Service Host: SysMain (SuperFetch): What It Does and How to Stop High Disk Usage

If Task Manager shows Service Host: SysMain using your disk, you’re looking at the Windows service that used to be called SuperFetch. It learns which apps and data you use and loads them into spare memory ahead of time so they open faster. Brief disk activity from it is normal. If it keeps your disk busy for long stretches, you can stop or disable it in Services, and turn it back on later if things get worse. Everything here applies to Windows 10 and Windows 11.

What SysMain (SuperFetch) actually does

SuperFetch arrived in Windows Vista as a smarter way to manage memory. Microsoft’s description of how it works:

• It runs from Sysmain.dll as a Windows service inside a Service Host (svchost.exe) process.
• It keeps a history of which code and data your apps use, even after Windows has pushed them out of memory.
• Whenever memory frees up, for example when you close an app, it asks Windows to read recently evicted data back from disk into memory.
• It does this a few pages per second using Very Low priority disk reads, so it shouldn’t get in the way of what you’re doing.
• It also helps with resuming from hibernation, fast user switching and app launches, and it fills the ReadyBoost cache if you use one.

Microsoft’s own example is the “after lunch” problem: while you’re away, a memory-hungry task such as an antivirus scan pushes your apps out of memory. SuperFetch reloads them in the background so the PC feels fast again when you come back.

Note: A low Free memory number in Task Manager is expected. SuperFetch and the normal Windows cache use available memory to hold disk data, and Windows hands that memory to apps when they need it.

Why it shows up as “Service Host: SysMain”

Starting with Windows 10 version 1703, Windows runs most services in their own Service Host process on PCs with more than 3.5 GB of RAM. That’s why Task Manager shows Service Host: SysMain as its own line. On PCs with 3.5 GB of RAM or less, services stay grouped in shared Service Host processes, so SysMain may be bundled with others.

Older guides call the service Superfetch. Microsoft’s Windows Server 2016 service list still shows the display name Superfetch with the service name SysMain, described as “Maintains and improves system performance over time.”

Why SysMain uses your disk

SysMain’s whole job is reading data from disk into memory, so you’ll see disk activity from it, especially:

• shortly after you close a large app or game
• after a memory-heavy background task, such as a full antivirus scan

That activity is low priority and usually short. If Service Host: SysMain sits near the top of the Disk column for a long time and the PC feels slow, check the basics before you disable anything:

• Free space and drive type. A nearly full drive or an old hard disk drive makes any disk activity more noticeable. Our guide to why is my computer so slow shows how to check both.
• Memory pressure. If memory is full all the time, apps keep pushing each other out of memory, and SysMain keeps trying to reload what was pushed out.
• Malware. Run a Quick scan in Windows Security.

How to check what SysMain is doing

1. Press Ctrl+Shift+Esc to open Task Manager.
2. On the Processes tab, select the Disk column header to sort by disk use.
3. Find Service Host: SysMain and watch it for a few minutes. Short spikes are normal. Constant high use is what you’re looking for.
4. On the Performance tab, check the memory graph. If memory is close to full most of the time, deal with that first by closing apps or disabling startup apps.

How to stop or disable SysMain

What you want	Services console	Command (admin)
Test without SysMain until the next restart	Stop	sc.exe stop SysMain
Keep it off after restarts	Startup type: Disabled	sc.exe config SysMain start= disabled
Turn it back on	Startup type: Automatic, then Start	sc.exe config SysMain start= auto and sc.exe start SysMain

Important: Changing services needs administrator rights. Before you change anything, write down the current Startup type of SysMain so you can put it back exactly as it was. Don’t disable other services you aren’t sure about.

Option 1: Use the Services console

1. Press Windows key + R, type services.msc and press Enter.
2. Find SysMain in the list and double-click it.
3. Note the current Startup type.
4. Select Stop to stop it for now. Watch Task Manager to see if the disk use drops.
5. To keep it off after restarts, set Startup type to Disabled and select OK.

Stopping without disabling is a good test. If the startup type is Automatic, the service starts again at the next restart, so you can compare.

Option 2: Use sc.exe in an admin Command Prompt

1. Open an elevated Command Prompt (Command Prompt as administrator).
2. Stop the service:

sc.exe stop SysMain

3. Prevent it from starting again:

sc.exe config SysMain start= disabled

The space after start= is required. Without it, the command fails.

Tip: Use sc.exe, not just sc, if you run these in PowerShell. In PowerShell, sc is a shortcut for a different command.

How to turn SysMain back on

If apps feel slower to open after disabling it, undo the change.

In Services: open SysMain, set Startup type back to what you wrote down (for example Automatic), select Apply, then Start.

In an admin Command Prompt:

sc.exe config SysMain start= auto
sc.exe start SysMain

start= auto makes the service start automatically every time Windows starts. Use start= demand instead if the original startup type was Manual.

What happens when SysMain is off

Windows keeps running without SysMain, but you lose what it does:

• Apps you use often aren’t preloaded into memory, so they may take longer to open, especially after the PC has been idle or after a memory-heavy task.
• The extra help for resuming from hibernation and switching users goes away.
• ReadyBoost can’t prefill its cache.

Microsoft doesn’t publish a “disable it” recommendation for regular PCs. Its Windows Server 2016 guidance lists “No guidance” for this service. The one place Microsoft says it doesn’t help is non-persistent virtual desktops (VDI), because the preloaded data is thrown away at every restart.

If it still doesn’t work

• The disk is still at 100% with SysMain off. Something else is using it. Sort Task Manager by Disk again. If it’s the search indexer, our guide to the Windows search bar not working covers indexing status and how to rebuild the index.
• Another process is busy. If Task Manager shows a different process, such as sdiagnhost.exe, read our guide to Scripted Diagnostics Native Host to see what it is and whether it’s genuine.
• The PC is slow across the board. Work through the steps in how to speed up Windows 11.
• The drive itself may be failing. Back up your files and have the drive checked by a repair shop or the manufacturer. For more hardware help, see our computer repair tips.