Flamingo Raises $4.5M Seed Round · Led by Vertex Ventures, bringing total funding to $6.7M to build the open, AI-native layer for IT and security.
"Fae" Grace Meadows
SysMain, the service Windows used to call Superfetch, preloads the programs people open into spare RAM. What it does, why the disable advice came from the hard-drive years, how to confirm it is the culprit, and the four switches that turn it off.
A laptop boots, the disk sits at 100% for ten minutes, and the top row in Task Manager reads Service Host: SysMain. The forum answer is always the same: disable it. This guide covers what Superfetch does, when that advice still holds, and how to confirm the service is the problem before you switch it off.
Microsoft's own description of the service is one line: it "maintains and improves system performance over time", per the Windows services guidance on Microsoft Learn. In plain words, it watches which programs get opened and when, then loads their files into spare RAM before anyone asks for them. The next launch comes from memory instead of disk.
The cache sits at low priority. If an application needs the RAM, Windows hands it over and SysMain refills later. That is why a healthy machine shows most of its memory as "in use" or "standby" a few minutes after logon. The service is doing its job, not leaking.
The name has a history. Windows XP had a prefetcher that remembered which files a program touched at launch. Windows Vista extended it into SuperFetch, which also learned the time of day and the order you open things, and fed the same cache to ReadyBoost on a USB stick. Windows 10 version 1809 renamed the service SysMain, so Task Manager now shows Service Host: SysMain while every guide older than 2019 still says Superfetch. Same service, same registry keys, new label.
The advice is from the spinning-disk years. A laptop hard drive handles roughly a hundred small reads a second, and after logon SysMain, Windows Search, the antivirus scan and Windows Update all want the disk at once. On that hardware the service's preloading was one more reader in a queue that was already full, and stopping it made the 100% disk bar drop. The advice spread because it worked.
Look at who was asking. A January 2019 Microsoft Q&A thread describes heavy disk use at every boot on a machine with 16 GB of RAM and a 1 TB hard drive, and the top reply calls it "a known bug" and says to disable the service. An August 2025 Microsoft Tech Community post asks the same question for a Windows 10 machine with 8 GB and a 1 TB hard drive showing SysMain at 20 to 40% CPU, and both replies say disabling it on a hard drive is safe. Hard drive, every time.
On an SSD the sums change. Random reads are cheap, so the cost of preloading is small, and the benefit is small too, because a launch from a fast SSD is already quick. Disabling SysMain on a healthy SSD buys you little either way, which is why the default stays on. What has not gone away is the boot storm, where several disk-heavy jobs collide in the first fifteen minutes.
That February 2026 thread is the modern version of the ticket. Dell Vostro laptops on Windows 11 25H2, Core i5 with 16 GB, SSDs behind the Intel RST driver, and on some of them SysMain reads and writes at hundreds of megabytes a second for about fifteen minutes after every boot. Disabling the service fixed it. The replies are the interesting part: one says it should be off on any SSD, one points at Dell SupportAssist and Dell Optimizer as the usual resource hogs on that hardware, and one lists what else runs at boot on a managed laptop, indexing, .NET optimization after updates, antivirus scans, software inventory and Intune syncs. The service was the thing they turned off. It may not have been the thing that was wrong.
Task Manager blames the container, not the cause. SysMain runs inside a Service Host, and the disk column next to it includes reads the service is doing on behalf of the programs it is preloading. Four other jobs produce the same symptom and get fixed by the same wrong switch.
Open Resource Monitor with resmon, go to the Disk tab and sort by Total bytes per second. SysMain's reads show under the System process, PID 4, and the file column lists executables and DLLs from Program Files and Windows. SearchIndexer.exe reading your documents folder is the indexer rebuilding after an update. MsMpEng.exe walking the whole drive is a Defender scheduled scan. TiWorker.exe and TrustedInstaller.exe are Windows Update servicing a cumulative update. mscorsvw.exe is .NET recompiling after a framework update. A backup agent, OneDrive or a vendor tool like SupportAssist shows under its own name.
Then watch the clock. SysMain's work is front-loaded: it runs hard after logon and settles within minutes. A disk pinned at 100% for an hour, or all afternoon, belongs to something else, and the lower CPU usage guide covers the scan windows and update rings that stop the repeat.
