What are Sedsvc.exe, Sedlauncher.exe Files and REMPL Folder in Windows 10?

SUMMARY: Sedsvc.exe, Sedlauncher.exe, Rempl.exe, Remsh.exe and WaaSMedic.exe files present in REMPL folder in your Windows 10 computer are not a virus or malware. These files are copied by a reliability update KB4023057 for Windows 10 to improve Windows Update Service components in your machine. The KB4023057 update may also install a program called “Windows Setup Remediations (x64) KB4023057” in your Windows 10 device which can be found under “Settings -> Apps -> Apps & features” page.

Yesterday night I was working on one of my Windows 10 machines and suddenly I received a notification from my firewall software that following 2 executables were trying to access/connect to Internet:

  • sedsvc.exe
  • sedlauncher.exe

Sedsvc_Sedlauncher_EXE_Files_Rempl_Folder_Windows_10.png

Advertisement

I immediately blocked both executables from connecting to Internet. Both sedsvc.exe and sedlauncher.exe files were having digital signature of Microsoft Windows.

I checked with Task Manager (press Ctrl+Shift+Esc) and found sedsvc.exe executable running in background. Task Manager was showing its name as Windows Remediation Service.

Sedsvc_EXE_Windows_10_Remediation_Service_Task_Manager.png

I right-clicked on the EXE file and selected “Open file location” option to open the folder containing this file. Windows opened following folder in File Explorer:

C:\Program Files\rempl

The REMPL folder contains following files and folders in my Windows 10 computer:

  • Logs
  • CTAC.json
  • disktoast.exe
  • osrrb.exe
  • rempl.xml
  • sedlauncher.exe
  • sedplugins.dll
  • sedsvc.exe
  • ServiceStackHardening.Inf
  • strgsnsaddons.dll
  • toastlogo.png

Rempl_Folder_Windows_10_Program_Files.png

Advertisement

When Windows opened REMPL folder, I immediately got the idea that the sedsvc.exe and sedlauncher.exe files are definitely related to downloading and installing the new feature update released for Windows 10. Because the same REMPL folder has been used by other files called Rempl.exe, Remsh.exe, WaaSMedic.exe and WaasMedicAgent.exe in past for the same purpose.

I also noticed a strange program with the name “Windows Setup Remediations (x64) KB4023057” listed on “Settings -> Apps -> Apps & features” page. Although the Uninstall button was enabled/activated for the program but the button didn’t work and I was unable to uninstall it.

Windows_Setup_Remediations_X64_KB4023057_Windows_10.png

I also found 2 new services Windows Remediation Service (sedsvc) and Windows Update Medic Service (WaaSMedicSvc) in Services Manager (services.msc). The “Windows Remediation Service” was set to Automatic and was running in background. On the other hand, “Windows Update Medic Service” was set to Manual and was not running. Description of Windows Remediation Service was showing “Remediates Windows Update Components” and description of Windows Update Medic Service was showing “Enables remediation and protection of Windows Update components“.

Disable_Windows_Remediation_Service_Windows_10.png

After some investigation I found that the update KB4023057 (and sometimes KB4295110) for Windows 10 installed these sedsvc.exe and sedlauncher.exe files in REMPL folder and the “Windows Setup Remediations (x64) KB4023057” program in my computer.

According to the official description of this update:

This update includes reliability improvements to Windows Update Service components in Windows 10, versions 1507, 1511, 1607, 1703, 1709, and 1803. It may also take steps to free up disk space on your device if you do not have enough disk space to install Windows updates.

This update includes files and resources that address issues that affect the update processes in Windows 10 that may prevent important Windows updates from being installed. These improvements help make sure that updates are installed seamlessly on your device, and they help improve the reliability and security of devices that are running Windows 10.

There are more details available on what this update can do in your Windows 10 device:

  • This update may request your device to stay awake longer to enable installation of updates. Please note the installation will respect any user-configured sleep configurations and also your “active hours” when you use your device the most.
  • This update may try to reset network settings if problems are detected, and it will clean up registry keys that may be preventing updates from being installed successfully.
  • This update may repair disabled or corrupted Windows operating system components that determine the applicability of updates to your version of Windows 10.
  • This update may compress files in your user profile directory to help free up enough disk space to install important updates.
  • This update may reset the Windows Update database to repair the problems that could prevent updates from installing successfully. Therefore, you may see that your Windows Update history was cleared.

Microsoft has also mentioned what this update can do to free up disk space on your computer to install feature updates:

When a Windows feature update is available for your device, you may see a message on the Windows Update settings page or elsewhere that asks you to free up disk space by removing files or applications that you do not use regularly. If you see this message, select “Fix issues” to free up disk space on your device. To help free up disk space, this update may also compress files in your user profile directory so that Windows Update can install important updates. After you install the update, your files are restored to their original state.

So basically these files and folders are used by Windows 10 update to make sure future updates and feature updates are installed without any issues in your Windows 10 PC.

IMPORTANT NOTE:

If you want to stop/disable/remove “Windows Remediation Service” process and “Windows Setup Remediations” program from your Windows 10 computer, following tutorial will help you:

How to Remove or Disable Windows Setup Remediations Service in Windows 10

PS: If you don’t want to upgrade your Windows 10  system to new feature update, you can check out following articles:

How to Prevent or Skip Feature Update Installation in Windows 10

Fixing Windows 10 Automatic Updates Installation Problem

Also Check:

What are UpdateNotificationMgr.exe, UNPUXLauncher.exe, UNPUXHost.exe Files and UNP Folder in Windows 10?

