are causing inordinately high disk I/O.

  • @zmbq: Have you managed to find out what's going on?
    – user132740
    Sep 1, 2012 at 7:06

System process is used by Windows Update. If you have selected to install updates automatically, it is probably your systems is currently installing windows software. If you run Windows Update and try to install updates you will receive a message saying you cannot install as Windows is currently updating the system.

Change the Windows Update to not downloading and installing without manual action and wait the current installation to finish.

  • 1
    This worked for me. My problem was IE made System (PID4) use 100% of the drive. Turning off IE's Automatic Update (Help->About IE->Install new versions automatically) fixed it.
    – Coomie
    Jul 9, 2013 at 1:41
  • @Coomie what version of IE has this 'feature'?
    – MDMoore313
    Jul 17, 2013 at 13:52
  • @MDMoore313 IE 10
    – Coomie
    Jul 18, 2013 at 1:37
  • @Microsoft, Why should IE upgrade itself from kernel-mode/ring0? Oct 9, 2014 at 20:54

I had the exact same symptoms. In my case they were related to Norton360 and the MS-SQL VSS service. Once I disabled VSS, my activity dropped significantly. System still locks up when Norton does it's thing, but it's semi bearable since it only seem to happen every hour.


Posting this answer here as I stumbled over this thread when looking for answers on why system process 4 was consuming so many read/write traffic.

Users when having mapped drives or going out to a UNC path to a share, especially something with a good sized directory structure would all the sudden have a ton of receive traffic continuously from the host server. Normally I would see 100-300k, as soon as you expand in the nav pane it would shoot up in the 20,000k plus range.

Ended up disabling the automatically expand to current folder option in Explorer and that traffic goes away.



I had a similar issue, however in my case it appears that somehow Offline Files was enabled. I'm going to be investigating things on the server side (e.g. I thought it was disabled globally via Group Policy and on the shares.....) but I had two Windows 7 machines at a remote office merrily trying to sync several hundred GB over a VPN connection.

(Edit before posting: Offline files were not properly disabled on the shares, possibly following a server migration.


Beware that the Windows "Resource Monitor" computes an average I/O speed for the last 60 seconds for the 3 columns "Read (B/sec)", "Write (B/sec)" and "Total (B/sec)", which means that there is an inertia. This applies to all processes, including explorer.exe, or command-line processes. Even after the process has exited, it still appears in the "Resource Monitor", with a linearly decreasing I/O speed down to 0.

In contrast, Sysinternals Process Explorer columns called "I/O Delta Read bytes" and "I/O Delta Write Bytes" show the real instant values.

These observations were made on Windows 10 Pro 20H1.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .