In this guide, we are concerned with the issue where the Microsoft.Photos.exe process tries to access the internet on Windows devices. Many users reported that their antivirus application (or security utility) flagged the Photos app process as a potentially malicious program.
Since you are here, you too probably saw a prompt or dialog where your antivirus asked if you wanted to allow communications initiated by the Microsoft.Photo.exe process over your firewall. At that moment, you might have wondered why the Photos application needs to connect to the internet or why your antivirus prevented it from doing so and flagged its actions as suspicious. Well, we have all the answers here.
What is Microsoft.Photos.exe?
Microsoft.Photos.exe is the process associated with the Microsoft Photos application on Windows 10. The Photos app is preinstalled on computers; it is the default image viewer. A good number of users are contented with the work the Photos app does, while others install third-party programs to view images and perform related tasks.
Why is Microsoft.Photos.exe trying to access the internet?
If the Microsoft.Photos.exe process trying to access the internet on your computer is the genuine program, then we can infer it attempted to reach the web for one or more of the following reasons:
- The application is trying to check for and download updates to its components and packages. Of course, just as is the case with Windows updates which are fetched from Microsoft servers, Microsoft Photos too needs internet access to get its stuff.
- The Photos app wants to initiate syncing operations. Microsoft embedded the OneDrive sync function inside the Photos application. When users enable OneDrive sync, the Photos program automatically works to upload images to the cloud (OneDrive storage facility). Well, this is where the need for web access comes in.
- The Photos program might be trying to send feedback and other relevant diagnostic data to Microsoft. Yes, the app is programmed to use your internet connection to send such minor details.
Well, given the events or scenarios we described, it seems Microsoft forgot to attach its official digital signature to the Photos application, which explains why your antivirus (or security program) flagged the Microsoft.Photos.exe process as a potentially malicious program. Antiviruses and protection utilities are designed to check the signatures of unknown applications, especially when they try to initiate contact with the web – they typically block connections from untrusted apps and inform users of the action they took.
Or perhaps, Microsoft did fuse its digital signature with the app, but the recognition facility is broken or malfunctioning. To be honest, there are several possibilities and we cannot figure out all of them or deduce which one exactly is in play.
There is one important possibility – which is closer to an outlier – that you must be mindful of, though. There is a small chance that the Microsoft.Photos.exe process trying to connect to the internet on your computer is a malicious program which has been coded to masquerade itself as the genuine Microsoft Photos process. Attackers too are privy to the information about the Microsoft.Photos.exe process lacking a digital signature from Microsoft, and they might have developed exploits to take advantage of the oversight.
Why is the Microsoft.Photos.exe process always running?
Some users also raised the issue regards the Microsoft.Photos.exe process or a similar Microsoft Photos component always running on their computers even when the program itself is not open or active on their taskbars. If you too launch the Task Manager app and check the utilities operating on your system, you are likely to see the Photos.exe process or something similar running.
Well, you have to understand the Microsoft Photos app was designed and configured to always run as a background app, not least because it is the default image viewer on devices running Windows 10. Like other background applications – whose components remain active on some level even when their windows are closed – the Microsoft Photos app is still alive even when it has no open window.
Is Microsoft.Photos.exe a security risk?
If you are certain the Microsoft.Photos.exe process running on your computer is the genuine program, then you should have no issues – if you are right. The uncertainties involving this process, though, might constitute enough reasons due to which users start worrying.
For one, the general expectation that the Microsoft.Photos.exe process is always supposed to be running might play into attackers’ hands, the same way the program’s apparent lack of a digital signature did. A harmful or malicious program can be designed to mirror the Microsoft Photos behavior or activity, which means they get allowed to wreak havoc or cause harm while masquerading as a regular utility.
Is Microsoft.Photo.exe ransomware?
Given all we have said up to this point, defining Microsoft.Photos.exe as a security risk or not is mostly subjective. If you are sure the process operating on your system is the genuine program from Microsoft and you are fine with a digitally unsigned application using your internet, then you can leave the process or application alone.
