What is ucmapi.exe and Should I Remove It?

Several Windows users have been reaching us with questions after having doubts about one process that they constantly see inside Task Manager. UCMAPI.exe is often reported by users for taking up a lot of system resources or for locking up Outlook OST files, making them unusable until the next computer startup. After experiencing weird behaviors about this ucmapi.exe executable, some users are wondering whether this process is legitimate or is a security threat to their system. As it turns out, this executable is not exclusive to a certain Windows version as it’s encountered on Windows 10, Windows 8.1 and Windows 7.

What is ucmapi.exe?

The genuine ucmapi.exe file is a legitimate software component belonging to Microsoft Office. UCMAPI stands for Unified Communications Messaging Application Programming Interface.  The default location of this process is inside the main Office installation folder.

The main purpose of ucmapi.exe is to facilitate communications between SFC and Outlook. Without this SFB module, synchronization between calendar/schedule data, IM conversation history, and contact info would be impossible.

Although you should see this legitimate process popping up whenever there is an Office function that needs to be signed, you should not see it running at all times and you should not see this process eating a lot of system processes.

Is ucmapi.exe safe?

As mentioned above, the legitimate ucmapi.exe process is signed by Microsoft Corp. and doesn’t pose any security risk. However, don’t be so quick to label this file safe until you confirm that you’re dealing with the genuine file.

Keep in mind that nowadays most modern malware programs have cloaking capabilities. This means that a lot of viruses that are still effective now know how to disguise themselves as legitimate processes with enhanced privileges to avoid being picked by security scanners.

To make sure that’s not the case in your particular scenario, you should start by performing a series of investigations that will allow you to determine whether the executable you’re dealing with is genuine or not.

First things first, you should look for the parent application. If you’re not using Microsoft Office and you don’t have any product belonging to that suite installed on your computer, chances are you’re not dealing with a genuine ucmapi.exe file (unless it’s a remnant file).

In case you’re suspicious that the ucmapi.exe file you’re dealing with is not genuine, you should take a look at the location of the file. To do this, press Ctrl + Shift + Esc to open up the Task Manager window.

Once you get there, select the Processes tab from the horizontal menu, then scroll down through the list of background processes and locate ucmapi.exe. Once you see it, right-click on it and choose Open File Location from the newly appeared context menu.

If the revealed location is different than C:\Program Files (x86)\Microsoft Lync\ or C:\Program Files (x86)\Microsoft Office\root and you didn’t install the Office suite in a custom location, there’s a high chance that you’re dealing with a malicious executable.

If the investigation above has revealed a suspicious location where the ucmapi.exe file is stored, you should proceed by verifying if the executable is infected or not. The best course of action here is to check the file across a large Virus database to figure out if you’re dealing with a false positive or a legitimate security breach.

There are a lot of different services that will allow you to do this, but we encourage you to use the VirusTotal database since it’s the largest and it’s entirely free. To upload the file for analysis on VirusTotal, access this link (here), upload the file and wait for the analysis to complete.

Note: If the VirusTotal analysis didn’t raise any concerns, skip the next section below and move directly to the ‘Should I remove ucmapi.exe?’ section.

On the other hand, if the analysis above had some red exclamation points, continue with the next section below for step-by-step instructions on dealing with the virus infection.

Dealing with the security threat

If you’re following this section, it means that the investigation above has raised some concerns about virus infection. In this case, it’s highly recommended that you deploy a security scanner that’s 100% capable of identifying and removing malware with cloaking capabilities.

Keep in mind that when dealing with self-cloaking malware, these executables are notoriously hard to detect and eliminate. Not all scanners are capable of dealing with them effectively – especially free versions of security scanners.

But if you’re looking for a security that’s capable of dealing with these kinds of security threats without asking you to purchase a premium subscription, we recommend Malwarebytes. A deep scan with this security will allow you to remove the vast majority of malware that is programmed to avoid detection by posing as processes with enhanced privileges.

If you’re unsure of how to perform a deep Malwarebytes scan, follow the instructions outlined in this article (here).

If the scan above managed to identify and quarantined infected items, restart your computer and see if the ucmapi.exe process disappears from the list of active processes inside Task Manager.

