Services Windows 10 Services

A list of the default services in Windows 10 (21H2).

Service Display Name Service (Registry Key) Description Default Status
ActiveX Installer (AxInstSV)AxInstSVUAC validation to control the installation of Active-X controls via the internet.Manual
Agent Activation Runtime_????? AarSvc_????? Chatbot Runtime for activating Conversational agent applications - Clippy returns.Manual
AllJoyn Router ServiceAJRouter IoT integration.Manual (Trigger Start)
App ReadinessAppReadiness Runs at first logon to prepare apps for use.Manual
Application IdentityAppIDSvc Verify Application identity, used by AppLocker.Manual (Trigger Start)
Application InformationAppinfoFacilitates running applications with additional administrative privileges. If disabled those additional privileges will not be available.Manual (Trigger Start, Running)
Application Layer Gateway ServiceALG Enables plugins for the now ancient internet connection sharing.Manual
Application ManagementAppMgmt Required for Group Policy software management, Not Available in Win 10 home.Manual
AppX Deployment Service (AppXSVC)AppXSvcWindows Store integration. Cannot be disabled.Manual
AssignedAccessManager ServiceAssignedAccessManagerSvc Kiosk mode, Not Available in Win 10 home.Manual
Auto Time Zone Updatertzautoupdate Automatically set the Time Zone.Disabled
AVCTP serviceBthAvctpSvc Audio Video Control TP service - Bluetooth / Wireless.Manual (Trigger Start)
Background Intelligent Transfer ServiceBITS Transfer files.Manual or Automatic (Delayed Start, Running)
Background Tasks Infrastructure ServiceBrokerInfrastructureCannot be disabled.Automatic (Running)
Base Filtering EngineBFEManage Windows Firewall and IPsec policies and implements user mode filtering. Do not disable.Automatic (Running)
BitLocker Drive Encryption ServiceBDESVCSecure startup and volume encryption.Manual (Trigger Start)
Block Level Backup Engine Servicewbengine Used by Windows Backup.Manual
Bluetooth Audio Gateway ServiceBTAGServiceBluetooth Audio - Wireless headsets.Manual (Trigger Start)
Bluetooth Support ServicebthservDiscovery of Bluetooth devices.Manual (Trigger Start)
Bluetooth User Support Service_????? BluetoothUserService_?????Bluetooth features.Manual (Trigger Start)
BranchCachePeerDistSvcUsed by Windows Update for download sharing on the local subnet.Manual
Capability Access Manager Servicecamsvc Manage UWP apps.Manual
CaptureService_????? CaptureService_?????Screen Capture Service via the Windows.Grapics.Capture API.Manual
Cellular TimeautotimesvcSet the time based on NITZ messages from a mobile network.Manual
Certificate PropagationCertPropSvcManage certificates for Smart Card login.Manual (Trigger Start)
Client License Service (ClipSVC)ClipSVCSupport for Microsoft store, cannot be disabled.Manual (Trigger Start)
Clipboard User Service_????? cbdhsvc_????? Clipboard.Manual
CNG Key IsolationKeyIsoSecure long lived keys for cryptographic operations.Manual (Trigger Start, Running)
COM+ Event SystemEventSystemCOM Event notification service, required for COM+Manual
COM+ System ApplicationCOMSysAppNetwork discovery of systems on local network.Manual (Trigger Start)
Connected Devices Platform ServiceCDPSvc Connected Devices Platform.Automatic (Delayed Start, Trigger Start)
Connected Devices Platform User Service_????? CDPUserSvc_????? Connected Devices Platform.Automatic (Running)
Connected User Experiences and TelemetryDiagTrackFeedback and Diagnostics.Automatic (Running)
ConsentUX_?????ConsentUxUserSvc_?????Connect and pair WiFi and Bluetooth devices, ConnectUX.Manual
Contact Data_?????PimIndexMaintenanceSvc_?????Indexes contact data for fast contact searching.Manual
