Services Windows 10 Services

A list of the default services in Windows 10 (build 1903).

Service Display Name Service (Registry Key) Description Default Status
ActiveX Installer (AxInstSV)AxInstSVUAC validation to control the installation of Active-X controls via the internet.Manual
Agent Activation Runtime_????? AarSvc_?????Chatbot Runtime for activating Conversational agent applications Clippy returnsManual
AllJoyn Router ServiceAJRouterIoT integrationManual (Trigger Start)
App ReadinessAppReadinessRuns at first logon to prepare apps for useManual
Application IdentityAppIDSvcVerify Application identity, used by AppLockerManual (Trigger Start)
Application InformationAppinfoFacilitates running applications with additional administrative privileges. If disabled those additional privileges will not be available.Manual (Trigger Start, Running)
Application Layer Gateway ServiceALGEnables plugins for the now ancient internet connection sharingManual
Application ManagementAppMgmtRequired for Group Policy software management, Not Available in Win 10 homeManual
AppX Deployment Service (AppXSVC)AppXSvcWindows Store integration. Cannot be disabled.Manual
AssignedAccessManager ServiceAssignedAccessManagerSvcKiosk mode, Not Available in Win 10 homeManual
Auto Time Zone UpdatertzautoupdateAutomatically set the Time ZoneDisabled
AVCTP serviceBthAvctpSvcAudio Video Control TP service - Bluetooth / Wireless..Manual (Trigger Start)
Background Intelligent Transfer ServiceBITSTransfer filesManual or Automatic (Delayed Start, Running)
Background Tasks Infrastructure ServiceBrokerInfrastructureCannot be disabled.Automatic (Running)
Base Filtering EngineBFEManage Windows Firewall and IPsec policies and implements user mode filtering. Do not disable.Automatic (Running)
BitLocker Drive Encryption ServiceBDESVCSecure startup and volume encryption.Manual (Trigger Start)
Block Level Backup Engine ServicewbengineUsed by Windows BackupManual
Bluetooth Audio Gateway ServiceBTAGServiceBluetooth Audio - Wireless headsets.Manual (Trigger Start)
Bluetooth Support ServicebthservDiscovery of Bluetooth devices.Manual (Trigger Start)
Bluetooth User Support Service_????? BluetoothUserService_?????Bluetooth features.Manual (Trigger Start)
BranchCachePeerDistSvcUsed by Windows Update for download sharing on the local subnet.Manual
Capability Access Manager ServicecamsvcManage UWP appsManual
CaptureService_????? CaptureService_?????Screen Capture Service via the Windows.Grapics.Capture API.Manual
Cellular TimeautotimesvcSet the time based on NITZ messages from a mobile network.Manual
Certificate PropagationCertPropSvcManage certificates for Smart Card login.Manual (Trigger Start)
Client License Service (ClipSVC)ClipSVCSupport for Microsoft store, cannot be disabled.Manual (Trigger Start)
Clipboard User Service_????? cbdhsvc_?????ClipboardManual
CNG Key IsolationKeyIsoSecure long lived keys for cryptographic operations.Manual (Trigger Start, Running)
COM+ Event SystemEventSystemCOM Event notification service, required for COM+Manual
COM+ System ApplicationCOMSysAppNetwork discovery of systems on local network.Manual (Trigger Start)
Connected Devices Platform ServiceCDPSvcConnected Devices PlatformAutomatic (Delayed Start, Trigger Start)
Connected Devices Platform User Service_????? CDPUserSvc_?????Connected Devices PlatformAutomatic (Running)
Connected User Experiences and TelemetryDiagTrackFeedback and Diagnostics.Automatic (Running)
ConsentUX_?????ConsentUxUserSvc_?????Connect and pair WiFi and Bluetooth devices, ConnectUX.Manual
Contact Data_?????PimIndexMaintenanceSvc_?????Indexes contact data for fast contact searching.Manual
CoreMessagingCoreMessagingRegistrarCannot be disabled. Manages communication between system components.Automatic (Running)
Credential ManagerVaultSvcSecure storage and retrieval of credentials. Control Panel: Credential Manager.Manual
CredentialEnrollmentManagerUserSvc_?????CredentialEnrollmentManagerUserSvc_?????Credential Enrolment ManagerManual
Cryptographic ServicesCryptSvcManage root certificates.Automatic (Running)
Data Sharing ServiceDsSvcData brokering between applicationsManual (Trigger Start)
Data UsageDusmSvcNetwork data usage,data limit/metered networks.Automatic (Running)
DCOM Server Process LauncherDcomLaunchRequired for COM and DCOM object activation requests.Automatic (Running)