The cheapest test is a temporary stop. sc stop SysMain from an elevated prompt halts the service until the next reboot without changing its startup type. Watch disk activity for ten minutes. If nothing changes, run sc start SysMain and keep looking. If it drops, you have a cause and a decision to make, not a reflex.
The thread below is the 2021 version of the same choice. Disabling SuperFetch cleared a 100% disk problem, the poster turned it back on because nobody could say which was worse, and the one reply frames the trade correctly: disk overhead now against slower launches later.
All four reach the same service. Pick by how many machines and how reversible you need it to be.
The Services console is the one-machine route. Run services.msc, open SysMain, click Stop, set Startup type to Disabled, apply. To undo it, set Startup type back to Automatic and start it.
The command line does the same in two lines from an elevated prompt, and it is what goes into a script:
codesc stop SysMain sc config SysMain start= disabled
The space after start= is required; without it the command fails with a usage message. PowerShell's equivalent is Stop-Service SysMain followed by Set-Service SysMain -StartupType Disabled. Reversal is sc config SysMain start= auto and sc start SysMain.
The registry route is the one every old guide quotes, and it deserves a caveat. The key is HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters, which holds two DWORD values. EnablePrefetcher controls the launch and boot prefetcher: 0 off, 1 application launches, 2 boot, 3 both, and 3 is the default. EnableSuperfetch uses the same 0 to 3 scale for SysMain, but Microsoft does not document it, the value is often missing on a fresh Windows 11 install, and third-party guides disagree about what 1 and 2 mean. Use 0 to turn it off and 3 to turn it on, create the value as a DWORD if it is absent, and reboot. Set anything in between and you are trusting a forum post.
For a fleet there is no dedicated Group Policy setting. Use Group Policy Preferences under Computer Configuration, Preferences, Control Panel Settings, Services to set the SysMain startup type, or push the two sc lines through your RMM. On OpenFrame that is one script run across a client's devices with the output collected, so you can see which machines took the change and which still have the service running. Whatever you use, write down why, because the next technician will find the service disabled and want to know.
The walkthrough below shows the Services console and command-line versions on a single machine.
Leave SysMain on by default. Windows has shipped with it on since Vista, and on a machine with an SSD and enough RAM it costs nothing a user can feel. Three situations earn an exception.
The first is a documented conflict: a vendor or your own testing shows the service colliding with a specific driver or storage setup, the way the Vostro laptops did behind Intel RST. Disable it on that model, note the reason in the device record, and revisit when the firmware or driver changes.
The second is a thin-client or VDI image. The Vostro machines in the thread were running Horizon as thin clients, so the programs SysMain was busy preloading were never going to be launched locally. An image that exists to open one client has nothing to prefetch, and a boot storm across a classroom of them at 8:55 is a real cost.
The third is a machine on a tired hard drive waiting for replacement. The old advice still works where the old hardware still lives. Our guide to checking SSD health covers the SMART counters that tell you whether the drive is the actual bottleneck.
Everything else is a performance ticket with a different cause, and the ticket below is how it usually goes.
SysMain is Superfetch with a new name, and it preloads the programs people open into RAM they were not using. The disable advice was right for hard drives and mostly irrelevant for SSDs. Before you stop it, sort Resource Monitor by disk and read the process name, because the indexer, a Defender scan and Windows Update produce the same bar. Stop it temporarily to test, disable it only for a reason you can write down, and fix the thing that was fighting it for the disk.
If the next ticket is the service next to it, what svchost.exe is explains how to tell which service lives in which host. And if the boot itself is the slow part, Windows Fast Startup is the other setting worth a look before anyone touches the registry.
Lead AI Fairy
Some things defy easy explanation: magic dust, the northern lights… and Flamingo’s AI Angels. Think Charlie’s Angels, reimagined with automation brains and serious RMM (Remote Monitoring & Management) chops. Weird? A little. Effective? Absolutely. That’s the job.
Still deciding?
Ask Mingo answers from our docs and customer stories.
Still deciding?
Ask Mingo answers from our docs and customer stories.