What are USOCoreWorker.exe and USOClient.exe Processes in Windows 10?

SUMMARY: MoUSOCoreWorker.exe, USOCoreWorker.exe, USOClient.exe, USOapi.dll, USOCorePS.dll and USOSvc.dll files present in “System32” folder in your Windows 10 computer are not a virus or malware. These files are used by Windows 10 to scan, download and install available updates released by Microsoft via Windows Update in your machine. USOCoreWorker.exe and USOClient.exe executable have been developed to replace classic wuauclt.exe command in Windows 10.

Recently while upgrading one of my computer machines to the new version of Windows 10, I received a notification alert from my Firewall software that a a suspicious file “USOCoreWorker.exe” was trying to access/connect to Internet. I immediately disallowed/blocked the executable from accessing Internet.

USOCoreWorker_EXE_Trying_Connect_Internet_Firewall_Notification_Windows_10.png

I checked with Task Manager (press Ctrl+Shift+Esc) and found usocoreworker.exe executable running in background. Task Manager was showing its name as USO Core Worker Process.

I right-clicked on the EXE file and selected “Open file location” option to open the folder containing this file. Windows opened following folder in File Explorer:

C:\Windows\System32

I found following 6 similar files related to USO process:

MoUsoCoreWorker.exe
usoapi.dll
UsoClient.exe
usocoreps.dll
usocoreworker.exe
usosvc.dll

If you also noticed USOCoreWorker.exe and USOClient.exe processes running in Task Manager causing high CPU usage/disk usage or your Firewall application showed a warning about these executable trying to connect to Internet and you are worried about these files, here is the detailed explanation of these files.

First of all, MoUsoCoreWorker.exe, USOCoreWorker.exe, USOClient.exe and other DLL files related to USO are not any virus, malware or suspicious item. These files are genuine and come preinstalled with Windows 10 operating system.

USO stands for Update Session Orchestrator. It’s a new service introduced in newer versions of Windows 10 to replace old Windows Update client or agent.

In past, users were able to use wuauclt.exe /detectnow command to schedule Windows Update operations such as check or scan for new updates using Command Prompt or Task Scheduler. But this classic command has been deprecated and no longer works in Windows 10. That’s why USO service or process was implemented in Windows 10.

The USOCoreWorker.exe and USOClient.exe processes can be used to check, scan, download, install, pause, resume updates in Windows 10 operating system. It works in 4 phases: Scan -> Download -> Install -> Commit.

The USOCoreWorker.exe process immediately executed by Windows as soon as you launch Settings app and navigate to Update & Security -> Windows Update page. You can check yourself using Task Manager. Just click on “Check for Updates” button present in Windows Update page in Settings app and USOCoreWorker.exe process will immediately appear in Task Manager.

This process is also used by Windows 10 to download and install new feature updates in Windows 10 devices.

Following is a complete list of commands which can be used to scan, download, install new updates in Windows 10 using USOClient.exe via Command line:

C:\Windows\System32\UsoClient.exe RefreshSettings
C:\Windows\System32\UsoClient.exe RestartDevice
C:\Windows\System32\UsoClient.exe ResumeUpdate
C:\Windows\System32\UsoClient.exe ScanInstallWait
C:\Windows\System32\UsoClient.exe StartDownload
C:\Windows\System32\UsoClient.exe StartInstall
C:\Windows\System32\UsoClient.exe StartInteractiveScan
C:\Windows\System32\UsoClient.exe StartScan

For example, you can use C:\Windows\System32\UsoClient.exe startscan command to scan for new updates in Windows 10.

You can find Update Orchestrator Service present in Services Manager (Services.msc) as well as shown in following screenshot:

Update_Orchestrator_Service_Windows_10_Services_Manager.png

The service’s description states: “Manages Windows Updates. If stopped, your devices will not be able to download and install the latest updates.”

You can also find USO references in Task Scheduler. Open Task Scheduler using taskschd.msc command and navigate to “Microsoft\Windows\UpdateOrchestrator” folder. In right-side pane, you’ll find several tasks such as following:

Backup Scan
Maintenance Install
MusUx_UpdateInterval
Reboot_AC
Reboot_Battery
Schedule Scan
Schedule Scan Static Task
UpdateModelTask
USO_UxBroker

Update_Orchestrator_Tasks_Windows_10_Task_Scheduler.png

So the bottom line is that these files are used by Windows 10 Update service to scan, download and install regular updates and feature updates in your Windows 10 PC.

PS: If you don’t want to upgrade your Windows 10 system to new feature update, you can check out following articles:

How to Prevent or Skip Feature Update Installation in Windows 10

Fixing Windows 10 Automatic Updates Installation Problem

Also Check:

What are Sedsvc.exe, Sedlauncher.exe Files and REMPL Folder in Windows 10?

What are UpdateNotificationMgr.exe, UNPUXLauncher.exe, UNPUXHost.exe Files and UNP Folder in Windows 10?

What are MusNotifyIcon.exe, MusNotificationUx.exe and MusNotification.exe Processes in Windows 10?