CoreMessagingCoreMessagingRegistrarCannot be disabled. Manages communication between system components.Automatic (Running)
Credential ManagerVaultSvcSecure storage and retrieval of credentials. Control Panel: Credential Manager.Manual
CredentialEnrollmentManagerUserSvc_?????CredentialEnrollmentManagerUserSvc_????? Credential Enrolment Manager.Manual
Cryptographic ServicesCryptSvcManage root certificates.Automatic (Running)
Data Sharing ServiceDsSvc Data brokering between applications.Manual (Trigger Start)
Data UsageDusmSvcNetwork data usage,data limit/metered networks.Automatic (Running)
DCOM Server Process LauncherDcomLaunchRequired for COM and DCOM object activation requests.Automatic (Running)
Delivery OptimizationDoSvc Content delivery Optimisation.Automatic (Delayed Start)
Device Association ServiceDeviceAssociationServicePairing between the system and wired or wireless devices.Manual (Trigger Start)
Device Install ServiceDeviceInstallRecognise new hardware, do not disable.Manual (Trigger Start)
Device Management Enrollment ServiceDmEnrollmentSvcDevice enrolment/management.Manual
Device Management Wireless Application Protocol (WAP) Push message Routing ServicedmwappushserviceWAP - Sync device sessions.Manual
Device Setup ManagerDsmSvc Install device drivers.Manual (Trigger Start)
DeviceAssociationBroker_?????DeviceAssociationBrokerSvc_?????Pair devices.Manual
DevicePicker_?????DevicePickerUserSvc_????? Manage Miracast DLNA and DIAL UI.Manual
DevicesFlow_????? DevicesFlowUserSvc_?????Connect and pair WiFi and Bluetooth devices, ConnectUX/PC settings.Manual
DevQuery Background Discovery BrokerDevQueryBrokerEnable apps to discover devices with a background task.Manual (Trigger Start)
DHCP ClientDhcpAllocate an IP address to this computer automatically.Automatic (Running)
Diagnostic Execution ServicediagsvcEnable troubleshooting support.Manual (Trigger Start)
Diagnostic Policy ServiceDPSEnable problem detection, troubleshooting and resolution for Windows components.Automatic (Running)
Diagnostic Service HostWdiServiceHostDiagnostics for Local Services.Manual (Running)
Diagnostic System HostWdiSystemHostDiagnostics for the Local System.Manual
DialogBlockingService DialogBlockingService DialogBlockingService Disabled
Display Enhancement ServiceDisplayEnhancementService Brightness.Manual (Trigger Start)
Display Policy ServiceDispBrokerDesktopSvcConnection and configuration of local and remote displays.Automatic (Delayed Start)
Distributed Link Tracking ClientTrkWksAttempt to maintain valid links between NTFS files across a network.Automatic (Running)
Distributed Transaction CoordinatorMSDTCCo-ordinate transactions between resource managers, database, file and message queues.Manual
DNS ClientDnscacheCache DNS queries and register the computername.Automatic (Trigger Start, Running)
Downloaded Maps ManagerMapsBrokerWindows/Bing maps.Automatic (Delayed Start)
Embedded Modeembeddedmode Activate background applications.Manual (Trigger Start)
Encrypting File System (EFS)EFSAllow storage of encrypted files on NTFS file systems.Manual (Trigger Start)
Enterprise App Management ServiceEntAppSvcCannot be disabled. Enterprise Application management.Manual
Extensible Authentication ProtocolEaphostNetwork Authentication - VPN NAP and Wireless.Manual
File History ServicefhsvcUsed by Windows Backup.Manual (Trigger Start)
Function Discovery Provider HostfdPHostNetwork discovery and Web Service discovery.Manual
Function Discovery Resource PublicationFDResPubPublish this computer and resources over the network.Manual (Running)
GameDVR and Broadcast User Service_????? BcastDVRUserService_?????Game recordings and Live broadcasts. Cannot be disabled.Manual (Trigger Start)
