The fan is running and the computer is busy, and no one is using it.
Windows does work in the background, and most of the time a busy computer at night is exactly that. Task Manager shows which process is doing the work.
What it can’t show is whether that process belongs on the computer. That takes a record of what the process is, and a comparison with what you expect.
Find out what is busy
Microsoft’s troubleshooting guidance treats short spikes as normal and looks for usage that stays at 80 percent or higher for extended periods. One reading tells you little. Several readings at different times of day tell you more.
Do this when the computer is busy, not afterward. A reading taken once the fan has quieted tells you about a different moment.
- Right-click Start and open Task Manager, or press Ctrl+Shift+Esc.
- On the Processes tab, select the CPU column header so the arrow points down. The busiest entries move to the top.
- Write down the top three names and their percentages, with the time.
- For a second view, select Start, type resmon, open Resource Monitor, select the CPU tab, and sort by Average CPU.
- Restart the computer, open nothing, and repeat. Compare the two lists.
Work Windows does on its own
Search indexing. Microsoft says the first indexing run can take up to a couple of hours. After that it runs in the background as you use the computer, re-indexing only data that changed. The mode that covers the whole PC “may use more system resources.” A computer with a large pile of newly copied files is a normal reason for activity.
Programs that start at sign-in. Open Settings, Apps, Startup, or the Startup apps tab in Task Manager. Each entry shows a startup impact of None, Low, Medium, or High. A program you use that starts itself explains some background load.
Signs to write down
Search the exact process name before drawing a conclusion, and write down what you find. Don’t end an unfamiliar process yet. Ending it removes what it could have told you.
- A busy process whose name you can’t match to any program on the computer.
- The same unfamiliar process busy at the same time every day, or again after every restart.
- The load began the same day a new program, browser extension, or remote-access tool appeared.
- A browser entry that stays busy until you close one tab. Close the tab and watch the number.
- A startup entry with no publisher or a name nobody recognizes.
Read the Performance tab as well
On the Performance tab, select CPU. Microsoft’s page shows the number of cores and logical processors on that screen. The Processes tab can report a single busy core as a large percentage, so the Performance tab gives you the picture for the whole computer.
Look at the time too. Activity that begins the moment you sign in points at the startup list. Activity that runs while the computer sits at the sign-in screen, or at the same hour each night, points at something scheduled.
- Note whether the fan speed changes when the percentage changes.
- Note whether the activity stops when the network cable is unplugged or Wi-Fi is turned off, and write down that it did, without drawing a conclusion yet.
What this check cannot show
Task Manager shows what is running now. It doesn’t show what ran at 2 a.m. when you weren’t looking. A quiet reading doesn’t clear the computer, and a busy one doesn’t convict it. Tools used for remote access are legitimate software and may use little processor time, so a low reading doesn’t rule them out.
If the load only appears while a specific program is open, the question is about that program rather than the computer.
What we check with you
The process list with its file locations, the startup list, and the installed programs, side by side. A person reads them together and writes down what matches something you expect and what doesn’t, with dates.
Task Manager names what is busy, and whether it belongs on the computer is the part that needs a second set of eyes.
Related
Sources
Get answers about the computer you’re worried about.
The Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Rather talk to a person?
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.