What is WaaSMedicAgent.exe, and how to disable it?

It seems like not much is known about the WaaSMedicAgent program despite it being signed by Microsoft. However, the WaaSMedicAgent is actually a crucial part of the Windows system and may have saved your computer many times without you knowing. However, there are instances when the WaasMedicAgent is consuming unprecedented amounts of RAM and disk usage, and stealing a ridiculous amount of CPU performance, causing some Windows computers to slow down.

In this article, we take a look at the WaaSMedicAgent.exe and explain how important it is for your Windows computer and if it is possible to completely disable it.

What is WaaSMedicAgent?

The WaaSMedicAgent stands for “Windows as a Service Medic Agent”, and was first introduced in Windows 10 by Microsoft as a protection feature when running Windows Update. It is responsible for repairing any damaged or corrupted components during the download and installation of each Windows Update, and will only run if Windows encounters some issues which prevent it from updating the system.

The WaaSMedicAgent is usually misunderstood by users as malware because it connects to the internet, and may consume a good amount of RAM, disk storage, and CPU power. However, further investigation suggests that the program is connecting to “settingsfd-geo.trafficmanager.net” which appears to belong to a server controlled and managed by Microsoft. It is believed that the program connects to the server to look for fixes specific to the issues encountered by the Windows computer. This may also explain the excessive RAM, and disk usage, as well as the high CPU usage. Most of the time, the WaaSMedicAgent will download files to replace the corrupted data, and execute it to fix any issues in the computer.

With that said, the WaaSMedicAgent is a legitimate Windows component that comes with Windows 10 and Windows 11. However, we still suggest that you scan your computer using Windows Defender to make sure the WaasMedicAgent.exe that is running on your PC is legitimate as it is not uncommon for malware to disguise itself as an authentic Windows component.

How to disable the WaaSMedicAgent.exe?

While the WaaSMedicAgent can become incredibly annoying as a background process, we would really suggest that you keep it running as it will protect your computer from update issues in the future. However, the same can’t be said for computers with limited RAM, disk storage, and computing power such as those that are running on Intel Celeron. These computers usually come with a slow variant of RAM, and a slower hard drive or eMMC storage. The following are some of the ways to disable the WaaSMedicAgent to conserve memory usage and power.

1. Pause existing updates – One of the easiest ways to recover the RAM, disk storage, and CPU power being utilized by the WaaSMedicAgent is to pause the existing updates or delay all the updates altogether. As mentioned earlier, the WaaSMedicAgent only works if the Windows Update is turned as it is continuously looking for any problematic components on the update package. This isn’t going to be a long-term solution but it is the easiest one on the list.
2. Disable the WaasMedicAgent using RegEdit – A legitimate WaaSMedicAgent.exe is associated with the WaaSMedicAgent service. So to completely disable the executable, you will also need to disable the service. Note that since this is a crucial system component, Windows does not allow users to disable it using the Services app. You can, however, use the Registry Editor to disable it. This is a bit risky for beginners since a wrong click or deletion in the Registry Editor can result in even bigger issues.
   1. Search and open the Run app, then type RegEdit on the empty box. Click Enter. Alternatively, you may also just directly search RegEdit on the Search panel, then run the Registry Editor as Administrator.
   2. Navigate to Computer > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services. Then scroll down until you see the folder called “WaaSMedicSvs”. The folders are alphabetical so make sure to scroll down until the bottom.
   3. Click the WaaSMedicSvs folder and on the right side of the window, look for a file called Start. Again, these files are alphabetical so they should be on the bottom.
   4. Double-click the Start property to edit the value.
      • Note the following values below:
        • 2 – Automatic
        • 3 – Manual
        • 4 – Disable
   5. Delete the current value (usually, it is 3 which means Manual), and then change it to 4. Leave the base to Hexadecimal then click OK.
3. Update your Windows system to the latest version – While the first method is to delay or pause the existing updates, you may also continue updating the PC and wait for it to finish updating before using it. The moment the update is installed, the WaaSMedicAgent will automatically disable itself. The best way to do this is to update your computer at midnight or before going to bed so it doesn’t consume resources that may result in slower computer performance.
   1. Click the Windows key, then launch the Settings app.
   2. On the Settings app, click Windows Update. Now, depending on the Windows version your device is running on, the option for Windows Update will either be on the upper right corner (Windows 10), or on the left side at the bottom (Windows 11).
   3. Now, check for updates and wait until it finished downloading and installing.

Frequently Asked Questions (FAQs)

Is WaaSMedicAgent malware?

No. The WaaSMedicAgent service and executable is a legitimate Windows component signed and published by Microsoft. The service was first added on Windows 10 to protect computers from installing Windows update packages with missing, damaged, or corrupted components. However, some attackers may still use malware that disguises itself as WaaSMedicAgent to infect unsuspected users. The best way to combat this is to always enable your Windows Defender and scan for new updates on the virus database.

Is it safe to disable the WaasMedicAgent?

Yes and no. Yes because it will free the RAM, disk storage, network data, and CPU, but also no as it increases the risk of more issues appearing on your computer due to some problems on the update package components. Microsoft developed the WaaSMedicAgent to protect your device from installing corrupted updates. So beware. You may, however, pause the existing updates to avoid sluggishness in computer performance.

How can I tell if an executable is a virus?

There are many ways to tell if the exe running on your computer is a virus or a legitimate app or component. The first thing to do is to run Windows Defender (Windows Security) or any other antivirus suite. You may also check the app publisher and if it is signed. For theWaaSMedicAgent, for example, the publisher is Microsoft. Finally, monitor the file’s activity. You may use the Task Manager for this or third-party apps like GlassWire.