UEMS Agent Health Checker – console window flashing in user session every 20 minutes (Windows 11)

UEMS Agent Health Checker – console window flashing in user session every 20 minutes (Windows 11)

Hi all,

For a few days now, users on our Windows 11 clients have been seeing a console window that pops up and closes immediately, several times a day. Only workstations are affected; we have not seen it on servers.

Environment

  • Product: ManageEngine Endpoint Central (on-premises)
  • Server version: 11.5.2632.08 (build number 115263208)
  • Windows agent: ManageEngine UEMS - Agent 11.5.2632.08.W, the same version on every affected client checked
  • Clients: Windows 11 Pro 25H2, build 10.0.26200, domain-joined
  • Default terminal: Windows Terminal 1.24.12741.0, left at the Windows 11 default ("Let Windows decide")

What we found

We have process creation auditing enabled (Security event 4688). Over a 10-hour window on two different clients, this chain runs every 20 minutes:

UEMSAgentHealthChecker.exe   (service "ManageEngine UEMS - Agent Health Checker", runs as SYSTEM)
  └─ UEMSAgentHcHelper.exe
       └─ UEMSAgentHcComHelper.exe   <-- started in the logged-on user's session
            └─ conhost.exe           (user session)

In the same second, svchost.exe starts WindowsTerminal.exe and OpenConsole.exe. This is the Windows 11 default-terminal handoff, and it is the window users see.

  • On both clients there were 30 Windows Terminal launches in 10 hours, and all 30 happened in the same second as a launch of UEMSAgentHcComHelper.exe. There were no Windows Terminal launches without it.
  • The interval is exactly 20 minutes, with a different offset on each machine (:06/:26/:46 on one client, :18/:38/:58 on the other), which is why users see it as random.
  • C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\UEMSAgentHcComHelper.exe: file version 1.0.1.0, last modified 25 Sep 2026. We believe it came in with an agent update.

Questions

  1. Is this a known issue in 11.5.2632.08, and is there a build or hotfix that fixes it?
  2. Can the Health Checker be configured to run UEMSAgentHcComHelper.exe without a console window (CREATE_NO_WINDOW / hidden), or can its 20-minute schedule be changed?
  3. Is it expected for this helper to run in the interactive user session rather than in session 0?

We would rather not change the default terminal on every client as a workaround, so a fix on the agent side would be preferable.

Thanks in advance.