ccmexec.exe and inventory.exe – what are they and what do they do?


I referred to these two processes tangentially in Microsoft laptop gripes, but based on referrer hits and email they deserve a post of their own.

Systems Management Server pushes out patches and keeps your software updated via an agent that’s installed on your PC. This agent shows up in task manager as CcmExec.exe (where ccm stands for change and configuration management), and in the services list as the SMS Agent Host. Normally ccmexec doesn’t do much, but (depending on your setup) it may periodically kick off an Office update process called inventory.exe. Doing an inventory involves a lot of disk seeking, and unfortunately SMS isn’t smart enough to notice if you’re actually using a laptop on battery power.

This can lead to the poor user experience of “I was sitting in a meeting minding my own business, and all of a sudden something called inventory.exe started thrashing my laptop’s disk, and I couldn’t get anything done for two minutes”. To avoid this, you can stop ccmexec when you want a quiet laptop, and then restart it when you want to be a good corporate citizen again. Needless to say, this is undocumented, unsupported, and liable to leave you with an unpatched machine and an angry sysadmin if you forget to restart the service – but if you got this far you probably realize that anyway. So here are three alternative methods:

  • From the command line: “sc stop ccmexec” and “sc start ccmexec” (where sc is c:\windows\system32\sc.exe)
  • From the GUI #1: open the services list, right-click on the SMS Agent Host service, and select Stop or Start.
  • From the GUI #2: having typed “sc stop ccmexec” and “sc start ccmexec” into Start>Run, use the drop-down history menu at the end of the Run box to re-run them whenever you want to.

Ideally, I’d like to stop and start ccmexec programatically as I go on and off battery power. My Toshiba Tablet PC has an extended set of power schemes that almost does what I want, but not quite – it can changes power schemes when I run an arbitrary program, but not run an arbitrary program when I change power schemes.

Update: clarified where inventory.exe comes from, thanks to SMSPerfGuy‘s comment.

Update #2: the latest version of the Office Update Inventory Tool significantly reduces the CPU consumption while performing an inventory – so don’t stop the SMS service if you’re still seeing problems, ask your admin to upgrade the inventory tool instead!

Comments (35)

  1. Joku says:

    I suppose there’s not "standard" way of querying what power mode is currently used, to allow writing some tool to do that or something?

  2. There probably is, but I’m hoping someone else out there will tell me about it… 🙂

  3. Heine Jeppesen says:

    It shouldn’t be that difficult to check the powerstate of a computer.

    Try this program I did in a few minutes.

    It uses the Win32 API to check for the powerstate and if the computer is considered offline by the OS, it will check if the ccmexec service is running and if so, stop it.

    It should also try to start the service again if it finds the power is back on.

    The check is done every 60 seconds.

    I haven’t really tested it since I’m to lazy to turn on my laptop 🙂

    Btw: Use /s if you want to get rid of the messagebox once you’ve tested it.

    http://www.betaplace.dk/sms2003/smscheck.zip

  4. Very cool – could you include the source in the zip file, for the paranoid amongst us? 🙂

  5. SMSPerfGuy says:

    FYI: Inventory.exe is the Office scan tool. It has nothing to do with SMS hardware or software inventory. It is used to scan to make sure Office related products are up to date.

  6. Thanks for the clarification – inventory.exe does seem to be kicked off by SMS though. At least, if I do a "sc start ccmexec" when my laptop’s been sitting idle for a while, that’s the process that will promptly peg the CPU for a minute or two 🙂

  7. It is part of the Office Scan in the same way that the MBSA (or to be more specific mbsacli.exe) is used by the Security Scan Tool for Software Updates functionality in SMS. Scanwrapper.exe calls this utility to find which updates are installed and which are not, and then the data rolls up to SMS via HINV. More info here http://www.microsoft.com/office/ork/xp/journ/OffUTool.htm . This is kicked off by SMS when it runs as part of the normal weekly (or however often you decide to configure the process later) Advertisment.

    IMHO, having people kill CcmExec should be a rarety as the Security and Office Scans should take less than 60 seconds under ‘normal’ conditions. If its taking longer and bogging down a system the SMS Administrator needs to start digging into what on the system(s) is causing this perfomance hit and possibly open up a case with PSS. CcmExec is the actual SMS Agent (the SMS Agent Host service calls this) and by killing the process all client functionality stops – inventory, software distribution, patch management, etc. Better to fix the problem.

