TPMProvisioningService.exe
Summary
TPM Provisioning Service - provisions and configures the Trusted Platform Module.
TPMProvisioningService.exe is the 921st most commonly executed Windows program in EchoTrail's dataset, observed 2,606 times across enterprise environments. It typically runs from C:\Program Files\Intel\iCLS Client and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files\Intel\iCLS Client58.64%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_76523213b78d9046\lib14.78%
- C:\Program Files\Intel\Intel(R) Management Engine Components\iCLS10.88%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_75ffca5eec865b4b\lib10.34%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_a93205b6238060e4\lib2.14%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_7e148e9c120d86df\lib1.61%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_dec9bbf83f76d9e5\lib1.26%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_34687bf44d0a152a\lib0.19%
- C:\Windows\System32\Intel\iCLS Client\lib0.11%
- C:\Windows\System32\DriverStore\FileRepository\iclsclient.inf_amd64_1244e13de260a91d\lib0.04%
Top Hashes (SHA256)
- 2a651f943863fb96b8e5070962ef8b2c89ff1329010220979eb7ab8696f4556752.25%
- 2ccfd4ccd1badd4da0c2d63ca19c20672d1da072e203bb37d174b6a0f67a270415.23%
- 03026e2dd25405009c95c33681bca7a3395b642ebb8d3afaeb284f2966dc957810.66%
- 26b0c619e48fc69b24d72cbdc3c4e6060e9c4091ff5fcb2c0df8d7c4e8af93824.54%
- fa1619d9232e863018afc0eef425a506ebfbea0512b70232464180d4042f28172.92%
- 3f86b26c6feaf22e915902016ff13b21e7bcdd74255b5abce387b9065aca00d82.21%
- b7ab5579ae9d4594c24e8dd423675465a08d2ff2425d2b33c12405c05e08eb2e1.89%
- 41493917b189b030ea08238f316f16c0f4117b86638c22d4bc3d7e5f36dbdbed1.66%
- 64b7e3a944263948ac88caca3a7adbb235ed5c8beb743d03ff84fbd7165f5bde1.5%
- 72837af3e45cfb14b15580c4da0599f15e09af4db0c73ed1c324ab9f776b946a1.5%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Top Children
- regsvr32.exe0.12%
- ctfmon.exe0.06%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about TPMProvisioningService.exe
Rocky answers questions about TPMProvisioningService.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.