Why is my PC uploading data when I'm not using it?

A PC uploading data when idle is almost always doing something you agreed to at some point: syncing files to the cloud, running a backup, sharing Windows updates with other PCs, or sending diagnostic data. Sometimes it's a browser tab or an app you forgot was open. Rarely, it's a program that shouldn't be there. The only way to know which is to find the program that is sending, rather than guessing from a graph.

Why a PC uploads while you're away

Idle time is when Windows and your apps do their housekeeping. Many background jobs wait until you stop using the PC so they don't slow you down. The usual suspects:

• Cloud sync. OneDrive and other sync clients upload any file that changed in a synced folder. Photos arriving from a phone, a large video export, or a game writing save files into Documents can each start a long upload.
• Backups. Online backup software uploads on a schedule, often at night. The first full backup after installing one can run for days.
• Windows Update sharing. Delivery Optimization can send pieces of updates you've already downloaded to other PCs, on your local network or, depending on the setting, on the internet.
• Telemetry and crash reports. Windows and many apps send diagnostic data in the background. This is usually small and periodic, not a sustained stream.
• Browser tabs and chat apps. A web app left open, a video call that didn't fully close, or a messaging app syncing its history can keep sending.
• Something unwanted. Malware that steals data has to upload it somewhere. It's the rare case, but it's the reason the question deserves a real answer.

How to find the uploading app with Windows' own tools

Task Manager

Press Ctrl+Shift+Esc and look at the Network column on the Processes page. It shows each process's current network use, with sending and receiving added together. The Performance page splits your adapter's traffic into Send and Receive, but not by program. Good for "is something busy right now", weak for "who is uploading".

Resource Monitor

Resource Monitor separates upload from download per program:

1. Press Win+R, type resmon and press Enter.
2. Open the Network tab.
3. In Processes with Network Activity, click the Send (B/sec) column header to sort by upload.
4. Tick the checkbox next to the top process. The Network Activity and TCP Connections panes below now show only that program and the addresses it's talking to.

Delivery Optimization's own counter

Open Settings ▸ Windows Update ▸ Advanced options ▸ Delivery Optimization ▸ Activity monitor to see how much this PC uploaded to other PCs this month. If that number is large, turn off Allow downloads from other devices, or limit sharing to devices on your local network. The Advanced options on the Delivery Optimization page also let you cap upload bandwidth and set a monthly upload limit.

Data usage in Settings

Settings ▸ Network & internet ▸ Advanced network settings ▸ Data usage lists how much data each app used over the last 30 days. It combines upload and download and has no timestamps, so it tells you who used data, not who uploaded while you were asleep.

How NetSecWall shows what your PC uploaded while idle

NetSecWall watches every program's traffic and keeps a local history, so an upload that happened while you were away is still there when you come back.

Live: sort by upload rate

1. Open the Live tab with View set to Apps.
2. Click the second Rate column header, the one with the up arrow (▲), to sort by upload rate.
3. Or set Activity in the filter bar to Uploading to hide everything that isn't sending.
4. Select the top row. The details pane shows whether the program is signed, who published it, and when it was installed.

If the top row is svchost.exe, read the Service column. It names the Windows service behind each connection, so Delivery Optimization or Windows Update doesn't hide behind the generic process name.

History: what uploaded while you were away

1. Open the History tab.
2. Set Range to Today or Yesterday, and Group by to Apps.
3. Click the ↑ Total column to sort by upload.
4. Use the timeline bar chart above the list. Clicking a bar zooms the range to that hour, so you can see which app was sending at 3 a.m.
5. Double-click an app to open its app dashboard, with daily bars and the hosts it sent the most to.

History is recorded while NetSecWall is running. With the background service installed, which the installer does by default, that includes when the window is closed and nobody is signed in. See the background service and the tray.

Get told next time

1. Open Security ▸ Alerts & detection….
2. Tick App uploads more than the threshold.
3. Set Upload alert threshold: to a size that makes sense for you. The default is 100 MB.

When a single app passes that amount in the current session, a High upload tray notification names the app and how much it sent. For a whole-PC figure, Tools ▸ Set session data cap… alerts at 80% and 100% of a total you choose. More options are in choosing your alerts.

On Plus and higher plans, the detection engine also scores a program that has uploaded at least 100 MB and five times more than it downloaded. That shape is worth reading about in the upload pattern that should worry you.

What to do once you've found it

• A sync or backup client: let it finish, or use its own settings to schedule or throttle uploads.
• Delivery Optimization: limit or switch off sharing as described above.
• A Windows service you don't recognize: read what svchost.exe is doing on your network before blocking anything. Blocking svchost.exe wholesale breaks Windows Update, time sync and activation.
• An app that has no business uploading: block its internet access. Blocking is part of the Family and Pro plans and the trial.
• An unsigned program you don't know, running from a temp or downloads folder, sending steadily: take it seriously. Note its path, block it, and run a full scan with Microsoft Defender or your antivirus. NetSecWall watches the network; it doesn't scan or remove files.

The short version

Idle uploads have ordinary causes most of the time, and each one has a name you can find. The trick is having a record of what happened while you weren't watching. If you'd like that record, download NetSecWall and try it for 7 days with every feature unlocked, no card and no account.