Credential Enrollment Manager – what is this service?

Credential Enrollment Manager Service is a system service that is present in the later editions of Windows 10. It is associated with the credentialenrollmentmanager.exe process, which can be observed in the Task Manager. In this article, I will explain the purpose of this process and highlight its vulnerability to malware attacks.

Why does Windows 10 need the Credential Enrollment Manager?

This procedure is known as the retrieval of credentials from the internal keychain. Windows has the ability to store the logins and passwords utilized in Windows applications. If you are using Edge as your web browser and you log in to Gmail, the browser will prompt you to save the login and password. When you proceed with this prompt, the Credential Enrollment Manager is invoked.

When you attempt to log into the same account again, the operating system will execute the necessary calling operation. Windows will initiate this process by locating the credentials associated with the website and automatically filling them into the login form. The presence of a separate service is required within the operating system due to the ecosystem of applications developed for Windows.

Credential Enrollment Manager file location

Credential Enrollment Manager file in folder

Can I disable Credential Enrollment Manager service?

There is no need to stop it, since it is inactive for the majority of time. As I have mentioned before, system calls for this service only when it is needed to get or receive the credentials. And even in these small periods of time Credential Enrollment Manager consumes literally nothing. Meanwhile, its disabling may cause different problems if you use applications from the Microsoft ecosystem.

The cases when you can disable several processes in Windows to increase the system performance was in early 00s. When Windows XP was the last actual OS version, computers were quite weak, and their upgrade was quite expensive, disabling several services could really make your PC faster without any significant problems. Nowadays, such tricks can make things even worse.

How can I understand that this process is a virus?

There are no cases when a virus hijackes the Credential Enrollment Manager , or when malware uses its name for the malicious process. But while malware ignores the exact process, the vulnerabilities it has may easily be exploited by malware distributors. Different spyware used this security breach to steal the credentials that you use in the Windows applications. Nowadays, Microsoft claims that they dealt with this exploit in one of the security patches. Though, only Microsoft knows how strong this patch is.

No one can be sure that tomorrow the developers of some trojan virus will not decide to name the process of their virus as credentialenrollmentmanager.exe. So, if you have some suspicions, it is better to scan your PC with anti-malware software. My choice for malware detection and removal is GridinSoft Anti-Malware.

Removing the viruses with GridinSoft Anti-Malware

  • Download and install the GridinSoft Anti-Malware. After the installation, you will be offered to perform the standard scan. Apply this action.
  • GridinSoft Anti-Malware during the scan process

  • Standard scan lasts up to six minutes and checks the system files together with the files of the programs you have installed on your computer.
  • GridinSoft Anti-Malware scan results

  • When the scan is complete, press “Apply” to wipe out the malicious items that are present on your PC.
  • Malware removing with GridinSoft Anti-Malware

    Frequently Asked Questions

    Can I just delete the process from the root directory?
    No. In case if the process belongs to the legitimate system element, you will not be able to edit the root directory of the system, where it is stored, without granting yourself permission for this action.
    Is it possible to decrease the hardware consumption of this process?
    That process consumes literally nothing, so you will likely see no occasions when there is a need to make it less greedy with resources. However, if you see that it takes more than 20-30% of your CPU and the same amount of RAM, it is likely a virus. Perform the guide I wrote above.
    How can I know this process is malicious without checking its root directory?
    As was mentioned in the previous question, the CPU/RAM consumption of the original process is very low. So, the Credential Enrollment Manager process that uses a lot of hardware capacity is definitely a virus. Another way to understand that this process belongs to a malicious program is its location inside of the Process Explorer.

    About the author

    Wilbur Woodham

    Technical writer covering malware detections, unwanted programs, and browser-based threats. Wilbur turns research notes into step-by-step guides that Windows users can follow safely.

    2 Comments

    • buongiorno,mi scusi il disturbo ma non riesco disattivare il gestore di password, tutte la volte che entro nella pagine dove sono tutte le pssword e clicco sopra ad una di esse mi chiede sempre di autenticarmi e possibile trovare un sistema per togliere questa autenticazione???ho provato di tutto e letto di tutto su internet ma nulla.la ringrazio per l’attenzione cordiali saluti

    • I agree that stupid and useless service doesn’t consume anything same as the other hundres of stupid and useless Microsoft Services. I don’t care if it consumes memory or processor I don’t want that shit running on my computer like Ms Shit (I mean Edge). So if I never use Edge or any MSapp (in fact I deleted it from my PC) do I stil have to keep these idiotic services? ^^

    Leave a Comment