Delivery OptimizationDoSvcContent delivery OptimisationAutomatic (Delayed Start)
Device Association ServiceDeviceAssociationServicePairing between the system and wired or wireless devices.Manual (Trigger Start)
Device Install ServiceDeviceInstallRecognise new hardware, do not disable.Manual (Trigger Start)
Device Management Enrollment ServiceDmEnrollmentSvcDevice enrolment/management.Manual
Device Management Wireless Application Protocol (WAP) Push message Routing ServicedmwappushserviceWAP - Sync device sessions.Manual
Device Setup ManagerDsmSvcInstall device driversManual (Trigger Start)
DeviceAssociationBroker_?????DeviceAssociationBrokerSvc_?????Pair devices.Manual
DevicePicker_?????DevicePickerUserSvc_?????Manage Miracast DLNA and DIAL UIManual
DevicesFlow_????? DevicesFlowUserSvc_?????Connect and pair WiFi and Bluetooth devices, ConnectUX/PC settings.Manual
DevQuery Background Discovery BrokerDevQueryBrokerEnable apps to discover devices with a background task.Manual (Trigger Start)
DHCP ClientDhcpAllocate an IP address to this computer automatically.Automatic (Running)
Diagnostic Execution ServicediagsvcEnable troubleshooting support.Manual (Trigger Start)
Diagnostic Policy ServiceDPSEnable problem detection, troubleshooting and resolution for Windows components.Automatic (Running)
Diagnostic Service HostWdiServiceHostDiagnostics for Local Services.Manual (Running)
Diagnostic System HostWdiSystemHostDiagnostics for the Local System.Manual
Display Enhancement ServiceDisplayEnhancementServiceBrightnessManual (Trigger Start)
Display Policy ServiceDispBrokerDesktopSvcConnection and configuration of local and remote displays.Automatic (Delayed Start)
Distributed Link Tracking ClientTrkWksAttempt to maintain valid links between NTFS files across a network.Automatic (Running)
Distributed Transaction CoordinatorMSDTCCo-ordinate transactions between resource managers, database, file and message queues.Manual
DNS ClientDnscacheCache DNS queries and register the computername.Automatic (Trigger Start, Running)
Downloaded Maps ManagerMapsBrokerWindows/Bing maps.Automatic (Delayed Start)
Embedded ModeembeddedmodeActivate background applicationsManual (Trigger Start)
Encrypting File System (EFS)EFSAllow storage of encrypted files on NTFS file systems.Manual (Trigger Start)
Enterprise App Management ServiceEntAppSvcCannot be disabled. Enterprise Application management.Manual
Extensible Authentication ProtocolEaphostNetwork Authentication - VPN NAP and Wireless.Manual
File History ServicefhsvcUsed by Windows Backup.Manual (Trigger Start)
Function Discovery Provider HostfdPHostNetwork discovery and Web Service discovery.Manual
Function Discovery Resource PublicationFDResPubPublish this computer and resources over the network.Manual (Running)
GameDVR and Broadcast User Service_????? BcastDVRUserService_?????Game recordings and Live broadcasts. Cannot be disabled.Manual (Trigger Start)
Geolocation ServicelfsvcManage Geofences - a geographic location with associated events.Manual (Trigger Start, Running)
GraphicsPerfSvcGraphicsPerfSvcMonitor graphics performance.Manual (Trigger Start)
Group Policy ClientgpsvcCannot be disabled. Apply admin settings through group policy.Automatic (Trigger Start)
Human Interface Device ServicehidservActivate and maintain hot buttons on keyboards and other controls.Manual (Trigger Start)
HV Host ServiceHvHostHyper-V interface for performance counters.Manual (Trigger Start)
Hyper-V Data Exchange ServicevmickvpexchangeHyper-V interface for data exchange.Manual (Trigger Start)
Hyper-V Guest Service InterfacevmicguestinterfaceHyper-V interface for VM services.Manual (Trigger Start)
Hyper-V Guest Shutdown ServicevmicshutdownHyper-V interface for VM shutdown.Manual (Trigger Start)
Hyper-V Heartbeat ServicevmicheartbeatHyper-V identify frozen VMs.Manual (Trigger Start)
Hyper-V PowerShell Direct ServicevmicvmsessionHyper-V interface for PowerShell.Manual (Trigger Start)
Hyper-V Remote Desktop Virtualization ServicevmicrdvHyper-V desktop interface. Not Available in Win 10 homeManual (Trigger Start)
Hyper-V Time Synchronization ServicevmictimesyncHyper-V time sync.Manual (Trigger Start)
Hyper-V Volume Shadow Copy RequestorvmicvssHyper-V shadow copy/backup.Manual (Trigger Start)
