How to Disable SysMain to Stop Phantom Disk Usage in Windows 11

Quick fix: Open services.msc, find SysMain, set Startup type to Disabled, click Stop, then OK — phantom 100% disk readings from Service Host: SysMain stop within seconds.

You sort Task Manager by Disk and see Service Host: SysMain repeatedly spike to 50–100% disk usage on an idle PC. SysMain (formerly Superfetch) was designed to preload frequently-used apps into RAM for snappy launches on spinning HDDs. On SSDs — which is most modern PCs — the prefetching produces no measurable speed gain but generates constant background disk activity that Windows reports as high Disk usage in Task Manager.

What causes this

SysMain analyzes which applications you launch and when, then preemptively reads their executables and DLLs from disk into RAM so they appear to launch faster. On HDDs the cost-benefit ratio was reasonable — spinning-disk seek times dominated app launch latency, and prefetching shaved real seconds off the user experience. On NVMe SSDs that latency is already at the microsecond level, so the prefetched reads just push out CPU cycles and disk queue time without producing a perceptible speed difference. The Task Manager Disk column is sensitive to queue depth, not throughput, which is why SysMain’s small but constant reads register as 100%.

Method 1: Disable SysMain via Services console (recommended)

The standard route. Fully stops SysMain and prevents it from restarting on next boot.

1. Press Win + R, type services.msc, press Enter.
2. Scroll down the alphabetical list to SysMain. Right-click and choose Properties.
3. Click Stop if the service is currently running.
4. Change Startup type from Automatic to Disabled.
5. Click Apply → OK.
6. Close Services. Open Task Manager and sort by Disk — the SysMain row should disappear within 10 seconds.

You don’t need to reboot. The change applies immediately and persists across restarts.

Method 2: Disable SysMain via PowerShell (scriptable)

Useful if you’re managing multiple PCs or want to roll this into a setup script.

1. Open Terminal (Admin) from the Start right-click menu.
2. Run:

   Stop-Service -Name SysMain -Force
   Set-Service -Name SysMain -StartupType Disabled

3. Verify with:

   Get-Service SysMain | Format-Table Name, Status, StartType

   The output should show Stopped and Disabled.

4. For systems where you also want to disable the related Prefetch behavior, edit the registry:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" -Name EnablePrefetcher -Value 0
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" -Name EnableSuperfetch -Value 0

5. Reboot for the prefetch registry changes to take full effect.

This combination — SysMain disabled plus Prefetcher off — produces the cleanest result on SSDs.

Method 3: Disable via Registry Editor (no Services console access)

Use this when Services console is blocked by Group Policy on a managed PC where you still have local admin rights.

1. Press Win + R, type regedit, press Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMain.
3. Find the Start DWORD in the right pane. Double-click it.
4. Change the value from 2 (Automatic) to 4 (Disabled). Click OK.
5. Optional: in the same key, set DelayedAutostart to 0 if it exists.
6. Reboot. SysMain will not start on next boot.

The Start DWORD values: 0=Boot, 1=System, 2=Automatic, 3=Manual, 4=Disabled. This applies to every Windows service.

How to verify the fix worked

• Open Task Manager (Ctrl + Shift + Esc) and sort the Processes tab by Disk. Service Host: SysMain should not appear at all.
• Run Get-Service SysMain in PowerShell. Status: Stopped, StartType: Disabled.
• Open Resource Monitor (resmon) and check the Disk tab. Idle disk activity (B/sec) should sit well below 1 MB/s.

If none of these work

If SysMain restarts itself despite being set to Disabled, a Group Policy or third-party endpoint protection tool is keeping it running. Run gpresult /h C:\gpresult.html from an elevated Command Prompt and open the resulting HTML — look for any policy in the “Services” section that forces SysMain to Automatic. For Intune-managed devices, contact your IT admin to add an exception. If high disk usage persists from a different process after SysMain is disabled — typically Windows Search Indexer or Microsoft Defender — those have their own tuning needed (see related articles for those services). For purely hardware-driven disk activity (a failing SSD), check SMART values with CrystalDiskInfo or the OEM’s management tool.

Bottom line: SysMain is a leftover from the HDD era — disable it on any SSD-based Windows 11 system and phantom 100% disk readings stop immediately.