@Arturas_Meskauskas My observations are indeed relevant. FWIW. On my devices I have a variety of Nvidia cards that I use. My daily duster has embedded graphics from Intel which I disabled and use my Nvidia GPU as the sole video source. Allowing both to be active on the system creates massive issues. In this configuration Norton doesn’t bog the computer down. I also do light gaming on this PC as well.
My general purpose gaming PC runs an older RTX 3060 ( no integrated CPU on the chip or board ). No issues.
OK, I think I got it. It seems your PC usage is quite different from mine and probably from most of people here. I use laptop (NVIDIA RTX 4080) display mode automatic select (optimus) on and everything (except nortonui.exe) runs on Intel UHD Graphics. I use NVIDIA GPU only when gaming. This saves battery (important for laptops). There were no issues until nortonui.exe started using NVIDIA GPU even when the machine is supposed to run on Intel graphics. Of course if my laptop would always be plugged in I could use NVIDIA GPU only (I believe that is your usage scenario) and wouldn’t worry about nortonui.exe running on it.
I still have this issue (even worse, it looks like Norton makes my new laptop bsod under load), but disabling/enabling the dgpu driver is what i used so far for a temporary “fix”. The strange part is that my old laptop (with a ryzen 5900hs/RTX 3080 mobile) does not have this issue. My new intel-based laptop with the RTX 5080 has this problem. Perhaps this problem only exists in the newer 40- and 50 series GPU’s?
I don’t know why you keep defending Norton when it comes to this ‘nortonui.exe gpu usage’ issue. They must rollback to how it was a few months ago. This issue is affecting especially laptop users because battery % is noticeable there. A desktop is plugged in to AC power always and hence those users won’t notice or care about this issue.
@FullCircle360 I’m only asking a relevant question. Software isn’t always the cause. Sloppy coding usually is the cause when software is the issue. Software and hardware go hand-in-hand. One is designed to allow the other to function correctly. When software uses Windows services to perform its desired tasks and it has core OS level privileges things don’t always work the way it was originally thought out.
I found the above files installed on my system that absolutely do NOT belong there. Systems that have a dedicated GPU and a discrete GPU often find themselves working against one another due to that sloppy software coding. My laptops have BOTH, I am not seeing this issue on either Windows 10 or 11 on any of them. Hardware differences may in fact be the key. If this were a wider problem a larger user base would be reporting it.
My post was a suggestion of assistance, not defense of anything other than looking for something common that may be being overlooked.
Digging a bit deeper into another issue I’d like to follow on with my previous post. Please have a look at this post in another thread I started. I believe this MAY be the main cause of GPU usage issues being seen.
Additional info: model_host.exe face scanning is “user-enabled” with no setting to turn it off (26.9.11171.0)
Adding to this thread with log evidence from Norton 360 26.9.11171.0.
After the update, model_host.exe runs AI models on my discrete GPU (it picks the RTX 5070). C:\ProgramData\Norton\Antivirus\log\media_scan.log shows what it’s doing:
Face telemetry configuration changed, approved:true, enabled:true, crops:true, face cap:8, retention window s:60
Screen scanner state reconcile QR:false (shepherd:true user:false) face:true (shepherd:true user:true) → shouldRun:true
YuNet and SFace browser processing enabled
Audio recognizer initialized in per-process mode
So Norton is running face detection and face recognition (YuNet + SFace) on screen captures of my browser. It keeps face crops and logs “face telemetry” as approved. The log says the user enabled
this (user:true), but I never turned it on, and I can’t find any setting for face capture or screen scanning anywhere in the Norton UI.
Disabling it in the registry doesn’t hold either. I set HKLM\SOFTWARE\Norton\Antivirus\properties\MediaScan\Common\ProviderEnabled = 0, and after a reboot the screen scanner started again and tried
to launch model_host.exe (log, 2026-10-01 14:56:20). The only thing that has stopped it is blocking model_host.exe from launching at the OS level.
Questions:
Where is the setting that controls face capture and screen scanning? If there isn’t one, why does the log record it as user-approved?
What does “face telemetry” send off the machine, and where does it go? Is it tied to Community Watch?
How can I turn off screen and audio scanning permanently in a supported way, so it doesn’t use my GPU?
@shewbob1@Darrell_Wunder@ARP As I have tried to convey earlier the model host issue is 100% connected to the AI that has been incorporated into Norton products. Of which the AI is also tied to the added closed domain entries it is inserting into Windows host file.
Yes, model_host.exe is part of Norton’s artificial intelligence and machine learning infrastructure.
The process is a component of Gen Digital’s software suite (the parent company of Norton and Avast). It acts as a local “host” to execute Machine Learning (ML) models directly on your device. [1, 2]
What is it doing?
Deepfake and Audio Scam Detection: One point of agreement among users on a Reddit community discussion is that the file interacts with .onnx (Open Neural Network Exchange) files located in folders labeled for machine learning audio processing (\mlm\*\FakeAudio). It runs locally to scan audio streams (such as from browser pages or videos) to detect real-time AI voice scams or deepfakes. [1]
AI Agent Protection:It is tied into Norton’s newer security suites designed to monitor, filter, and act as a checkpoint for local and web-based AI tools. [1]
Common Issues: High GPU and CPU Usage
Because model_host.exe processes complex machine learning algorithms locally, it is heavily optimized to leverage your computer’s hardware. On some platforms, including discussions on the Avast Community Forum and AskWoody, users have reported that model_host.exe can cause massive spikes in GPU and CPU utilization (often taking 15% to 50% of processing power), which leads to significant battery drain on laptops and game stuttering. [1, 2, 3]
If it is causing severe performance issues on your machine, checking for the latest software updates within the Norton client or temporarily adjusting your real-time browser/audio protection settings may mitigate the heavy hardware usage.
@SoulAsylum I get it is coming from the AI and from what I getting from this now is it is using my gpu because my intel cpu does not have dedicated graphics. All I am trying to figure out is how to turn it off . I think I’ll be fine without their AI scanning. Like @shewbob1 said there no indication that this is enabled and how to turn it off.
To stop Norton’s model_host.exe from loading its face-detection models on the GPU, block its launch with an Image File Execution Options (IFEO) entry that points at a debugger that
doesn’t exist.
Turn off Norton’s tamper protection temporarily, so the registry write is allowed.
In an admin command prompt, run:
reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\model_host.exe” /v Debugger /t REG_SZ /d “C:\Windows\System32\blocked-model_host.exe” /f
Turn tamper protection back on.
From then on, Windows tries to start the nonexistent debugger instead, so model_host.exe never runs. Norton keeps retrying, which costs a little CPU, but the rest of Norton works
normally.
One thing this does do, that you can’t avoid is Norton keeps trying to start it over an over, so there are some wasted cycles there. At least your GPU stays clear.
I do think it is outrageous that Norton won’t allow turning this off in the UI. I use both my GPUs for LLMs, and VRAM is tight. I don’t need some unwanted model mucking up the works.