IKE and AuthIP IPsec Keying ModulesIKEEXTInternet Key exchangeManual (Trigger Start)
Internet Connection Sharing (ICS)SharedAccessProvides NAT/name resolution for small office networks. Very rarely needed.Manual (Trigger Start)
IP HelperiphlpsvcIPv6 translation.Automatic (Running)
IP Translation Configuration ServiceIpxlatCfgSvcIPv6 translation.Manual (Trigger Start)
IPsec Policy AgentPolicyAgentNetwork level peer authentication. Enforces IPsec policies.Manual (Trigger Start)
KtmRm for Distributed Transaction CoordinatorKtmRmCo-ordinates distributed transactions. MSDTC/KTM.Manual (Trigger Start)
Language Experience ServiceLxpSvcDeployment infrastructure for configuring additional languages.Manual
Link-Layer Topology Discovery MapperlltdsvcCreates a Network map describing each PC and device.Manual
Local Profile Assistant ServicewlpasvcProfile management for local subscriber identity modules.Manual (Trigger Start)
Local Session ManagerLSMCannot be disabled. Manage local user sessions.Automatic (Running)
MessagingService_?????MessagingService_?????Text MessagingManual (Trigger Start)
Microsoft (R) Diagnostics Hub Standard Collector Servicediagnosticshub.standardcollector.serviceCollect real-time Event Tracing for Windows (ETW) eventsManual
Microsoft Account Sign-in AssistantwlidsvcRunning if using MS account to log in to computer.Manual (Trigger Start)
Microsoft App-V ClientAppVClientManage App-V users and virtual applications. Not Available in Win 10 homeDisabled
Microsoft iSCSI Initiator ServiceMSiSCSIManage iSCSI devices.Manual
Microsoft PassportNgcSvcProcess isolation for cryptographic keys. Cannot be disabled.Manual (Trigger Start)
Microsoft Passport ContainerNgcCtnrSvcManage Local user identity keys and smartcard access. Cannot be disabled.Manual (Trigger Start)
Microsoft Software Shadow Copy ProviderswprvVolume Shadow Copy. Used by Windows Backup. Manual (Runs at boot, then stops)
Microsoft Storage Spaces SMPsmphostManage storage pools with multiple disks (WSS)Manual
Microsoft Store Install ServiceInstallServiceMicrosoft Store.Manual
Microsoft Windows SMS Router Service.SmsRouterRoute messages.Manual (Trigger Start)
Natural AuthenticationNaturalAuthenticationSignal aggregator service for automatic device lock/unlock.Manual (Trigger Start)
NetlogonNetlogonConnect to a domain controller.Manual
Network Connected Devices Auto-SetupNcdAutoSetupDiscover and install qualified devices.Manual (Trigger Start, Running)
Network Connection BrokerNcbServiceBroker connections between Windows store apps and the internet.Manual (Trigger Start, Running)
Network ConnectionsNetmanManage network and Dial-up connections.Manual
Network Connectivity AssistantNcaSvcDirectAccess status notification.Manual (Trigger Start)
Network List ServicenetprofmIdentify networks.Manual (Running)
Network Location AwarenessNlaSvcNotify changes in the network configuration.Automatic (Running)
Network Setup ServiceNetSetupSvcManage installation and configuration of network drivers.Manual (Trigger Start)
Network Store Interface ServicensiNetwork notifications for user mode clients.Automatic (Running)
Offline FilesCscServicePerform offline maintenance on the offline files cache. Not Available in Win 10 homeManual (Trigger Start)
OpenSSH Authentication Agentssh-agentAgent to hold private keys used for public key authentication.Manual
Optimize drivesdefragsvcOptimise file storage by defragmenting on disc.Manual
Parental ControlsWpcMonSvcEnforces parental controls in Windows.Manual
Payments and NFC/SE ManagerSEMgrSvcManage payments and Near Field Communication (NFC) based secure elements.Manual (Trigger Start)
Peer Name Resolution ProtocolPNRPsvcEnable serverless peer name resolution over the internet (Remote Assistance).Manual
Peer Networking Groupingp2psvcEnables multi-party communication using peer-peer grouping. (Home Group)Manual
Peer Networking Identity Managerp2pimsvcIdentity services for peer Name resolution and peer-peer grouping services.Manual
Performance Counter DLL HostPerfHostEnable remote users and 64 bit processes to query perf counters provided by 32-bit DLLs.Manual
Performance Logs & AlertsplaCollect performance data from local or remote computers.Manual
Phone ServicePhoneSvcManage the telephony state..Manual (Trigger Start)
Plug and PlayPlugPlayRecognise new hardware. Do not disable.Manual (Running)
