Tuesday, September 8, 2020

Finding out what a "Host Process for Windows Tasks" is doing

Today I noticed a "Host Process for Windows Tasks" process (taskhostw.exe) with heavy disk usage. That name isn't very specific, and indeed the program seems to be just a holder for various tasks' modules. To look at it more closely I fired up Process Explorer as administrator and opened the instance of taskhostw.exe with the most activity. I switched to the Threads tab and looked at the thread with CPU activity. Its Start Address was in SetupCleanupTask.dll, which is located in C:\Windows\System32\oobe.

That was at least more specific, but it didn't tell me exactly what that module does. I went back to the main Process Explorer screen and set View | Lower Pane View to Handles to see what the process had open. Selecting the process and looking through the lower pane, I found that it had some log files open in C:\Windows\Logs\SetupCleanupTask. Skimming those logs suggested that this module checks to see if it's been long enough (10 days) since the last Windows feature update was installed, then deletes the C:\Windows.old folder, reclaiming disk space.

No comments:

Post a Comment