Geolocation ServicelfsvcManage Geofences - a geographic location with associated events.Manual (Trigger Start, Running)
GraphicsPerfSvcGraphicsPerfSvcMonitor graphics performance.Manual (Trigger Start)
Group Policy ClientgpsvcCannot be disabled. Apply admin settings through group policy.Automatic (Trigger Start)
Human Interface Device ServicehidservActivate and maintain hot buttons on keyboards and other controls.Manual (Trigger Start)
HV Host ServiceHvHostHyper-V interface for performance counters.Manual (Trigger Start)
Hyper-V Data Exchange ServicevmickvpexchangeHyper-V interface for data exchange.Manual (Trigger Start)
Hyper-V Guest Service InterfacevmicguestinterfaceHyper-V interface for VM services.Manual (Trigger Start)
Hyper-V Guest Shutdown ServicevmicshutdownHyper-V interface for VM shutdown.Manual (Trigger Start)
Hyper-V Heartbeat ServicevmicheartbeatHyper-V identify frozen VMs.Manual (Trigger Start)
Hyper-V PowerShell Direct ServicevmicvmsessionHyper-V interface for PowerShell.Manual (Trigger Start)
Hyper-V Remote Desktop Virtualization Servicevmicrdv Hyper-V desktop interface. Not Available in Win 10 home.Manual (Trigger Start)
Hyper-V Time Synchronization ServicevmictimesyncHyper-V time sync.Manual (Trigger Start)
Hyper-V Volume Shadow Copy RequestorvmicvssHyper-V shadow copy/backup.Manual (Trigger Start)
IKE and AuthIP IPsec Keying ModulesIKEEXT Internet Key exchange.Manual (Trigger Start)
Internet Connection Sharing (ICS)SharedAccessProvides NAT/name resolution for small office networks. Very rarely needed.Manual (Trigger Start)
IP HelperiphlpsvcIPv6 translation.Automatic (Running)
IP Translation Configuration ServiceIpxlatCfgSvcIPv6 translation.Manual (Trigger Start)
IPsec Policy AgentPolicyAgentNetwork level peer authentication. Enforces IPsec policies.Manual (Trigger Start)
KtmRm for Distributed Transaction CoordinatorKtmRmCo-ordinates distributed transactions. MSDTC/KTM.Manual (Trigger Start)
Language Experience ServiceLxpSvcDeployment infrastructure for configuring additional languages.Manual
Link-Layer Topology Discovery MapperlltdsvcCreates a Network map describing each PC and device.Manual
Local Profile Assistant ServicewlpasvcProfile management for local subscriber identity modules.Manual (Trigger Start)
Local Session ManagerLSMCannot be disabled. Manage local user sessions.Automatic (Running)
MessagingService_?????MessagingService_????? Text Messaging.Manual (Trigger Start)
Microsoft (R) Diagnostics Hub Standard Collector Servicediagnosticshub.standardcollector.service Collect real-time Event Tracing for Windows (ETW) events.Manual
Microsoft Account Sign-in AssistantwlidsvcRunning if using MS account to log in to computer.Manual (Trigger Start)
Microsoft App-V ClientAppVClient Manage App-V users and virtual applications. Not Available in Win 10 home.Disabled
Microsoft iSCSI Initiator ServiceMSiSCSIManage iSCSI devices.Manual
Microsoft Keyboard Filter MsKeyboardFilter Control keystroke filtering and mapping. Not Installed (Disabled)
Microsoft PassportNgcSvcProcess isolation for cryptographic keys. Cannot be disabled.Manual (Trigger Start)
Microsoft Passport ContainerNgcCtnrSvcManage Local user identity keys and smartcard access. Cannot be disabled.Manual (Trigger Start)
Microsoft Software Shadow Copy ProviderswprvVolume Shadow Copy. Used by Windows Backup. Manual (Runs at boot, then stops)
Microsoft Storage Spaces SMPsmphost Manage storage pools with multiple disks (WSS).Manual
Microsoft Store Install ServiceInstallServiceMicrosoft Store.Manual
Microsoft Windows SMS Router Service.SmsRouterRoute messages.Manual (Trigger Start)
Natural AuthenticationNaturalAuthenticationSignal aggregator service for automatic device lock/unlock.Manual (Trigger Start)