PNRP Machine Name Publication ServicePNRPAutoRegPublish a machine name using Peer name resolution protocol.Manual
Portable Device Enumerator ServiceWPDBusEnumEnforce group policy for removable mass storage devices. Enables transferring and synchronising content.Manual (Trigger Start)
PowerPowerManage power policy and power policy notifications.Automatic (Running)
Print SpoolerSpoolerSpool print jobs. Do not disable.Automatic (Running)
Printer Extensions and NotificationsPrintNotifyOpen custom printer dialogue boxes and handle notifications from a remote print server or printer.Manual
PrintWorkflow_?????PrintWorkflowUserSvc_?????Print Workflow. Cannot be disabled.Manual
Problem Reports and Solutions Control Panel SupportwercplsupportSystem level problem reports.Manual
Program Compatibility Assistant ServicePcaSvcProgram Compatibility Assistant (PCA)Automatic (Running)
Quality Windows Audio Video ExperienceQWAVEPlatform for A/V streaming applications on IP home networks.Manual
Radio Management ServiceRmSvcRadio Management and Airplane Mode - wireless comms / Bluetooth.Manual
Recommended Troubleshooting ServiceTroubleshootingSvcAutomatic mitigation for known problems and recommended troubleshooting optionsManual
Remote Access Auto Connection ManagerRasAutoAutomatically connect to a remote network whenever a DNS name is used.Manual
Remote Access Connection ManagerRasManManage Dial-Up and VPM connections.Manual
Remote Desktop ConfigurationSessionEnvRemote Desktop related activities, temporary folders,themes and certificates. Manual
Remote Desktop ServicesTermServiceAllow users to connect interactively with a remote computer. To prevent remote use of this computer clear the checkboxes on the Remote tab of the system properties control panel item. Manual
Remote Desktop Services UserMode Port RedirectorUmRdpServiceAllow redirection of Printers/Drivers/Ports for RDP connections. Manual
Remote Procedure Call (RPC)RpcSsObject activation for COM and DCOM. Cannot be disabled.Automatic (Running)
Remote Procedure Call (RPC) LocatorRpcLocatorNo functionality in Windows 10, this is provided for Application Compatibility.Manual
Remote RegistryRemoteRegistryEnable remote users to modify the registry on this computer.Disabled
Retail Demo ServiceRetailDemo Allows running the Retail Demo mode which will erase all files and restore Windows to a factory default. You may prefer to disable this.Manual
Routing and Remote AccessRemoteAccessLAN and WAN routing to other businesses.Disabled
RPC Endpoint MapperRpcEptMapperResolve RPC interface identifiers to a transport endpoint. Cannot be disabled.Automatic (Running)
Secondary LogonseclogonEnable starting processes under alternate credentials.Manual
Secure Socket Tunneling Protocol ServiceSstpSvcSSTP VPN Capability.Manual
Security Accounts ManagerSamSsAllows SAM to accept request from other servicesAutomatic (Running)
Security CenterwscsvcMonitor and report security health settings: Firewall, Anti-Virus,Anti-Spyware.Automatic (Delayed Start, Running)
Sensor Data ServiceSensorDataServiceDelivers data from a variety of sensorsManual (Trigger Start)
Sensor Monitoring ServiceSensrSvcMonitor sensors to expose data and user state e.g. Adjust brightness.Manual (Trigger Start)
Sensor ServiceSensorServiceManage Simple Device Orientation (SDO) and History for sensors. Reports device orientation changes.Manual (Trigger Start)
ServerLanmanServerFile, Print and named pipe sharing over the network.Automatic (Running)
Shared PC Account ManagershpamsvcManage profiles and accounts on a SharedPC configured device.Disabled
Shell Hardware DetectionShellHWDetectionAutoplay notification.Automatic (Running)
Smart CardSCardSvrSupport for Smart Card login/logout.Disabled
Smart Card Device Enumeration ServiceScDeviceEnumSupport for Smart Card login/logout.Manual (Trigger Start)
Smart Card Removal PolicySCPolicySvcSupport for Smart Card login/logout.Manual
SNMP TrapSNMPTRAPHandle Simple Network Management Protocol (SNMP) agent messages.Manual
Software ProtectionsppsvcDownload and install Digital Licences. Cannot be disabled.Automatic (Delayed Start,Trigger Start)
Spatial Data ServiceSharedRealitySvcVirtual Reality data manager.Manual
Spot VerifiersvsvcVerify potential file system corruptions.Manual (Trigger Start)
SSDP DiscoverySSDPSRVDiscover UPnP /SSDP devices. Enables SSDP device discovery. Can be disabled.Manual (Running)
