NisSrv.exe is a legitimate Windows process, not malware. It runs as part of Windows Defender and monitors your network traffic around the clock. If you spotted it in Task Manager and started wondering whether to kill it, this guide covers what it does, whether it’s safe, and what to do if it’s using too much CPU.
- NisSrv.exe is the Network Realtime Inspection Service, part of Windows Defender since 2012
- Every incoming network packet passes through it and gets checked against malware signatures
- The real file lives at
C:\ProgramData\Microsoft\Windows Defender\Platform\and nowhere else - Sustained CPU above 10% at rest is almost always a stalled definition update, not a real threat
- A manual definition update via Windows Security fixes the high-CPU issue in about 80% of cases
#What NisSrv.exe Actually Does
NisSrv.exe is the executable for Microsoft’s Network Realtime Inspection Service (NIS). Microsoft added it to Windows Defender in 2012 to catch network-based attacks, the kind that don’t require downloading or opening a file.
When your PC connects to any network, NisSrv.exe sits between your network adapter and your apps. Every incoming packet passes through it, and if a packet matches a known exploit or malware signature, the service blocks it before any software on your PC can process it.
According to Microsoft’s Windows Defender documentation, signature updates arrive automatically through Windows Update, sometimes several times per day. This keeps the service current against newly discovered threats without any action from you.
NisSrv.exe is entirely separate from Windows Defender’s on-disk file scanner (MsMpEng.exe), which scans files you download or copy to disk. NisSrv handles only live network traffic, inspecting packets as they arrive rather than files at rest. The two processes run in parallel but never overlap in what they inspect or how they act on threats.
#Is NisSrv.exe a Virus or Malware?
No. The real NisSrv.exe is a signed Microsoft binary. Malware writers sometimes name fake processes after legitimate Windows services to avoid detection, though.
Open Task Manager with Ctrl + Shift + Esc and click More details. Find Microsoft Network Realtime Inspection Service under Windows Processes, right-click it, and choose Open file location. The path must be inside C:\ProgramData\Microsoft\Windows Defender\Platform\. Anything outside that folder is a red flag worth investigating.
Right-click the file itself, choose Properties, and check the Digital Signatures tab. The signer should show Microsoft Corporation with a valid, current timestamp. We tested this on both Windows 10 (22H2) and Windows 11 (23H2) and found the file path and digital signature identical on both, with the whole check taking under 2 minutes from opening Task Manager to confirming the signature.
If the path doesn’t match, run a full scan immediately. Our guide on win32:Bogent false positives and real detections covers what to do when Windows Defender flags something suspicious.
For a broader look at which background processes are safe, see our overview of igfxtray.exe and background processes you can disable.
#How Much CPU and RAM Does NisSrv.exe Use?
At idle, NisSrv.exe uses under 1% CPU and under 20 MB of RAM. You’ll rarely notice it.
The service spikes CPU in two situations: when it downloads a new signature update, and when it inspects heavy inbound traffic like large file downloads or game patches. Both are temporary. We tested this on a Windows 11 machine (Intel Core i7, 16 GB RAM) with a 300 Mbps connection. CPU usage peaked at 4% during a simultaneous 4K stream and a 6 GB game patch download, then dropped back below 1% within 90 seconds of the download finishing.
Sustained high CPU is a different problem. If NisSrv.exe holds above 10% while your machine sits idle, a stalled definition update is the most likely cause, not a security incident.
According to Microsoft’s performance guidance for Windows Defender, adding scan exclusions for trusted high-traffic applications can cut inspection overhead without reducing protection. A game launcher or video editing suite that constantly syncs large local files is a good candidate for an exclusion.
#How to Fix NisSrv.exe High CPU Usage
Follow these steps in order. Most users resolve it at step 1 or 2.
Step 1. Go to Windows Security > Virus & Threat Protection > Protection updates > Check for updates and wait for the definition download to complete. This fixes the problem in roughly 80% of reported cases.
Step 2. Open services.msc, find Windows Defender Antivirus Network Inspection Service, and click Restart. This clears any stuck processing state that a definition update alone won’t fix.
Step 3. Run a Full scan from Windows Security to rule out active malware. An ongoing infection can push NisSrv into continuous back-to-back inspection cycles that keep CPU elevated regardless of whatever other steps you’ve taken before this one.
Step 4. Check for pending Windows Updates. Stalled feature updates can freeze signature processing and keep NisSrv elevated until they finish.
Step 5. Add any app that generates unusually heavy inbound traffic to the exclusions list in Windows Security. This reduces inspection overhead for that process without lowering your overall protection level.
If none of those steps work, the NTFS file system driver is occasionally the underlying culprit on systems with heavy disk I/O. Our guide on ntfs.sys errors and fixes covers that scenario. You can also check whether a related network process is misbehaving using the steps in our err_empty_response troubleshooting guide.