However, if you are bothered that an app – which is supposed to have a digital signature from Microsoft but lacks one – is always running on your computer and even wants to connect to the web, then you can block its communications using your antivirus or security utility. When the dialog or window comes up to ask if you want to let the program through your firewall, you can click on Block or the button that ensures the connection never goes through. In your antivirus or protection utility’s menu or settings, you should also be able to configure it to disable internet access for Microsoft Photos (or its components and processes).
If the Microsoft.Photos.exe process is always consuming a big percentage of your computer resources, then this event is enough reason for you to suspect that something is not right. If you try to trace the location of the process you see and find it running from a directory that does not lie along the C:\Program Files\WindowsApps\(…)\Microsoft.Photos.exe path, then your suspicions are justified. You will do well to investigate things further.
On the other hand, if you trust the Microsoft.Photos.exe process you saw – if you are sure it is the legit program from Microsoft, then you can consider your antivirus or security utility threat detection or blocking action on it as a false positive. In that case, you can create an exception for it in your firewall rules so that the process communications go unhindered.
Nevertheless, you can take certain precautions to minimize the risks of you becoming a victim of malware attacks – especially if you do not know what to believe. For one, you can disable, turn off, or remove the Microsoft Photos application. This way, if you find any Microsoft.Photos.exe process running or trying to connect to the internet, you will know it is malicious or dangerous.
How to turn off the background function for the Microsoft Photos app
You can disable the background function for the Microsoft Photos application on your computer so that its components or processes stop operating without your knowledge (when the app window is not open). This way, the Microsoft.Photos.exe process is unlikely to try to connect to the internet since it will no longer be allowed to consume your system resources without supervision. Anyway, here are the steps you need to go through to do the job:
- First, you have to bring up the Search pane on the Windows Start menu screen. You can use the Windows logo button + letter S keyboard shortcut to perform the task here.
- Type Background apps into the text box available to perform a search operation using those keywords. Once Background apps (System Settings) comes up as the main entry on the results list, you must click on it.
The Background apps screen in the Settings application window will be displayed now.
- Go through the items listed as background apps and locate Microsoft Photos. Click on the toggle or switch beside it to turn off the background function. That should be it.
How to uninstall the Microsoft Photos app on Windows 10
If you want nothing to do with the Microsoft Photos application on your Windows 10 device – given the complications, uncertainties, and risks associated with the app – then no one can blame you. The program itself is hardly worth the trouble. You can easily get rid of it and install a third-party image viewer application as a replacement. To be fair, a good number of alternatives to the Microsoft Photos application have always existed, especially those that do not collect data from users and consume fewer system resources than the utility provided by Microsoft.
To uninstall the Microsoft Photos app, you must run a command on an elevated PowerShell window to force your computer to find its program packages or files and get rid of them. Anyway, here are the steps you need to go through:
- First, you have to launch the required PowerShell window (one with administrative privileges):
Use the Windows logo button + letter S keyboard shortcut to bring up the Search pane for the Windows Start menu. There, you must fill the text field with PowerShell to perform a search operation using that keyword.
Once Windows PowerShell (App) shows up as the main entry on the results list, you have to click on it to launch the needed program.
If a User Account Control prompt or dialog comes up to get some form of confirmation for the program launch operation, you have to affirm by clicking on the Yes button.
The Administrator: Windows PowerShell application window will come up in no time.
- At this point, you have to type in and execute this code (by hitting the Enter button on your device’s keyboard):
Get-AppxPackage *photo* | Remove-AppxPackage
- Assuming the code execution operation has reached completion, you must close the Windows PowerShell app and other applications running on your computer and then restart your PC.
How to fix other Microsoft.Photos.exe issues on Windows 10
If the Microsoft.Photos.exe process on your computer is misbehaving or if you are experiencing problems with the Microsoft Photos application itself, then there are a couple of procedures you can use to force the app to function normally. Here are some of them:
Repair and reset the Microsoft Photos app:
The repair and reset functions accessed through the program’s menu in the Settings application are capable of forcing changes that resolve a wide range of issues with the Photos app. You will do well to use the repair function first – since its effects are mild – and if it fails, you can then try the reset function whose effects are more disruptive.
Anyway, you have to go through these instructions:
- First, you have to launch the Settings app (using the Windows logo button + letter I keyboard shortcut).