  8. I agree that by stopping and restarting the SMS service I’m fixing the symptom and not the cause. Having said that, it’s also a quick fix for a definite pain-point: it’s just unacceptable for this service to stop me getting work done on my laptop in the middle of a meeting, even if it’s only for a couple of minutes. And since I only do this while on battery power, the SMS service is stopped for a maximum of three hours. At least with current technology 🙂

  9. Levi Stevens says:

    I wanted to point out that a new version of the Office Inventory tool has been released that addresses the performance issues. If you are still hitting this then notify your IT administrators to update thier SMS scan packages.

  10. Thomas Smailus says:

    My problem with ccm is not a performance issue, but a problem with it grabbing file handles and then not releasing them. I have large data sets on my drive, and occasionally find that ccm has an open handle to the contents, though no applications I am running are in those directories.

    Result = windows will not allow me to rename the directory = highly irritated user.

    Result = turn of ccm and forget about being corportate citizen until microsoft can figure out how to not get in my way with the things its trying to do ‘for me’.

  11. Massimo says:

    I’m angry too. I deal with an xp system with only 256 Mb of memory. Having tasks running continuosly affects performances dramatically.

    Result=I’m looking for a way to stop definitively ccmexec

  12. jonathanh says:

    Massimo – if you’ve got ccmexec running on your system, it’s because your sysadmin wants it there. If it’s affecting your work, ask him or her for more memory!

  13. Paul M says:

    In my circumstance this process seems to continually throughout the day access various and numerous files and hence kick the on access VirusScan regularly resulting in the machine pausing for several seconds at a time.  Is it really appropriate to continually inventorise the drive given the impact it can have?

  14. jonathanh says:

    Paul – your admin should have some control over how frequently the inventory takes place.

  15. Nishant says:

    Terminating or blocking SMS (ccmexec.exe and inventory.exe) doesnt affect the system, just ensure that you do all the patches manually. I dont like the auto enforce from SMS so i keep it blocked 😉 using Sunbelt Kerio Personal Firewall

  16. Elroy says:

    As a user, I can sympathize. And having Inventory.exe kick-off over a dial-up/VPN is ridiculous.

    As an administrator of SMS, I’d rather hear about your performance issues and help fix them than to have your laptop go without security updates–especially if you’re out ‘cavorting’ with unprotected wireless connections. I don’t need to deal with the bugs you bring home.

    And fair warning: if I find a Kerio personal firewall on your laptop blocking my administrative tools–and it’s my job to find it–your supervisor will hear from mine. Nothing personal.

  17. Lurking Observer says:

    This was a very helpful dialog.

    Thanks everyone for your comments.

    🙂

  18. Tim says:

    I loose any use of my laptop for several minutes each time  it comes out of hiberbnate because of this process. It defeats the point of hibernating. My suspicion is that this is related to the wireless network and VPN not being available immediately and the the state of the offline files being being differnt pre- and post-hiberante as a result.

  19. Marco says:

    Elroy: I appreciate that you don’t like users disrupting efforts at security, but let my try to describe the situation this way:

    the *user* is paid by the company do do useful work;

    the *sysadmin* is paid by company to make computers run, so that users can do their job;

    SMS updates, ccmexec and whatnot are tools that help *sysadmins* to do their job, on average at the detriment of *users* who as a result are hindered in theirs.

    No brainer, or what ?

    Cordially,

    Marco

  20. Maurizio says:

    Thanks for the article and the feedback, it helped me finding out what’s knibbling on my system and prevented me from shouting to our administrators.

    To Elroy: Sure you got to do your job, but to go crying by the boss…. hate that kind of admins…. this way you only trigger the "users" to hide their stuff better.

    And you widen the gap between the so-called "support" side and the "user" side, so next time you get even less credit if you want to "improve" something on the user’s pc’s.

    Why don’t sysadmins learn to communicate? If something is really necessary just tell people why that is, I guess you have fair chance that they’ll accept it.

  21. Nic says:

    CCMEXEC.exe was constantly grinding on my hard drive, so I renamed my the CCMEXEC.exe file to KILLCCMEXEC.exe.  Now WinDoze no longer finds it.  If I need an update, I’ll restore it… and kill it again after I’m done.

  22. Patrick says:

    Folks, there is a great tool out there called filemon from the sysinternals crowd. It shows you what programs are smashing away on your disk. I’ve been able to systematically find programs like ccmexec and others to help dramatically improve the performance on my MS lappie.

    BTW, if SMS updates can’t play well with me. I won’t play well with it. Disabled.

  23. 0/0 says:

    1. Telling sysadmins that they’re only there to make sure the users can do the actually useful work is rather like telling a cop that you pay his salary – generally unhelpful, and likely to end less than favorably.

    2. If the users don’t like the administration tools, they need to complain to the admins and tell them why, so that they can fix the issues. Going around them is childish and petty.

