Service Host: Local System (Network Restricted) high CPU process on Windows 11/10

Introduction

If your Windows 11/10 machine suddenly sounds like a jet engine, freezes when you open a browser tab, and shows 80–100% CPU usage in Task Manager, you’ve probably already spotted the culprit: “Service Host: Local System (Network Restricted)” hogging resources. This cryptic entry isn’t a single program, but a container for many core Windows services grouped under one svchost.exe process.

What makes it confusing is that the label “Network Restricted” sounds like an error, but it’s really just a networking profile indicating limited network permissions; the real problem is usually one or more services inside this host going rogue. Typical offenders include Windows Update, Delivery Optimization, SysMain (Superfetch), Background Intelligent Transfer Service (BITS), or a driver or component stuck in a loop.

In this tutorial, we’ll start with fast triage steps you can try right away, then move to a structured, safe troubleshooting flow to identify the exact service responsible and fix high CPU usage without breaking Windows Update or weakening system security. You’ll also learn how to verify that the issue is really solved and how to keep it from coming back after future updates.

Quick Triage (fast fixes you can try right now)

If your PC is almost unusable and you just need relief, start here. These steps are safe, quick, and often enough to clear temporary glitches after updates or driver changes.

1. Reboot and let Windows settleRestarting clears stuck tasks and pending update operations.
   • Save your work and perform a normal restart.
   • After logging in, wait 5–10 minutes without opening heavy apps.
   • Open Task Manager (Ctrl + Shift + Esc) → Processes tab and watch CPU usage.

   If “Service Host: Local System (Network Restricted)” drops to a few percent and stays there, it was likely a one-time spike. If it shoots back to 30–100%, continue.

2. Install pending Windows updatesIncomplete or stuck updates frequently cause heavy background activity.
   • Go to Settings → Windows Update.
   • Click Check for updates, install everything, and restart if prompted.
   • After reboot, give the system 5–10 minutes of idle time, then re-check CPU in Task Manager.
3. Run the Windows Update troubleshooterIf Windows Update is broken, the troubleshooter can automatically fix some common issues.
   • Windows 11: Settings → System → Troubleshoot → Other troubleshooters.
   • Windows 10: Settings → Update & Security → Troubleshoot → Additional troubleshooters.
   • Run Windows Update, apply any fixes, restart, and test again.
4. Check behavior in Safe ModeSafe Mode loads minimal drivers and services, which helps you see if third-party software is involved.
   • Press Win + R, type msconfig, press Enter.
   • Go to Boot → check Safe boot → Network → OK → restart.
   • In Safe Mode, check CPU usage in Task Manager.

   If CPU is normal here but high in normal mode, a third-party driver or app is likely contributing. If CPU is still high, the culprit is almost certainly a core Windows service. When finished, open msconfig again, uncheck Safe boot, and reboot normally.

If the problem persists after these quick checks, move on to the deeper, systematic steps below.

Prerequisites (before you dig deeper)

Before you start tuning services and editing settings, it’s wise to prepare a safety net. You don’t need to be a sysadmin, but you should feel comfortable following step-by-step instructions.

1. Make sure you have admin rightsYou’ll be adjusting services, running system tools, and possibly editing the Registry. Log in with an account that has administrator privileges.
2. Create a system restore pointA restore point lets you roll back changes if something goes wrong.
   • Press Win and search for Create a restore point.
   • On the System Protection tab, select your system drive (usually C:) and click Create.
   • Give it a name such as Before Service Host fix and confirm.
3. Back up important filesYou shouldn’t lose data during this process, but hardware failures and power cuts happen. Copy critical documents and work files to cloud storage or an external drive so you can troubleshoot without worrying about data loss.

Step-by-Step Guide to Fix “Service Host: Local System (Network Restricted)” High CPU

In this section we’ll first identify which service is misbehaving, then apply targeted fixes for the most common causes of high CPU usage.

1. Identify which service inside the host is causing high CPU

The “Service Host: Local System (Network Restricted)” entry is just a wrapper. We need to see which individual service inside it is burning CPU.

1. Inspect the group in Task Manager
   • Open Task Manager with Ctrl + Shift + Esc and click More details if needed.
   • On the Processes tab, scroll down to Windows processes and find Service Host: Local System (Network Restricted).
   • Click the small arrow on its left to expand the group so you can see the individual services.
   • Watch the CPU column for a minute and note any services that repeatedly jump to the top. Common names you may see include Windows Update, Delivery Optimization, SysMain, BITS, and others.
2. Cross-check with the Services console
   • Switch to the Services tab in Task Manager and click Open Services at the top right (this opens services.msc).
   • Locate the services you saw consuming CPU inside the host group. This is where you’ll be starting, stopping, and reconfiguring them in the next steps.

