Program file
lms.exe: what the file is and whether it is safe
lms.exe is the Local Manageability Service of Intel Active Management Technology (AMT), installed with the Intel Management Engine software. It is a normal, non-system program and Windows does not need it. A copy in C:\Windows or outside the Intel folders is not this service.
Prefer to check it yourself? The manual checks follow.
In C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS, lms.exe is a legitimate non-system process that is installed together with Intel software. Stopping it does not affect how Windows runs.
Any executable can be taken over by malware. A copy in C:\Windows, in a fonts folder or anywhere outside the Intel folders, or one that pushes the CPU to the limit, is not the genuine service until a scan says so.
- Type
- Non-system service process; Local Manageability Service of Intel Active Management Technology
- Publisher
- Intel Corporation
- Program
- Intel Management Engine Components, part of the Intel AMT software bundle
- Usual folder
- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS; older installs used C:\Program Files (x86)\Intel\AMT
- Windows versions
- Windows 10, 8, 7, Vista and XP per the old page and Intel forum posts; also seen on Windows Server
- Runs at startup
- Yes, as a Windows service (Local Manageability Service in the Services app)
- Not needed by Windows
- Windows runs without it; it can be uninstalled or disabled
What lms.exe is
lms.exe is usually installed together with Intel software and is a component of Local Manageability Service, a core service of Intel's Active Management Technology. An Intel employee describes the service as providing local access to some Active Management Technology features. It is typically present on PCs with Intel's management engine software, which many OEMs pre-install.
The old page said the file handles communication between IANA-registered port numbers and the motherboard or processor, which allows remote diagnosis or repair. Stopping the service stops that Intel ME functionality. On a personal computer Intel said it can be safely disabled; on a work computer ask your IT department first.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check it
Check the folder first, then the signature, then scan.
- Check the file location In Task Manager right-click lms.exe > Open file location. The genuine service is in the Intel Management Engine Components\LMS folder. If the executable is located in C:\Windows or in a fonts folder (the old page wrote C:\WindowsFonts), it is most likely a component of malware.
- Check the signature Open Properties > Digital Signatures. The signer should be Intel Corporation.
- Look at the service Open Services (services.msc) and find Local Manageability Service. Its executable path should lead to the Intel folder.
sc qc LMS - Scan it Run a Microsoft Defender full scan from Windows Security > Virus & threat protection > Scan options. The best way to check whether the file is malicious is to scan it; if the scan returns nothing, the executable is not a known threat.
A Trojan hiding behind this name is unlikely, but it does happen: malware can run for months or years before it is found, because it is programmed to show no suspicious signs.
Do you need lms.exe?
Do not remove lms.exe if it is a legitimate component of Intel software. Whether you need to remove it depends on whether it is related to malware and on whether you need the Intel software it belongs to.
- Leave it alone if it causes no problem If you use an Intel chipset and the file is not causing you any issues, leave it running. Removal is not necessary, and Windows keeps working without it.
- Disable it if you do not use Intel AMT Open Services, double-click Local Manageability Service, set Startup type to Disabled and choose Stop. This stops the Intel ME functionality for remote diagnosis or repair, so on a work computer ask IT first.
- Uninstall the Intel software Remove it only if you are sure the file is malicious or you no longer run or need Intel software. Open Settings > Apps > Installed apps and uninstall Intel Management Engine Components.
- Run a full scan first Before doing anything else, run a Microsoft Defender full scan and then an offline scan. If the scan returns no positive result, the executable is the legitimate one.
- If it is malware, go to Safe Mode Removal is then mandatory. Malware usually changes the way the operating system works: it modifies the registry, changes the boot sequence, adds entries to the hosts file and tampers with security software. The best way is to enter Safe Mode with Networking (Settings > System > Recovery > Advanced startup > Restart now > Troubleshoot > Advanced options > Startup Settings > press 5) and run a full scan from there.
- Reduce the chance of a repeat Keep Microsoft Defender updated, patch Windows and all installed software with security updates, use strong passwords for every account, protect Remote Desktop with a secure password and a non-default port, never open spam attachments that ask for macros to be enabled or click their links, do not download cracks or keygens, and avoid high-risk sites.
Warning signs
| What you see | What it means |
|---|---|
| lms.exe in C:\Windows or a fonts folder | The genuine file is in the Intel folders. In the Windows folder it is most likely malware. |
| High CPU usage spikes | Some users complained about it with the real service too (see problems). If it persists together with a fan roar and a slow PC, a coin miner is possible. |
| Detections named Trojan.Win64.BitMin.aom or TROJ_GEN.R0EBC0SE117 | The old page gave these names for coin-mining software. Such malware abuses the CPU to mine cryptocurrency (MITRE ATT&CK T1496), causing slow operation, lag, high electricity bills and possible hardware wear. |
| No symptoms at all | Trojans are usually programmed to stay hidden and may join the PC to a botnet, log keystrokes or load other malware, such as ransomware. |
| No Intel software on the PC | If nothing from Intel's management engine software is installed, there is no reason for the service to exist. |
Everyday problems
High CPU usage spikes or errors
Some users complained that lms.exe caused high CPU usage spikes or other errors. Intel forum threads from 2008 to 2017 describe the service using 40 to 100 percent of the CPU on Windows Vista, XP, 7 and Server 2012 R2 until it was stopped in Services.
Update the Intel Management Engine software from the PC maker's site, and scan the PC to rule out a coin miner. Monitor the device and fix the issue quickly: a trojan can also download other payloads.
Questions people ask
Is lms.exe a virus?
Not in its original form: lms.exe is Intel's Local Manageability Service. It can be replaced or copied by malware, so check that it sits in the Intel Management Engine Components folder, is signed by Intel and that a Microsoft Defender full scan finds nothing. In C:\Windows it is most likely malware.
What does lms.exe do?
It provides local access to Intel Active Management Technology features, which let a management console diagnose or repair a PC remotely. It is installed with the Intel Management Engine software, which many OEMs pre-install. Windows itself does not need it, and it can be uninstalled at any time if you do not use AMT.
Can I disable or remove lms.exe?
Yes. Windows runs without it, and Intel said on its forum that on a personal system the service can be safely disabled. Doing so stops Intel ME functions such as remote diagnosis. On a work computer ask your IT department first. Do not delete the file by hand; use Services or uninstall the Intel software.
Why does lms.exe use so much CPU?
Intel forum threads report the service using 40 to 100 percent of the CPU on several Windows versions, often after startup. Check for an updated Intel Management Engine package from the PC maker. If the file is not in the Intel folder, or Defender finds a miner, treat the CPU load as malware.
What is the CVE-2017-5689 note about?
In 2017 researchers found a privilege escalation flaw, CVE-2017-5689, in Intel manageability firmware (Active Management Technology, Standard Manageability and Small Business Technology). Patch it with the firmware and Intel software updates from your PC maker, so the flaw cannot be exploited. NVD holds the record.
How do I get rid of an lms.exe virus?
Restart in Safe Mode with Networking and run a Microsoft Defender full scan from there, then an offline scan. Malware changes the registry, the boot sequence and the hosts file, so removing the file alone is not enough. Update Windows afterwards and change the passwords you used on that PC.
Sources
- Local Manageability Service and system resources (Intel Community)
- CVE-2017-5689 (NIST National Vulnerability Database)
- Resource Hijacking, T1496 (MITRE ATT&CK)
- Microsoft Defender Offline (Microsoft Learn)
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…