Net.Msmq/Net.Pipe/Net.Tcp Listener Adapter NetMsmqActivator/NetPipeActivator/NetTcpActivator   Not installed
Net.Tcp Port Sharing Service   Provides ability to share TCP ports over net.tcp Disabled
NetlogonNetlogonConnect to a domain controller.Manual
Network Connected Devices Auto-SetupNcdAutoSetupDiscover and install qualified devices.Manual (Trigger Start, Running)
Network Connection BrokerNcbServiceBroker connections between Windows store apps and the internet.Manual (Trigger Start, Running)
Network ConnectionsNetmanManage network and Dial-up connections.Manual
Network Connectivity AssistantNcaSvcDirectAccess status notification.Manual (Trigger Start)
Network List ServicenetprofmIdentify networks.Manual (Running)
Network Location AwarenessNlaSvcNotify changes in the network configuration.Automatic (Running)
Network Setup ServiceNetSetupSvcManage installation and configuration of network drivers.Manual (Trigger Start)
Network Store Interface ServicensiNetwork notifications for user mode clients.Automatic (Running)
Offline FilesCscService Perform offline maintenance on the offline files cache. Not Available in Win 10 home.Manual (Trigger Start)
OpenSSH Authentication Agentssh-agentAgent to hold private keys used for public key authentication.Manual
Optimize drivesdefragsvcOptimise file storage by defragmenting on disc.Manual
Parental ControlsWpcMonSvcEnforces parental controls in Windows.Manual
Payments and NFC/SE ManagerSEMgrSvcManage payments and Near Field Communication (NFC) based secure elements.Manual (Trigger Start)
Peer Name Resolution ProtocolPNRPsvcEnable serverless peer name resolution over the internet (Remote Assistance).Manual
Peer Networking Groupingp2psvc Enables multi-party communication using peer-peer grouping. (Home Group).Manual
Peer Networking Identity Managerp2pimsvcIdentity services for peer Name resolution and peer-peer grouping services.Manual
Performance Counter DLL HostPerfHostEnable remote users and 64 bit processes to query perf counters provided by 32-bit DLLs.Manual
Performance Logs & AlertsplaCollect performance data from local or remote computers.Manual
Phone ServicePhoneSvc Manage the telephony state.Manual (Trigger Start)
Plug and PlayPlugPlayRecognise new hardware. Do not disable.Manual (Running)
PNRP Machine Name Publication ServicePNRPAutoRegPublish a machine name using Peer name resolution protocol.Manual
Portable Device Enumerator ServiceWPDBusEnumEnforce group policy for removable mass storage devices. Enables transferring and synchronising content.Manual (Trigger Start)
PowerPowerManage power policy and power policy notifications.Automatic (Running)
Print SpoolerSpoolerSpool print jobs. Do not disable.Automatic (Running)
Printer Extensions and NotificationsPrintNotifyOpen custom printer dialogue boxes and handle notifications from a remote print server or printer.Manual
PrintWorkflow_?????PrintWorkflowUserSvc_?????Print Workflow. Cannot be disabled.Manual
Problem Reports and Solutions Control Panel SupportwercplsupportSystem level problem reports.Manual
Program Compatibility Assistant ServicePcaSvcProgram Compatibility Assistant (PCA)Automatic (Running)
Quality Windows Audio Video ExperienceQWAVEPlatform for A/V streaming applications on IP home networks.Manual
Radio Management ServiceRmSvcRadio Management and Airplane Mode - wireless comms / Bluetooth.Manual
Recommended Troubleshooting ServiceTroubleshootingSvc Automatic mitigation for known problems and recommended troubleshooting options.Manual
Remote Access Auto Connection ManagerRasAutoAutomatically connect to a remote network whenever a DNS name is used.Manual
Remote Access Connection ManagerRasManManage Dial-Up and VPM connections.Manual