Keep a short list of services that appear particularly active or suspicious; we’ll refer back to this list.

2. Temporarily stop heavy tasks inside the host (diagnostic step)

Here you’ll gently stop specific services to confirm which one is responsible. This is diagnostic, not a permanent fix.

1. End problematic services from the expanded host
   • In Processes, with Service Host: Local System (Network Restricted) expanded, right-click the sub-service that shows the highest CPU usage.
   • Choose End task.
   • Watch the overall CPU usage:
     • If it drops immediately, that service is a primary culprit.
     • If nothing changes, you can let the service restart at the next reboot and test another one.
2. Stop the same service in Services
   • In the Services window (services.msc), find the same service by name.
   • Right-click it and select Stop.
   • Observe CPU usage again. If the system becomes responsive and CPU falls to normal levels, you’ve likely identified the service that needs a more permanent fix in the following sections.

Note: Some services (especially Windows Update-related ones) shouldn’t be disabled permanently. Use this step to confirm the culprit and then move on to targeted remediation.

3. Fix Windows Update loops and Delivery Optimization

Windows Update and Delivery Optimization are among the most common reasons for sustained CPU, disk, and network usage in this service host.

1. Clear the Windows Update cacheCorrupted or stuck update files can keep update services busy in the background.
   • Open services.msc.
   • Stop Windows Update (wuauserv) and Background Intelligent Transfer Service (BITS).
   • In File Explorer, go to:
     C:\Windows\SoftwareDistribution
   • Select all files and folders inside and delete them (these are temporary update files).
   • Go back to Services and start BITS and Windows Update again.
   • Restart your PC and check CPU usage after the system has been idle for several minutes.
2. Reduce Delivery Optimization impactDelivery Optimization can use your bandwidth and CPU to upload updates to other devices.
   • Open Settings → Windows Update → Advanced options → Delivery Optimization (on some builds: Settings → Update & Security → Delivery Optimization).
   • Turn Allow downloads from other devices Off, or restrict it to PCs on my local network only.
   • Optionally, in Advanced options, limit upload bandwidth to a low percentage.

If CPU and disk usage fall significantly after these steps, you’ve likely resolved an update or Delivery Optimization loop.

4. Disable SysMain (Superfetch) if it’s causing high I/O and CPU

SysMain preloads frequently used data into memory to speed up application launches. On some systems, especially those with older HDDs, it can cause excessive disk and CPU usage.

1. Turn off SysMain
   • Open services.msc.
   • Find SysMain.
   • Right-click → Properties.
   • Set Startup type to Disabled, click Stop, then OK.
   • Restart your PC and monitor CPU and disk usage.
2. Decide whether to keep it disabledIf your system feels smoother and resource usage is noticeably lower, it’s safe to leave SysMain disabled, particularly on SSD-based systems. If you don’t see much difference, you can re-enable it later by switching Startup type back to Automatic.

5. Adjust or temporarily disable Background Intelligent Transfer Service (BITS)

BITS quietly moves data for Windows Update and other services. When something goes wrong, it can get stuck and consume CPU.

1. Restart BITS
   • In services.msc, locate Background Intelligent Transfer Service.
   • Right-click and choose Restart.
   • After the restart, watch CPU usage for a few minutes. Short spikes are normal; constant high usage is not.
2. Set BITS to Manual for testing
   • In the Properties dialog for BITS, set Startup type to Manual and click Stop.
   • Reboot your PC and see whether the Service Host CPU usage stabilizes.
   • If this resolves the issue, you can leave BITS on Manual for a while, but remember Windows Update may work less efficiently and might require manual checks.

6. Fix memory leaks (Ndu registry tweak – advanced but effective)

On some systems, the NDU (Network Data Usage) driver can leak memory in the non-paged pool, indirectly driving up CPU and resource usage in the Service Host group. Disabling NDU is a known workaround, but this is more advanced.

Warning: This step involves editing the Windows Registry. Make sure you’ve created a restore point before proceeding.

1. Open the NDU key in Registry Editor
   • Press Win + R, type regedit, and press Enter.
   • Approve the UAC prompt.
   • In the left pane, navigate to:
     HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu
     (on some systems, you may see CurrentControlSet instead of ControlSet001).
2. Disable NDU
   • In the right pane, double-click Start.
   • Change Value data to 4 and click OK.
   • Close Registry Editor and restart your computer.

If NDU was causing memory leaks, you should see more stable CPU and RAM usage after reboot.

7. Repair system files with SFC and DISM

Corrupted system components can cause services to misbehave and stay in high-usage states. Windows includes built-in tools to repair these.

1. Run System File Checker (SFC)
   • Right-click Start and open Windows Terminal (Admin) or Command Prompt (Admin).
   • Run:

   sfc /scannow

   Wait for the scan to reach 100%. If it finds and repairs corrupt files, restart the PC and check whether CPU usage improves.