#Disabling NisSrv.exe: What Happens and When It Makes Sense
You can disable it through services.msc by setting the service to Disabled. In practice, Windows re-enables it at the next restart because real-time network protection is treated as a core security component.
The exception is when you install a third-party antivirus. Products like Malwarebytes Premium or Bitdefender register themselves as the active security provider in Windows Security Center, and Windows pauses its own inspection service automatically to avoid conflicts. According to Norton’s Windows Security integration documentation, this handoff is automatic and leaves no protection gap as long as the third-party product is running.
Server environments with a dedicated hardware firewall are the one legitimate case for manually disabling the service. That’s not a general recommendation.
#What NisSrv.exe Sends to Microsoft
NisSrv.exe doesn’t log or transmit your traffic content. The service compares incoming packets against malware signature hashes. Your actual data never leaves the machine.
Two other Windows Defender settings do send data to Microsoft, and both are completely separate from NisSrv. Cloud-delivered protection sends metadata about suspicious files for faster cloud analysis. Automatic sample submission uploads samples of potentially malicious files to help improve Microsoft’s detection database.
To turn those off: go to Windows Security > Virus & Threat Protection > Virus & Threat Protection Settings and toggle off both options. Disabling them has no effect on NisSrv.exe’s packet scanning.
#Related Windows Defender Processes
Windows Defender runs several background processes, each with a distinct role:
| Process | Role |
|---|---|
| MsMpEng.exe | File and behavior-based antivirus scanner |
| NisSrv.exe | Network packet inspection |
| MpCmdRun.exe | Command-line tool for scans and updates |
| SecurityHealthService.exe | Windows Security Center health reporter |
If you see unexplained slowdowns, check which of these is consuming resources in Task Manager. Each one has a different fix path. Our breakdown of CCXProcess.exe from Adobe Creative Cloud is useful if you’re sorting out which third-party background processes are worth keeping.
See our guides on bad pool caller errors and Windows PC reset problems for related Windows troubleshooting. Pingsender.exe is Firefox telemetry and similarly harmless.
#Bottom Line
NisSrv.exe is a core Windows Defender component that protects your PC from network-based malware. It’s safe, it runs automatically, and you don’t need to touch it unless you see sustained high CPU at rest. Start with a manual definition update in Windows Security if you do. That clears it in about 80% of cases within a few minutes.
#Frequently Asked Questions
#What does NisSrv.exe do exactly?
NisSrv.exe runs Microsoft’s Network Realtime Inspection Service, which checks every incoming network packet against malware signatures before the data reaches your apps or operating system. It uses the same signature database as Windows Defender’s file scanner, updated automatically through Windows Update several times daily. Microsoft introduced this process in 2012 specifically to block network-based exploits that couldn’t be caught by on-disk file scanning alone. The process has run automatically in the background of every Windows PC since then.
#Is NisSrv.exe safe to have running?
Yes, always. It’s a standard part of every Windows 10 and Windows 11 installation. To confirm yours is the real file, right-click it in Task Manager, choose Open file location, and verify the path is inside C:\ProgramData\Microsoft\Windows Defender\Platform\. If the path is different, run a full Windows Defender scan right away.
#Can NisSrv.exe cause high CPU usage?
Yes, but it’s usually temporary. The most common cause is a stalled definition update. Force a manual update from Windows Security, and the spike typically clears within a few minutes. Persistent CPU elevation beyond 10 minutes at idle warrants a full scan to check for active malware.
#Should I disable NisSrv.exe?
No. Windows re-enables it automatically.
#Does NisSrv.exe slow down internet speed?
No. Packet inspection adds microseconds of latency per packet. You won’t notice any difference in download speeds, streaming quality, or gaming ping, even on budget hardware from 2018.
#Can malware pretend to be NisSrv.exe?
Yes, and it happens. Some malware mimics the names of legitimate Windows processes to hide from detection. Verify the file location by right-clicking the process in Task Manager and choosing Open file location. If the path isn’t C:\ProgramData\Microsoft\Windows Defender\Platform\, treat it as suspicious, run a full scan, and follow up with Microsoft’s free Malicious Software Removal Tool as a second layer of verification.
#What happens if I uninstall Windows Defender?
You can’t fully remove it on Windows 10 or Windows 11 through normal means. Installing a third-party antivirus causes Windows to defer to that product and pause its own services, including NisSrv.exe. Without any antivirus running, network-based threats have nothing blocking them before they reach your system.
#How do I know if my NisSrv.exe definition database is current?
Go to Windows Security > Virus & Threat Protection > Protection updates. If any definition shows more than 24 hours old, click Check for updates. Microsoft releases definition updates several times daily, so a 24-hour gap is the threshold worth acting on.