    3. SMS blows anyway. Use a real management tool like Novell ZENWorks, or maybe LANDesk. I’m in the middle of learning and implementing SMS after working with ZEN for the past 8 years, and I am constantly amazed by the kludgey, half-baked way that most of it works (or doesn’t work). Management tools should be seen and not heard, except when doing something deliberate and large, and only after prior communication from IT. Daily management should be invisible.

  24. C says:

    services.exe musy be a pretty comprehensive, "hide-all" package because it rips away at my poor HD ALL DAY LONG. What could it possibly be doing for days on end?!? I think I might look into filemon.

  25. C says:

    After 3 straight days of HD crackling in my laptop, I ran "sc stop ccmexec" and…Silence!  I have my sanity again. I will now do a half hearted search for the purposes of CCMEXEC.exe and see if I ever need to turn it back on.

  26. Larry says:

    I found this process by using filemon.exe (from microjunk) and running it to find out which process had which files open. The CcmExec.exe program must have a flaw in it because it was accessing my CVS repository and all other files on my hard drive. They had nothing to do with office.

    This is another example of terrible design by Microjunk. Linux rules.

  27. Joe says:

    Can CcmExec.exe have an effect on closing outlook?

    Everything I close it — the taskmanager shows multiple instance running. I have to close it from taskmanager to stop it. And restarting it causes it to start from safe mode.

    I’ve read posting suggesting that some program may be accessing outlook is what causes my delimema.

  28. joe says:

    Gotta program "knockout.exe" to fix my issue.

  29. JeffCurless says:

    My issue is that for some reason, CcmExec.exe seems to keep handles to VMWare virtual machines that I have opened previously.  It stops me from being able to open the vm again later.  Stoping CcmExec clears this problem.

    Weird.

  30. AnActualSysAdmin says:

    ——–

    Tuesday, May 29, 2007 5:16 PM by Larry

    I found this process by using filemon.exe (from microjunk) and running it to find out which process had which files open. The CcmExec.exe program must have a flaw in it because it was accessing my CVS repository and all other files on my hard drive. They had nothing to do with office.

    This is another example of terrible design by Microjunk. Linux rules.

    ——–

    Larry – I’m not sure you understand what ccmexec.exe is.  That is the executable that the SMS Agent uses.  It is unrelated to Office.  The problem people are discussing is related to inventory.exe, an Office inventory tool.  The issue here is that when SMS kicks off it’s regularly scheduled inventory processes, it can cause inventory.exe to also initiate.  The SMS inventory processes themselves have very little impact. If you have that on your computer, then your computer is in a managed environment – managed by your sysadmins.  Please report any issues you have to them, and get them to troubleshoot the source of the problem.

    Arrogant users annoy me – especially the know it all linux people whose sole source of education is wikipedia.

  31. Mark says:

    I just wanted to pass along my thanks for this blog entry. I’ve had to  fight ccmexec.exe from a different perspective than the laptop scenario you describe. Sometimes I need to attach a USB external drive to my system.  Many times when I tried to stop the device via the "Safely remove hardware" feature, I would get the dreaded "unable to stop the device at this time" message. I found UnLocker (http://ccollomb.free.fr/unlocker/), a neat little utility which can unlock a device. But when it came to ccmexec, it wouldn’t do any good since as soon as I unlocked the dozen  references ccmexec had, it had moved on to the next dozen.

    So anyway, your tip now allows me to easily get my portable drive safely detached without having to do a shutdown and restart. Much faster to stop a service, then restart it after detaching the device. So thanks for taking the time to publish this.

  32. unnamed by request says:

    Interesting, looking at this thread 2 and 3 years later (Dec 2010). I had found ccmexec.exe interfering with my laptop about 6 months ago, after our company upgraded to Office (from Corel Suite). I had read that ccmexec is how SMS runs patches and updates; however, how can it do this when the laptop is not connected to a company network? I think it runs, as others have said, CONSTANTLY. Filemon shows it accessing every f_n file on the hard drive, all day long, worst at bootup. It scans the Windows hotfixes Uninstall files too!! Every day.  You need System Cred to stop it programatically. However, even manually stopping it in TaskMgr, it returns to life by itself in 5 minutes from Stopped state. Does this every time too. So far, sysadmins are ignoring the tremendous work outage that occurs for every laptop user (we mainly have single core cpu machines).  A great thread

  33. DAG says:

    Your update #2 link titled "Office Update Inventory Tool" goes nowhere. Though I guess that's expected since it's MS's website (90% dead links in all articles, blogs, etc that reference the site). Rather obnoxious that the site is still so useless after many years of the same continuous problem.