2. Run DISM if SFC can’t fix everythingIf SFC reports errors it can’t repair, run:

   DISM /Online /Cleanup-Image /RestoreHealth

   After DISM completes, run sfc /scannow again, then reboot and test.

8. Scan for malware, adware, and PUPs

Although “Service Host: Local System (Network Restricted)” itself is legitimate, malware and potentially unwanted programs can hook into system services, generate heavy network or disk activity, and push CPU usage up indirectly.

1. Use Microsoft Defender for a full scan
   • Open Settings → Privacy & security → Windows Security → Virus & threat protection.
   • Click Scan options → choose Full scan → Scan now.
   • Remove or quarantine anything suspicious it finds.
2. Add a second opinion scanner
   • Download a reputable on-demand antimalware tool from a trusted security vendor.
   • Run a full system scan and clean out any detected spyware, adware, or PUPs.
3. Clean up browser extensions and startup apps
   • Remove unknown or unnecessary browser extensions.
   • In Task Manager → Startup apps, disable items you don’t recognize or don’t need, reducing the chances of background processes stressing system services.

9. As a last resort: in-place repair upgrade (Windows 10/11)

If you’ve tried all previous steps and high CPU usage still returns, an in-place repair upgrade can refresh Windows components without deleting your files and installed apps.

At a high level, the process looks like this:

• Download the latest Windows 10/11 installation media from Microsoft.
• Run setup.exe from within Windows.
• Choose the option to keep personal files and apps.
• Let the setup complete; your system files and services are rebuilt while your data and programs remain.

Because the exact prompts can change across builds, follow Microsoft’s current official repair-install documentation when you perform this step.

Validation and Testing (make sure it’s actually fixed)

Once you’ve applied one or more fixes, it’s important to confirm that you’ve solved the issue, not just reduced it temporarily.

1. Observe CPU usage at idleAfter your latest change, restart the PC, log in, and leave it alone for 10–15 minutes.
   • Open Task Manager and check overall CPU usage when idle; it should usually be under 10–15%.
   • “Service Host: Local System (Network Restricted)” may spike briefly but should not sit at the top consuming a large percentage continuously.
2. Use Resource Monitor for more detail
   • Press Win + R, type resmon, and press Enter.
   • On the CPU tab, confirm which processes are still active when the system is idle.
   • On the Disk and Network tabs, check whether any svchost.exe or associated services are still generating heavy I/O or traffic without obvious reason.
3. Check Reliability Monitor for recurring errors
   • Search for View reliability history in the Start menu.
   • Look for recurring Windows failures or Windows Update errors around the times you experienced high CPU usage.
   • If a particular component keeps failing, you may need to revisit the relevant step (for example, update cache, BITS, or SFC/DISM).

   

4. Test normal usage: Use your PC as you typically would for a few hours—browse, stream, work, and game if relevant. If the system stays responsive and CPU doesn’t hit 100% when you’re not doing anything heavy, your fix is likely durable.

Security Hardening and Prevention

Now that your system is stable, a bit of preventive maintenance can reduce the odds of the same problem returning.

1. Keep Windows and drivers updated, but not blockedDon’t permanently disable Windows Update. Instead, allow updates to install regularly, and use Active hours and restart settings to avoid interruptions while still benefiting from security and stability fixes.
2. Avoid low-quality “optimizers” and intrusive toolsMany performance “boosters”, aggressive firewalls, or poorly designed VPN clients interfere with core Windows networking and update services. Stick to trusted vendors and uninstall tools you don’t truly need running all the time.
3. Trim background and startup appsOpen Task Manager → Startup apps and disable entries that aren’t essential. Fewer background processes mean fewer conflicts with system services and fewer surprises in CPU usage.
4. Schedule periodic scansLet Microsoft Defender perform scheduled scans and occasionally run an additional on-demand scanner to catch adware and PUPs that may slip through.
5. Create restore points before major changesBefore big driver updates, feature upgrades, or installing system-level software, create a restore point. If high CPU usage returns after such a change, rolling back is much easier.

Bringing Service Host CPU Back Under Control

“Service Host: Local System (Network Restricted)” can look mysterious and intimidating, but it’s really just a container for several essential Windows services. When CPU usage goes out of control, the key is to identify which service inside the host is responsible and then apply a focused fix instead of randomly killing processes or disabling Windows Update entirely.

By clearing stuck update files, taming Delivery Optimization, disabling or adjusting SysMain and BITS where appropriate, fixing potential NDU leaks, repairing system files, and ruling out malware, you can almost always bring CPU usage back to normal and keep your system fast and stable. If worst comes to worst, an in-place repair upgrade gives you a clean Windows installation while preserving your data and apps.

FAQ