Remote Desktop ConfigurationSessionEnvRemote Desktop related activities, temporary folders,themes and certificates. Manual
Remote Desktop ServicesTermServiceAllow users to connect interactively with a remote computer. To prevent remote use of this computer clear the checkboxes on the Remote tab of the system properties control panel item. Manual
Remote Desktop Services UserMode Port RedirectorUmRdpServiceAllow redirection of Printers/Drivers/Ports for RDP connections. Manual
Remote Procedure Call (RPC)RpcSsObject activation for COM and DCOM. Cannot be disabled.Automatic (Running)
Remote Procedure Call (RPC) LocatorRpcLocatorNo functionality in Windows 10, this is provided for Application Compatibility.Manual
Remote RegistryRemoteRegistryEnable remote users to modify the registry on this computer.Disabled
Retail Demo ServiceRetailDemo Allows running the Retail Demo mode which will erase all files and restore Windows to a factory default. You may prefer to disable this. Manual
Routing and Remote AccessRemoteAccessLAN and WAN routing to other businesses.Disabled
RPC Endpoint MapperRpcEptMapperResolve RPC interface identifiers to a transport endpoint. Cannot be disabled.Automatic (Running)
Runtime Broker RuntimeBroker Microsoft core process, manages permissions for all universal (Windows Store) apps. Automatic (Running)
Secondary LogonseclogonEnable starting processes under alternate credentials.Manual
Secure Socket Tunneling Protocol ServiceSstpSvcSSTP VPN Capability.Manual
Security Accounts ManagerSamSs Allows SAM to accept request from other services.Automatic (Running)
Security CenterwscsvcMonitor and report security health settings: Firewall, Anti-Virus,Anti-Spyware.Automatic (Delayed Start, Running)
Sensor Data ServiceSensorDataService Delivers data from a variety of sensors.Manual (Trigger Start)
Sensor Monitoring ServiceSensrSvcMonitor sensors to expose data and user state e.g. Adjust brightness.Manual (Trigger Start)
Sensor ServiceSensorServiceManage Simple Device Orientation (SDO) and History for sensors. Reports device orientation changes.Manual (Trigger Start)
ServerLanmanServerFile, Print and named pipe sharing over the network.Automatic (Running)
Shared PC Account ManagershpamsvcManage profiles and accounts on a SharedPC configured device.Disabled
Shell Hardware DetectionShellHWDetectionAutoplay notification.Automatic (Running)
Smart CardSCardSvrSupport for Smart Card login/logout.Disabled
Smart Card Device Enumeration ServiceScDeviceEnumSupport for Smart Card login/logout.Manual (Trigger Start)
Smart Card Removal PolicySCPolicySvcSupport for Smart Card login/logout.Manual
SNMP TrapSNMPTRAPHandle Simple Network Management Protocol (SNMP) agent messages.Manual
Software ProtectionsppsvcDownload and install Digital Licences. Cannot be disabled.Automatic (Delayed Start,Trigger Start)
Spatial Data ServiceSharedRealitySvcVirtual Reality data manager.Manual
Spot VerifiersvsvcVerify potential file system corruptions.Manual (Trigger Start)
SSDP DiscoverySSDPSRVDiscover UPnP /SSDP devices. Enables SSDP device discovery. Can be disabled.Manual (Running)
State Repository ServiceStateRepositoryReports Application State. Cannot be disabled.Manual (Running)
Still Image Acquisition EventsWiaRpcLaunch applications associated with still image acquisition.Manual
Storage ServiceStorSvcAdds 'System Volume Information' folder to external USB memory devices. Required for Windows Store.Manual (Trigger Start)
Storage Tiers ManagementTieringEngineServiceOptimise the placement of data in storage tiers on all tiered storage spaces.Manual
Sync Host_?????OneSyncSvc_?????Sync mail, contacts calendar and other user data.Automatic (Delayed Start)
SysMainSysMainTune system performance over time.Automatic (Running)