- Once the Settings application window comes up, you have to check its main screen list and click on Apps to enter the menu there.
- On the screen that follows, you must go through the applications listed and locate Microsoft Photos. Click on it to get it highlighted.
- Click on the Advanced options link (that only recently showed up). On the following screen, you have to click on the Repair button.
Windows will now work to repair the Microsoft Photos app as best as it can.
- After the repair operation reaches completion, you must restart your computer and then check the state of the Microsoft Photos app.
If the issues with the application persist, then you must continue to the next step:
- Open the Settings application again as you did earlier, navigate to the Apps menu there, and then enter the Advanced options screen for Microsoft Photos.
- This time, you have to click on the Reset button.
Your system will now act to reset the Microsoft Photos application, which means it will be reinstalled and its settings will be reverted to their default values.
- Once the reset operation reaches completion, you must reboot your system and then check if the Photos app now works fine.
Delete the Microsoft Photos old or outdated registry keys:
If the repair and reset operations fail to bring about the changes needed, then you have to fix things through an unorthodox method. Here, we intend to guide you through the removal operation of registry entries for the troubled Microsoft Photos application so that it gets a new breath of life.
Well, we have to tell you about the risks associated with editing stuff on the registry or the complications that could arise if you make the wrong changes and save them. We recommend you make a backup of your registry entries – if you have the time. It will come in handy if things go wrong.
Anyway, these are the instructions you have to go through to perform the necessary tasks on the registry:
- First, you have to launch the Registry Editor app.
Use the Windows button + letter R keyboard shortcut to fire up the Run application and then fill the text field on its program window with this code: regedit
Hit the Enter button on your device’s keyboard. If you see a User Account Control prompt seeking some form of confirmation for the operation you initiated, you have to give affirmation by clicking on the Yes button.
By the time Windows is done executing the code, the Registry Editor program window will have appeared.
- Check the items in the top-left corner of the window, click on Computer, and then continue your navigation through these directories: HKEY_CURRENT_USER / Software / Classes / Local Settings / Software / Microsoft / Windows / CurrentVersion / AppModel / Repository / Families / Microsoft.Windows.Photos_8wekyb3d8bbwe.
- In your current location, you should see a couple of entries. They all contain or are represented by a specific version number (Microsoft.Windows.Photos_2017.35071.13510.0).
If you find more than three entries there, then you must assume that the outdated keys remained somehow, even after your computer downloaded and installed updates for Microsoft Photos. You have to remove the outdated entries and leave only the three most recent entries.
Windows will prevent you from deleting the entries, though. You have to acquire the necessary permissions first to be successful. You must continue with the instructions below:
- Click on an old entry (you can choose any of them) to highlight it. Right-click on the highlighted item to see some options and then choose Properties.
The Properties window for the selected old entry will be displayed now.
- Click on the Security tab and then click on Permission.
- Click on Advanced (under the Select User or Group window). Click on Find now and then fill the field with your username and then click on the OK button.
- Now, assuming the Properties and the Permission windows you worked on have been dismissed, you must return to the old entry you got Windows to highlight in the beginning. Right-click on it and then choose the Delete option.
The removal operation will proceed this time without issues (given the work you did). Now, you have to perform the same task on the other old entries to acquire the necessary permissions to force Windows to allow you to delete them.
- At this point – assuming you have finished deleting the old entries as we recommended – you must close the Registry Editor program window and restart your computer.
The Microsoft Photos app – given the serious changes you made to its installation code or data – should now function without issues on your PC.
Other things you can do to resolve issues with the Microsoft Photos app on Windows 10:
- Update Windows
- Update the Microsoft Photos application itself
- aRun the Windows Store Apps troubleshooter
- Remove the app package and then restore it.
Given the operations we described in this guide and the volume of work involved, you are likely to find Auslogics Anti-Malware useful in some way. If you need to scan the entirety of your system or run checks on suspicious files, then the recommended utility will assist you with those tasks. Furthermore, with security being the major theme in our explanations here, you will do well to strengthen your computer’s defense against viruses and malware and the installation of that anti-malware application is a step in the right direction.