Is it a Virus?
✔ NO - Safe
Must be located at C:\Windows\System32\WerFaultSecure.exe and be digitally signed by Microsoft.
Warning
Typically normal activity
WerFaultSecure may briefly run during application crashes to collect diagnostic data.
Can I Disable?
✔ YES
You can end the process if needed and adjust Windows Error Reporting settings, but disabling can reduce crash diagnostics.
What is werfaultsecure.exe?
werfaultsecure.exe is the Windows Error Reporting Secure variant responsible for capturing crash data when an application fails. It runs in the background under system context to collect diagnostics, memory dumps, and event data, then send them securely for analysis or store for later submission. It helps improve reliability.
It coordinates Windows Error Reporting: it runs when an app crashes, collects dump data, and transmits it securely for analysis. It operates with elevated rights and communicates with the WER service without exposing user content.
Quick Fact: Windows Error Reporting evolved to support secure data handling; WerFaultSecure focuses on protected transmission of crash data.
Types of Wer Fault Processes
- WER_Crash_Handler: Receives crash events from applications and initiates reporting
- WER_Reporter: Formats and prepares crash data for submission
- Telemetry Listener: Monitors telemetry channels for error data
- System32 Interface: Interfaces with Windows Error Reporting framework
- Secure Channel: Encrypts diagnostic data in transit
- Background Daemon: Runs as a lightweight background task to monitor issues
Is werfaultsecure.exe Safe?
Yes, werfaultsecure.exe is safe when it's the legitimate Microsoft system file located in the System32 folder and signed by Microsoft.
Is werfaultsecure.exe a Virus or Malware?
The real werfaultsecure.exe is NOT a virus. However, malware can impersonate benign system files. Always verify location and signature.
How to Tell if werfaultsecure.exe is Legitimate or Malware
- File Location: Must be in
C:\Windows\System32\WerFaultSecure.exe or C:\Windows\SysWOW64\WerFaultSecure.exe. Any other path is suspicious.
- Digital Signature: Right-click the file in Explorer → Properties → Digital Signatures. Should show "Microsoft Corporation" as signer.
- Resource Usage: Normal usage is 0-6% CPU per process under light load, 20-100 MB memory. Constant high usage is suspicious.
- Behavior: The service should run in the background and only engage during crashes for reporting.
Red Flags: If werfaultsecure.exe is located outside System32/SysWOW64, lacks a digital signature, or exhibits persistent high resource use, scan with reputable antivirus and check Windows Event Logs for errors.
Why Is werfaultsecure.exe Running on My PC?
werfaultsecure.exe is part of Windows Error Reporting and runs to capture crash data when applications fail or when diagnostic data is requested by the OS.
Reasons it's running:
- Active Crash Reporting: An application has crashed or generated a fault, triggering the error reporting workflow.
- Background Diagnostics: WER collects telemetry and diagnostic data in the background for quality insights.
- System Stability Checks: Windows uses WER to monitor stability and generate reports for reliability-focused updates.
- Startup/Background Operation: WER can run at user login to monitor for failures across sessions.
- User-Initiated Reporting: When a user triggers "Report a problem", WerFaultSecure engages to assemble and transmit data.
Can I Disable or Remove werfaultsecure.exe?
Disabling werfaultsecure.exe is not recommended because it is a core OS component for crash diagnostics. You can reduce activity or adjust reporting in Windows Settings.
How to Stop werfaultsecure.exe
- End Individual Tasks: Open Task Manager (Ctrl+Shift+Esc), locate WerFaultSecure.exe, and End Task for active crashes.
- Disable in Startup: Not typically available; disable related Windows Error Reporting tasks via Task Scheduler if present.
- Stop Background Data: Settings → Privacy & security → Diagnostics & feedback → Turn off 'Send required and optional diagnostic data'.
- Reduce Automatic Reporting: In the same Diagnostics settings, minimize data sent and disable background reporting where possible.
- For Enterprises: Group Policy or EDP settings may control WER behavior; refer to official docs for your Windows version.
How to Disable Windows Error Reporting (WER) related features
- ✔ Open Settings > Privacy & security > Diagnostics & feedback > Turn off 'Tailored experiences' and set diagnostics to 'Basic'.
- ✔ Use Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows Error Reporting to adjust behavior.
- ✔ Restart your computer to apply changes.
Common Problems: High CPU or Memory Usage by WerFaultSecure
If werfaultsecure.exe is consuming excessive resources or behaving oddly, try the following common fixes.
Common Causes & Solutions
- Frequent application crashes: Investigate the crashing apps, update them, or reinstall; review Event Viewer for faulting modules.
- Background error reporting enabled: Limit data sent or disable optional reporting in Diagnostics settings.
- Outdated drivers: Update system and device drivers from official vendor websites.
- Corrupted system files: Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to repair Windows components.
- Malware impersonation: Run full antivirus scan and verify signature locations; restore if tampered.
- Insufficient RAM with many apps: Close unused apps, upgrade RAM, or adjust which apps are allowed to submit diagnostics.
Quick Fixes:
1. Open Task Manager and identify heavy WerFaultSecure activity (Ctrl+Shift+Esc).
2. Limit crash data: Settings > Privacy & security > Diagnostics & feedback.
3. Run Windows Update to ensure bug fixes are present.
4. Update drivers from official sources.
5. Run SFC and DISM to fix system components.
Frequently Asked Questions
Is werfaultsecure.exe a virus?
No, the legitimate werfaultsecure.exe is a Microsoft system file found in C:\Windows\System32 and signed by Microsoft. Malicious files may misuse similar names.
Why is werfaultsecure.exe using CPU?
It runs during crash reporting. Short spikes are normal during a fault; persistent high CPU warrants checking for failing apps or driver issues.
Where is werfaultsecure.exe located?
Typically in C:\Windows\System32\WerFaultSecure.exe or C:\Windows\SysWOW64\WerFaultSecure.exe for 32-bit environments.
Can I disable werfaultsecure.exe?
Disabling is not recommended, but you can reduce data collection or disable WER features via Diagnostics settings or Group Policy in Enterprise editions.
How do I fix WerFaultSecure high memory usage?
Update Windows, run SFC/DISM, check for faulty drivers or applications causing crashes, and review Event Viewer for crash details.
What is the difference between WerFault and WerFaultSecure?
WerFault is the classic error reporting process; WerFaultSecure is a variant with tightened data handling and encryption for reporting crash data.