System Event Notification ServiceSENSMonitor system events and notify COM+ subscribers.Automatic (Running)
System Events BrokerSystemEventsBrokerCo-ordinates background work for WinRT. Cannot be disabled.Automatic (Trigger Start, Running)
System Guard Runtime Monitor BrokerSgrmBrokerAttests to Windows platform integrity.Automatic (Delayed Start, Running)
Task SchedulerScheduleSchedule Automated Tasks. Cannot be Stopped or disabled.Automatic (Running)
TCP/IP NetBIOS HelperlmhostsProvides NetBIOS over TCP/IP (NetBT) Enables sharing Files, Printers and logon to the network.Manual (Trigger Start, Running)
TelephonyTapiSrvSupport for programs that control telephony devices.Manual
ThemesThemesUser Theme Management.Automatic (Running)
Time BrokerTimeBrokerSvcBackground work for WinRT application.Manual (Trigger Start, Running)
Touch Keyboard and Handwriting Panel ServiceTabletInputServiceEnables touch keyboard and handwriting panel pan and ink functionality.Manual (Trigger Start)
Update Orchestrator ServiceUsoSvcManages Windows Updates.Manual (Running)
UPnP Device HostupnphostAllows UPnP devices to be hosted on this computer.Manual
User Data Access_?????UserDataSvc_?????Provides apps access to structured user data, including contact info, calendars, messages. Cannot be disabled.Manual (Running)
User Data Storage_????? UnistoreSvc_?????Handles storage of structured user data, including contact info, calendars, messages.Cannot be disabled.Manual (Running)
User Experience Virtualization ServiceUevAgentService Support for the roaming of OS and application settings. Not Available in Win 10 home.Disabled
User ManagerUserManagerSupport for Multi-User interaction.Automatic (Trigger Start, Running)
User Profile ServiceProfSvcLoading and unloading of user profiles.Automatic (Running)
Virtual DiskvdsMagagement of disks and volumes.Manual
Volume Shadow CopyVSSManages and implements Volume Shadow copies used for backup and other purposes.Manual
Volumetric Audio Compositor ServiceVacSvcHosts spacial analysis for mixed reality audio simulation.Not Installed
WalletServiceWalletServiceObjects used by clients of the wallet.Manual
WarpJITSvcWarpJITSvcJIT out of process service for Windows Advanced Rasterization Platform (WARP) when running with Arbitrary Code Guard (ACG) enabled.Manual (Trigger Start)
Web Account ManagerTokenBrokerProvide single sign on to apps and services.Manual (Running)
WebClientWebClientEnable Windows based programs to create access and modify internet based files.Manual (Trigger Start)
Wi-Fi Direct Services Connection Manager ServiceWFDSConMgrSvcConnect to wireless display and/or dock.Manual (Trigger Start)
Windows AudioAudiosrvManage Audio.Automatic (Running)
Windows Audio Endpoint BuilderAudioEndpointBuilderManage Audio devices.Automatic (Running)
Windows BackupSDRSVCWindows Backup.Manual
Windows Biometric ServiceWbioSrvcCapture and edit biometric data without gaining direct access to any biometric hardware or samples.Manual (Trigger Start)
Windows Camera Frame ServerFrameServerAccess video frames from camera devices.Manual (Trigger Start)
Windows Connect Now - Config RegistrarwcncsvcWireless Protected Setup (WPS) protocol.Manual
Windows Connection ManagerWcmsvcMakes automatic connect/disconnect decisions based on the network connectivity options currently available to the PC.Automatic (Trigger Start, Running)
Windows Defender Advanced Threat Protection ServiceSenseSecurity event monitor. Not Available in Win 10 homeManual
Windows Defender Antivirus Network Inspection ServiceWdNisSvcAnti-Virus Cannot be disabled.Manual (Running)
Windows Defender Antivirus ServiceWinDefendMalware detection. Cannot be disabled.Automatic (Running)
Windows Defender FirewallmpssvcFirewall. Cannot be disabled.Automatic (Running)
