Fix: dasHost.exe High CPU and Memory Usage

Device Association Framework Provide Host (dashHost.exe) is a Microsoft core process that is responsible for pairing both wired and wireless devices in Windows. The process is part of the official suite of Windows components that run under the Local Service account. It’s a relatively new framework that was introduced with Windows 8, but it’s also available on the newer Windows 10.

Why are there multiple instances of dasHost.exe in Task Manager?

Device Association Framework Provide Host (dashHost.exe) is tasked with pairing both wired and wireless devices with the Windows operating system. The framework makes it possible for network-connected devices to be discovered, installed and associated with a PC client as if they were bus-connected.

Users encounter multiple instances of the Device Association Framework Provide Host because the process duplicates itself for each network-connected device. For every device paired with your PC via this framework, a separate Device Association Framework Provide Host will show up in Task Manager.

Cases of High CPU Usage 

Some users have complained that multiple Device Association Framework Provider Host end up eating up almost all system resources, with cases where dashHost.exe takes up over 70% of the CPU capability.

Normally, the Device Association Framework Provider Host process is extremely light (under 10 MB of RAM usage) and should not exceed 1-2% of CPU usage (this depends on the specs).

If the service is consuming more system services than it should, it’s usually one of the following three scenarios:

• The problem is associated with the connected device, rather than with the process.
• The dashHost.exe process has glitched and needs to be restarted.
• Malware has replaced the legitimate Device Association Framework Provider Host process with a malicious executable (a rare occurrence).

DasHost.exe is known to cause CPU spikes, but most of the time those happen when you connect devices that have outdated drivers. The issue is more common on Windows 10 since a lot of older devices have not yet received driver updates tailored for the new operating system.

Unfortunately for the end user, Windows doesn’t have a built-in tool that will help us identify which device is causing the Device Association Framework Provider Host process to increase resource usage.

Should I disable DasHost.exe?

No, you shouldn’t. By disabling the Device Association Framework Provider Host process you will sabotage most of your PC’s connections with external devices. Regardless of the performance problems you encounter, disabling DasHost.exe is not a feasible strategy because it severely cripples your system.

However, if you find the CPU spikes unbearable, you can temporarily kill the faulty Device Association Framework Provider task in Task Manager (Ctrl + Shift + Esc). This will don’t do any long-term damage because your OS will automatically reopen DasHost.exe after a short while. If the framework doesn’t start again automatically, go ahead and reboot your system.

By forcing the system to reboot the framework, you might easily get rid of the glitch that is causing the performance spikes.

However, if the issue is more underlying than that, ending the Device Association Framework Provider task will only serve you temporarily and the issue will soon return.

A more in-depth solution would be to restart the Device Association Service from the Services window and remove the glitch. To do this, open a Run window (Windows key + R), type “services.msc” and hit Enter. In the Services dialog box, look for the Device Association Service entry. Once you found it, right-click on it and choose Restart.

What else can you do?

Since there’s no way of determining exactly which device is causing the performance spikes of DasHost.exe, you’ll need to do some troubleshooting inquiries yourself if restarting didn’t have any effect on lowering the resources usage.

Below you have a collection of methods that will troubleshoot most of the common causes for high usage of the Device Association Framework Provider process. Please follow each method in order until your resources usage returns to normal.

Method 1: Bringing WU up to date

Since drivers are by far the biggest culprits for the performance spikes of DasHost.exe, let’s start by making sure you have the latest drivers possible. Before doing anything else, make sure every external device that you regularly use is connected.

A good place to start is WU (Windows Update). Press Windows key + R to open a Run command, type “control update” and hit Enter to open Windows Update. This shortcut will work with every Windows version.
Once you see the Windows Update screen, click the Check for updates button and see if you have any pending update. If you have any pending updates, wait for them to be installed and applied to your system. If prompted to reboot, do so and return to the Windows Update screen to make sure your system is up to date.

Method 2: Dealing with drivers that aren’t managed by WU

After you’ve let Windows update do its thing, let’s do another inquiry on the drivers that aren’t managed by Windows Update. Drivers that aren’t managed by WU are often the ones causing the performance spikes of the Device Association Framework Provider process.

As a rule of thumb, if a device is not supported by your Windows version it’s best to disable it rather than leaving it to run with compatibility problems. Very few devices achieve the same functionality if the drivers aren’t written with that particular OS in mind. And even if they do, they often cause system problems that are extremely hard to pinpoint.

The easiest way to identify problematic drivers is via Device Manager. To open Device Manager, hold Windows key + R, type “devmgmt.msc” and hit Enter.

Once you’re in Device Manager, start hunting for outdated drivers. You can identify them via the yellow warning sign – this means the device is conflicting with other hardware, is not supported or Windows was unable to find the proper driver for it. If you decide to search online for drivers, do not restrict the search to your Windows version.

You can try to install drivers for a slightly older Windows version if you don’t find one tailored specifically for your Windows – e.g. if you have Windows 10, try installing a driver for Windows 8.1 since drivers for the two OS versions are often incompatible. If the warning icon goes away after installing a driver, it’s usually a sign that the device is now functioning properly.

If you didn’t manage to find a driver for the device, the only choice is to disable the device. You can do this easily by right-clicking on the device and selecting Disable Device (Disable). If you know which device you’ve just disabled, also physically remove the affected devices if they have a wired connection to your PC.

After all unsupported devices have been dealt with, reboot your Pc and return to Task Manager to see if the usage of the Device Association Framework Provider Host process has gone down. If the issue persists, move to the method below.

Method 3: Running a malware scan on DasHost.exe

The DasHost.exe executable is an official Windows component. However, you probably heard talk about viruses capable of camouflaging themselves as legitimate system 32 processes.

Theoretically, a malware can replace the Device Association Framework Provider Host with a malicious executable that will do it’s bidding. But realistically, in the last few years, Windows has gotten a lot better at preventing viruses from gaining access or posing as system files. This is even less likely if your system is up to date. We have conducted a concise online investigation to see if there are any cases of malware camouflaging as the DasHost executable, but there’s little evidence to support that.

But if you’d like to be absolutely sure, a quick and effective way to determine if the Device Association Framework Provider Host process is legit is by checking it’s underlying file location. You can do this easily by opening Task Manager (Ctrl + Shift + Esc), right clicking on Device Association Framework Provider Host and choosing Open File Location.

If the executable is located in Windows / System32, you can probably rest assured as you’re not dealing with a camouflaged malware. In the event that you’re still skeptical, you can also trigger a virus scan on the process by right-clicking on DasHost.exe and choosing Scan with Windows Defender. 

Note: If you’re not confident in the ability of Windows Defender, you can try scanning with an external solution like Malware Bytes.

If the scan reveals a malware threat, the executable will be dealt with by your antivirus and a new instance of dasHost will be created by your OS.