What are USOCoreWorker.exe and USOClient.exe Processes in Windows 10?

What are MusNotifyIcon.exe, MusNotificationUx.exe and MusNotification.exe Processes in Windows 10?

Published in: Windows 10

About the author: Vishal Gupta (also known as VG) has been awarded with Microsoft MVP (Most Valuable Professional) award. He holds Masters degree in Computer Applications (MCA). He has written several tech articles for popular newspapers and magazines and has also appeared in tech shows on various TV channels.

Comments

NOTE: Older comments have been removed to reduce database overhead.

  1. Vishtal,

    It appears that they really REALLY do not want to stop anyone from preventing updates, and this is going to great lengths to prevent it:

    C:\Program Files\rempl\ServiceStackHardening.Inf Starts off by stating their intent:
    [Registry Values]
    [Profile Description]
    >>>> Description=Hardens the servicing stack against admin tampering

    Then they are setting or resetting the service permissions:

    [Service General Setting]
    “BFE”,2,”D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)”

    “DoSvc”,2,”D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)”

    They are even including the licensing engine in these permissions processes and ownership of these registry keys:

    “LicenseManager”,3,”D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)”

    I suspect that it would take some testing to change these permissions without breaking something, but it could still be done.

  2. It is for times like these firewalls were created. Block the outgoing packets, and the requests for updates cannot be made

  3. Thanks for this article! I’ve been searching for more info on these services but most websites gave very little info.

  4. Thanks for such good site. To find your site on this subject with such immediate clarification is excellent. many thanks.
    John

  5. Thnks for the info,

    Sooo, if I delete it, will I be able to update windows ?? or will I loose that function?

    K

  6. ^^ Windows Update is not dependent on this tool so you’ll keep getting updates. But feature updates might get affected.

  7. Sedlauncher trashes my hard drive, constant high disk usage on every startup. Can it be disabled or something??

  8. ^^ You can uninstall the update using Programs & features or manually delete or rename the EXE file.

  9. sedlauncher.exe is preventing my PC from going to sleep :
    EXECUTION:
    [PROCESS] \Device\HarddiskVolume3\Program Files\rempl\sedlauncher.exe
    SleepDeferralConditionsMet

    PERFBOOST:
    [PROCESS] \Device\HarddiskVolume3\Program Files\rempl\sedlauncher.exe
    SleepDeferralConditionsMet

  10. I don’t get why people want to remove this the file size is very small.
    The process uses 0 CPU, 0 Network, 0 Disk, and 1.2 MB Memory on my laptop.
    If you hate Microsoft that much then you should just switch to Ubuntu.

  11. “designed to improve the speed of WU”

    Meanwhile my whole PC is in total meltdown… yea, no thanks. Im blocking it in my firewall and anti-malware.

    Because you know what else uses maximum system resources without user permission? Malware.

  12. The purpose is to update MS ‘features’

    Without it, normal updates to MS software ARE performed.

    Sounds good to me.

    And when you kill it and disk usage drops to zero, it later respawns and disk goes back to 99%. It slows normal swap operations which are usually fast enough to be imperceptible, and the computer bogs down.

    Somehow, I don’t think sedlauncher is running on a machine with zero disk usage.

    Unless important features are released hourly, it can be translated to a batch process that runs once a day during human sleep time.

    I, for one, do not like programs that spend all their time wearing out the head mechanism of my hard drive with a ~0% chance of doing something marginally useful.

  13. Sed is a program used on unix (windows 10 is unix underneath all the bs) and linux systems to allow for command line edits of files. Windows is using it to manually go into our registries, our filesystems, or settings files and to reset our values to default so they can push their update. Their update is prolly one that gives them more access to your filesystem, programs, apps, web browser history, because us peasants aren’t allowed to think or do anything without Microsofts permission. Theyll call it a security update and defender, firewall, antiviruses and most vpn providers will try to tell you to install it, but make no mistake, Microsoft does not care about security, they care about enslaving your will and mind. Microsoft can give sed above admin privileges because they are the developers, they can create a privilege level above admin, prevent the user or an admin from deleting it, give it these same privleges so it can be used on every file on your system regardless if its read only or blocked by an admin. It can be used to delete lines in documents or add or edit them for nefarious means, so say you downloaded the dark overlord 911 files and were stupid enough to download them onto a windows system, the government could use Microsoft to manually edit and change those 911 files to hide or frame anyone they want. Say your the global central bankers and wanted to destroy bitcoin and cryptocurrencies, you would sneak sed into every windows machine on earth, and simultaneously have them all use sed to edit bitcoin object files and keys, they could steal a boat load of bitcoins by changing it to a different address or simply send it to a bad address so the coins are lost forever. This would not normally ever be possible because normally, even admin or network level sed can not access certain files but because it is Microsoft themselves doing it, they can give sed permissions to any file by using ‘above system admin’ privileges. They can basically do any edit imaginable in any file type imaginable when they use sed with ‘above system admin’ privleges. Using sed to allow windows update to be reset is like using a nuclear bomb to kill one man. I highly suggest you delete it with prejudice, in fact you should learn how to use the task scheduler to schedule a task that checks for it frequently to prevent it from ever being on your system.

  14. Seems if you disable Windows Update service (Win 10.0.17134.590) then sedlauncher screams bloody hell. Setting updates to Manual and it shuts up – from my brief encounter.

Leave a Comment

Your email address will not be published. Required fields are marked *

NOTE: Your comment may not appear immediately. It'll become visible once we approve it.