Windows Encryption Provider Host ServiceWEPHOSTSVCExchange Active Sync (EAS) policies for Email encryption with 3rd parties.Manual (Trigger Start)
Windows Error Reporting ServiceWerSvcAllows errors to be reported.Manual (Trigger Start)
Windows Event CollectorWecsvcRemote event log management.Manual
Windows Event LogEventLogManage and query event logs.Automatic (Running)
Windows Font Cache ServiceFontCacheCache font data.Automatic (Running)
Windows Image Acquisition (WIA)stisvcImage acquisition for scanners and cameras.Manual
Windows Insider ServicewisvcUsed only for Windows insider - beta testing of new versions of Windows.Manual (Trigger Start)
Windows InstallermsiserverInstall applications from an .MSI or .MSP package. Cannot be disabled.Manual
Windows License Manager ServiceLicenseManagerWindows Store.Manual (Trigger Start)
Windows Management InstrumentationWinmgmt Windows Management Instrumentation (WMI).Automatic (Running)
Windows Management ServiceWManSvc Provisioning and enrolment services.Manual
Windows Media Player Network Sharing Service WMPNetworkSvc Share Windows Media Player libraries with other devices using PnP. Disabled
Windows Mixed Reality OpenXR Service MixedRealityOpenXRSvc Enable Mixed reality OpenXR runtime. Manual
Windows Mobile Hotspot Serviceicssvc Share a Mobile Data Connection with another device.Manual (Trigger Start)
Windows Modules InstallerTrustedInstaller Windows Update, installer service.Manual
Windows Perception Servicespectrum Virtual Reality Service.Manual (Trigger Start)
Windows Perception Simulation ServiceperceptionsimulationEnables spatial perception simulation - camera and spatial input simulation.Manual
Windows Presentation Foundation Font Cache FontCache3.0.0.0 Optimise the performance of WPF applications by caching commonly used files. Not Installed (Manual)
Windows Push Notifications System ServiceWpnService Push Notifications.Automatic (Running)
Windows Push Notifications User Service_?????WpnUserService_?????Local and push notifications: tile, toast and raw.Automatic (Running)
Windows PushToInstall ServicePushToInstallWindows Store.Manual
Windows Remote Management (WS-Management)WinRM Remote Management.Manual
Windows SearchWSearchSearch content indexing.Automatic (Delayed Start, Running)
Windows Security ServiceSecurityHealthServiceDevice protection.Manual
Windows TimeW32TimeDate and Time Synchronisation.Manual (Trigger Start)
Windows UpdatewuauservWindows Update.Manual (Trigger Start)
Windows Update Medic ServiceWaaSMedicSvcRemediation and protection of Windows Update components.Manual
WinHTTP Web Proxy Auto-Discovery ServiceWinHttpAutoProxySvcWeb Proxy Auto-Discovery over HTTP.Manual (Running)
Wired AutoConfigdot3svcIEEE 802.1 authentication over Ethernet.Manual
WLAN AutoConfigWlanSvc Connect and Disconnect from a Wireless LAN, it is strongly recommended that this service is left set to Automatic if a Wireless Card is installed.Automatic
WMI Performance AdapterwmiApSrvProvide performance information from WMI providers to clients on the network.Manual
Work Folders workfolderssvc Sync files with the Work Folders server enabling you to use the files on any PC where you have setup Work Folders. Manual
WorkstationLanmanWorkstation Connect to remote servers using SMB 2.0 or 3.0Automatic (Running)
WWAN AutoConfigWwanSvc Manages Mobile Broadband Data Connections (GSM and CDMA) by auto-configuring the network.Manual
Xbox Accessory Management ServiceXboxGipSvc Xbox Accessories.Manual (Trigger Start)
Xbox Live Auth ManagerXblAuthManager Xbox Authentication.Manual
Xbox Live Game SaveXblGameSaveXbox sync with game server.Manual (Trigger Start)
Xbox Live Networking ServiceXboxNetApiSvcXbox API.Manual