If this method wasn’t applicable or you’re still experiencing the same behavior in relation to the ucmapi.exe, move down to the next section below.

Should I remove ucmapi.exe?

If the investigation above didn’t reveal any security issues, you can safely assume that the ucmapi.exe executable you’re dealing with is genuine.

Keep in mind that the ucmapi.exe is an SFC module that facilitates communications between SFC and Outlook. Removing this module will break synchronization between Calendar/Schedule data, IM conversation history, and contact info.

If you are prepared to face these consequences, you can potentially remove the process if you want to. But deleting the process manually won’t do you much good since the Office program will likely regenerate it during the next system startup.

How to fix issues related to ucmapi.exe?

Several different issues are related to the ucmapi.exe process. Some users are reporting that this process locks up the Outlook OST file until the next startup, some say that the process is consuming an excessive amount of resources even when Office is not running while others are reporting that this process ends up causing Skype whenever it’s started.

Regardless of your issues with this process, we’ve analyzed each scenario in part and tested out the various repair strategies that are recommended by affected users that managed to get this particular issue resolved. As it turns out, several different scenarios will cause problems with the ucmapi.exe process. Here’s a shortlist of potential culprits:

Method 1: Removing the Lync Meeting Add-in

As it turns out, this issue can also occur due to an Outlook add-in called Lync Meeting. As it turns out, using this add-in with Microsoft Office 2013 has the chance of causing unusually high resource usage caused by ucmapi.exe.

If this scenario is applicable you can resolve the issue by accessing your Outlook Options screen and removing the Lync Meeting Add-in. Several affected users have confirmed that this method allowed them to resolve the issue entirely

Here’s a quick guide on how to do this:

1.  Open the Outlook application and click on File from the ribbon bar at the top. Next, click on Options from the vertical menu on the left.
2. Once you’re inside the Outlook Options, select the Add-in tab from the vertical menu on the left section of the screen.
3. Inside the Add-in Options screen, go to the bottom section of the screen and click on the drop-down menu associated with Manage.
4. From the next window, select COM Add-ins and click Go to see the list of installed Add-ins.
5. When you’re inside the COM Add-in screen, search for Lync Meeting Add-in, select it and click on Remove to get rid of it.
6. Restart your computer and see if the issue is resolved at the next system startup.

   

If the same issue is still occurring, move down to the next method below.

Method 2: Disabling Lync compatibility mode

As it turns out, this particular issue can occur in situations where the main Lync executable is configured to run in compatibility mode (with an older Windows version). This ends up conflicting with the ucmapi.exe process with the potential of glitching it to the point where it will remain open even if the main Office program is closed.

Several users that found themselves in a similar situation have managed to get the issue resolved by disabling the compatibility mode on the Lync.exe file.

Here’s a quick guide on disabling the compatibility mode on the main Lync executable:

1. Right-click on the main Lync executable and choose Properties from the newly appeared context menu.

   

2. Once you’re inside the properties screen, select the Compatibility tab from the top of the screen and then uncheck the box associated with Run this program in compatibility mode for.
   

   

3.  Click Apply to save the changes, then restart your computer and see if the issue has been resolved.

If you’re still encountering the same issue related to the ucmapi.exe file even after you’ve performed the steps above, move down to the next method below.

Method 3: Repairing the Office Installation

As it turns out, this particular issue can occur due to some type of system file corruption inside the Office installation folder. This can either be triggered by a bad installation or can surface due to a quarantined office item.

Some users that were also encountering this issue have reported that they finally managed to resolve the issue by using the quick repair function included with the most recent version of Microsoft Office. Keep in mind that you should be able to follow the procedure below regardless of the Office suite that you’re using.

Here’s what you need to do to repair your office installation:

1. Open up a Run dialog box by pressing Windows key + R. Next, type ‘appwiz.cpl’ and press Enter to open up the Programs and Files window.

   

2. Once you manage to get inside the Programs and Features window, locate the Microsoft Office installation and right-click on it. Then, from the newly appeared context menu, click on Change.

   

3. Once you’re inside the repair menu, choose Quick repair from the list of available options to start the repairing process.

   

4. Once the process is complete, restart your computer once again and see if the issue is resolved at the next system startup.
   Note: You can also try performing an Online Repair if the first procedure fails.