Credential Enrollment Manager – what is this service?
Andrew White Credential Enrollment Manager Service is a system service that is present in the late editions of Windows 10. In Task Manager, this service is presented with credentialenrollmentmanager.exe process. In this article, I will explain the task carried by that process, and also show you why it is vulnerable to malware attacks.
Why does Windows 10 need the Credential Enrollment Manager?
This process is called only when you are requesting some credentials from the internal keychain. Windows is capable of keeping the logins and passwords you used in Windows apps. If you use Edge as your web browser and log into Gmail, the browser will offer you to save the login and password. At the moment when you confirm this action, the Credential Enrollment Manager is called.
The OS will perform the calling operation when you will try to log into this account again. Windows will call this process, it will find the credentials for this website, and paste them into a login form. Operating system needs a separate service because of an ecosystem of applications created inside of Windows.
Credential Enrollment Manager file in folder
Can I disable Credential Enrollment Manager service?
There is no need to stop it, since it is inactive for the majority of time. As I have mentioned before, system calls for this service only when it is needed to get or receive the credentials. And even in these small periods of time Credential Enrollment Manager consumes literally nothing. Meanwhile, its disabling may cause different problems if you use applications from the Microsoft ecosystem.
The cases when you can disable several processes in Windows to increase the system performance was in early 00s. When Windows XP was the last actual OS version, computers were quite weak, and their upgrade was quite expensive, disabling several services could really make your PC faster without any significant problems. Nowadays, such tricks can make things even worse.
How can I understand that this process is a virus?
There are no cases when a virus hijackes the Credential Enrollment Manager , or when malware uses its name for the malicious process. But while malware ignores the exact process, the vulnerabilities it has may easily be exploited by malware distributors. Different spyware used this security breach to steal the credentials that you use in the Windows applications. Nowadays, Microsoft claims that they dealt with this exploit in one of the security patches, but only Microsoft knows how strong this patch is.
No one can be sure that tomorrow the developers of some trojan virus will not decide to name the process of their virus as credentialenrollmentmanager.exe. So, if you have some suspicions, it is better to scan your PC with anti-malware software. My choice for malware detection and removal is GridinSoft Anti-Malware.
Removing the viruses with GridinSoft Anti-Malware
Frequently Asked Questions
Can I just delete the process from the root directory?
No. In case if the process belongs to the legitimate system element, you will not be able to edit the root directory of the system, where it is stored, without granting yourself permission for this action.
Is it possible to decrease the hardware consumption of this process?
That process consumes literally nothing, so you will likely see no occasions when there is a need to make it less greedy with resources. However, if you see that it takes more than 20-30% of your CPU and the same amount of RAM, it is likely a virus. Perform the guide I wrote above.
How can I know this process is malicious without checking its root directory?
As was mentioned in the previous question, the CPU/RAM consumption of the original process is very low. So, the Credential Enrollment Manager process that uses a lot of hardware capacity is definitely a virus. Another way to understand that this process belongs to a malicious program is its location inside of the Process Explorer. System processes are listed in the corresponding thread, so that process’ application among the user’s background processes is a sign of malware presence.