The links above will open a Google search for the service name targeted at, this will often find a more detailed description of what the service does.

Clicking the headers of the table above will sort by that column.

Per-User Services

Some of the services listed above are per-user services, indicated by ????? at the end of the service name, this represents a locally unique identifier (LUID), a 4 to 7 digit string thats unique to each user of the computer.

Per-user services are created when a user signs into Windows and are stopped and deleted when that user signs out.


Svchost.exe is a generic host process name for services that run from dynamic-link libraries.

Many Windows services run from a .DLL file rather than a .EXE which can be launched directly. Svchost.exe is a reusable shell used to launch a DLL file and startup the relevant service. The task manager in Windows 10 lists these processes under Service Host: Name of Service.

Disabling Services

It is inadvisable to disable a service without being aware of the consequences, always start by setting the service to manual, reboot and test for any problems.

A service set to manual will be automatically restarted if another service is dependent on it.
A service set to disabled will not restart even if it's required to boot the machine!

If a service crashes the machine at startup, you can DISABLE it using the recovery console.

Stopping or disabling a service will generally save a small amount of memory and will reduce the number of software interrupts (cpu message queue.) The main reason for tinkering with services is to harden the system against security vulnerabilities. Disable everything that you don’t need or use - then any future problems with those services cannot affect the machine.

To document all the services currently installed:

SC QUERY state= all |findstr "DISPLAY_NAME STATE" >my_services.csv

Many services communicate and send data directly to Microsoft servers, while this is not generally something to lose sleep over. Managing the running of these services might be a consideration if confidentiality or anonymity is highly important to you.

Remove a service completely

To delete a service use the SC DELETE command:
SC delete NameofServiceTodelete

Built-in Service Accounts

In addition to other Default User & Group accounts there are 3 built-in accounts, designed for running background services.

Local Service Account (NT AUTHORITY\LOCAL SERVICE) - has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard the system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session without credentials. (This account is not supported for running SQL Server services.)

Network Service Account (NT AUTHORITY\NETWORK SERVICE) - has more access to resources and objects than members of the Users group. Services that run as the Network Service account access network resources by using the credentials of the computer account.

Local System Account (NT AUTHORITY\SYSTEM) - a very high-privileged built-in account. It has extensive privileges on the local system and acts as the computer on the network.

The security group All Services (NT SERVICES\ALL SERVICES) includes all service processes that are configured on the system. Membership of this group is controlled by the OS.

Managed Service Accounts provide automatic password management and simplified service principal name (SPN) management.
(Primarily intended for IIS). Managed Service accounts are created in PowerShell with New-ADServiceAccount


“The service we render to others is really the rent we pay for our room on this earth. It is obvious that man is himself a traveler; that the purpose of this world is not 'to have and to hold' but ’to give and serve.' There can be no other meaning” - Sir Wilfred T. Grenfell

Related commands

SC - Service Control.
TASKLIST - List running tasks and services.
MSINFO32 - Windows System Information.
PORTQRY - Enumerate local services, SQL Server instances, Local ports, and the DLL modules loaded.
How-to: ServiceStatus.ps1 - List all services (PowerShell).
Safe Mode - Press F8 during bootup to start with minimal services running.
WMIC SERVICE - WMI access to services.
DComCnfg - Disable/configure Component Services.
Revert Service Defaults - List of default Services.
Q137890 - SRVANY - create an NT Service from any executable. Not supported on current OS's use a Scheduled Task instead.

Copyright © 1999-2024
Some rights reserved