lms.exe high CPU: what the Intel Local Management Service is and how to fix it

What lms.exe is, and why it is on that machine

lms.exe is the executable behind the Intel(R) Management and Security Application Local Management Service, whose service name is LMS. It exists on PCs with Intel's manageability stack (vPro, Active Management Technology or Standard Manageability). It lets local software talk to the Management Engine firmware through the MEI driver, and Intel documents it as listening on ports 16992 to 16995, 623 and 664.

Intel's own documentation says the LMS installer is packaged with the Management Engine drivers on the PC manufacturer's support site, and that Windows Update installs only the MEI driver, not LMS. That matters later: the fix for a misbehaving LMS is almost always a manufacturer package, not a Windows patch.

1. Prove the CPU is really lms.exe

Ask for the current percentage over several samples. The CPU column in Get-Process is lifetime processor seconds and will mislead you.

1..5 | ForEach-Object {
  Get-CimInstance Win32_PerfFormattedData_PerfProc_Process -Filter "Name='LMS'" |
    Select-Object Name, IDProcess, PercentProcessorTime
  Start-Sleep 2
}

One logical core fully used reads as 100, so a single runaway thread on an eight-thread laptop shows near 100 while the whole machine is near 12 percent. Decide whether that is actually the complaint before changing anything.

2. Check it is the genuine Intel file

A name is not an identity. Malware is commonly named after a quiet Intel process, so confirm where it runs from and that it is signed.

Get-CimInstance Win32_Service -Filter "Name='LMS'" |
  Select-Object Name, DisplayName, State, StartMode, ProcessId, PathName
$p = (Get-CimInstance Win32_Service -Filter "Name='LMS'").PathName.Trim('"')
Get-AuthenticodeSignature $p | Select-Object Status, @{n='Signer';e={$_.SignerCertificate.Subject}}

Expect a signed file under an Intel folder in Program Files, registered as a service. A copy in Downloads, Temp, AppData or Desktop, an unsigned file, or no LMS service at all while a process called lms.exe runs, is not this guide: treat it as suspicious, do not delete it, and send it to whoever owns endpoint security.

3. Find out whether the machine uses Intel manageability at all

Many business laptops ship with the stack installed and nobody provisioned. Look at the driver that LMS depends on.

Get-CimInstance Win32_PnPSignedDriver |
  Where-Object { $_.DeviceName -like '*Management Engine*' } |
  Select-Object DeviceName, DriverVersion, DriverDate

An old driver date next to a recent Windows feature update is the pattern worth noting. It is a lead, not proof: Intel's pages do not give one root cause for LMS CPU use, which is why the steps below go from least to most invasive.

4. Fixes, least invasive first

1. Update the package from the PC maker. Get the current Intel Management Engine (or Intel MEI/LMS) component from the manufacturer's support page for that exact model. This is the durable fix, and it is a software install that needs approval.
2. Restart the service to confirm the symptom is the service. This briefly interrupts anything using local manageability. If CPU drops and climbs back, you have reproduced it.
3. Only if the customer does not use Intel manageability: set the service to Disabled.

Restart-Service LMS

Disabling LMS is a configuration change, and on a managed fleet it can break a console that discovers or manages machines through Intel AMT. Intel documents the command in its INTEL-SA-00075 mitigation guide as a way to reduce exposure, and also notes that anyone with administrator rights can re-enable it. Record the current start mode first so the change can be reversed, and ask the customer if anything relies on it.

# Record first:
Get-Service LMS | Select-Object Name, Status, StartType
# Then, only with approval:
sc.exe config LMS start= disabled
Stop-Service LMS

5. Verify

Repeat the sampling from step 1 for several minutes, not one reading, and ask the user whether the original symptom (fan noise, battery drain, a slow machine) has gone. If lms.exe returns after the next Windows feature update, the driver package is still the old one.

Where RemediateDesk fits

On a real endpoint, RemediateDesk runs steps 1 to 3 as read-only checks, shows you what it found, and proposes the restart or the disable as an exact command. Anything that changes the service waits for a technician's approval, and it will not mark the ticket resolved until a separate CPU check has run after the change. It cannot download an OEM driver package on its own judgement for you; that stays a technician decision. See endpoint remediation for MSPs for how commands are classified.

Frequently asked questions