State Repository ServiceStateRepositoryReports Application State. Cannot be disabled.Manual (Running)
Still Image Acquisition EventsWiaRpcLaunch applications associated with still image acquisition.Manual
Storage ServiceStorSvcAdds 'System Volume Information' folder to external USB memory devices. Required for Windows Store.Manual (Trigger Start)
Storage Tiers ManagementTieringEngineServiceOptimise the placement of data in storage tiers on all tiered storage spaces.Manual
Sync Host_?????OneSyncSvc_?????Sync mail, contacts calendar and other user data.Automatic (Delayed Start)
SysMainSysMainTune system performance over time.Automatic (Running)
System Event Notification ServiceSENSMonitor system events and notify COM+ subscribers.Automatic (Running)
System Events BrokerSystemEventsBrokerCo-ordinates background work for WinRT. Cannot be disabled.Automatic (Trigger Start, Running)
System Guard Runtime Monitor BrokerSgrmBrokerAttests to Windows platform integrity.Automatic (Delayed Start, Running)
Task SchedulerScheduleSchedule Automated Tasks. Cannot be Stopped or disabled.Automatic (Running)
TCP/IP NetBIOS HelperlmhostsProvides NetBIOS over TCP/IP (NetBT) Enables sharing Files, Printers and logon to the network.Manual (Trigger Start, Running)
TelephonyTapiSrvSupport for programs that control telephony devices.Manual
ThemesThemesUser Theme Management.Automatic (Running)
Time BrokerTimeBrokerSvcBackground work for WinRT application.Manual (Trigger Start, Running)
Touch Keyboard and Handwriting Panel ServiceTabletInputServiceEnables touch keyboard and handwriting panel pan and ink functionality.Manual (Trigger Start)
Update Orchestrator ServiceUsoSvcManages Windows Updates.Manual (Running)
UPnP Device HostupnphostAllows UPnP devices to be hosted on this computer.Manual
User Data Access_?????UserDataSvc_?????Provides apps access to structured user data, including contact info, calendars, messages. Cannot be disabled.Manual (Running)
User Data Storage_????? UnistoreSvc_?????Handles storage of structured user data, including contact info, calendars, messages.Cannot be disabled.Manual (Running)
User Experience Virtualization ServiceUevAgentServiceSupport for the roaming of OS and application settings. Not Available in Win 10 homeDisabled
User ManagerUserManagerSupport for Multi-User interaction.Automatic (Trigger Start, Running)
User Profile ServiceProfSvcLoading and unloading of user profiles.Automatic (Running)
Virtual DiskvdsMagagement of disks and volumes.Manual
Volume Shadow CopyVSSManages and implements Volume Shadow copies used for backup and other purposes.Manual
Volumetric Audio Compositor ServiceVacSvcHosts spacial analysis for mixed reality audio simulation.Not Installed
WalletServiceWalletServiceObjects used by clients of the wallet.Manual
WarpJITSvcWarpJITSvcJIT out of process service for Windows Advanced Rasterization Platform (WARP) when running with Arbitrary Code Guard (ACG) enabled.Manual (Trigger Start)
Web Account ManagerTokenBrokerProvide single sign on to apps and services.Manual (Running)
WebClientWebClientEnable Windows based programs to create access and modify internet based files.Manual (Trigger Start)
Wi-Fi Direct Services Connection Manager ServiceWFDSConMgrSvcConnect to wireless display and/or dock.Manual (Trigger Start)
Windows AudioAudiosrvManage Audio.Automatic (Running)
Windows Audio Endpoint BuilderAudioEndpointBuilderManage Audio devices.Automatic (Running)
Windows BackupSDRSVCWindows Backup.Manual
Windows Biometric ServiceWbioSrvcCapture and edit biometric data without gaining direct access to any biometric hardware or samples.Manual (Trigger Start)
Windows Camera Frame ServerFrameServerAccess video frames from camera devices.Manual (Trigger Start)
Windows Connect Now - Config RegistrarwcncsvcWireless Protected Setup (WPS) protocol.Manual
Windows Connection ManagerWcmsvcMakes automatic connect/disconnect decisions based on the network connectivity options currently available to the PC.Automatic (Trigger Start, Running)
Windows Defender Advanced Threat Protection ServiceSenseSecurity event monitor. Not Available in Win 10 homeManual
Windows Defender Antivirus Network Inspection ServiceWdNisSvcAnti-Virus Cannot be disabled.Manual (Running)
Windows Defender Antivirus ServiceWinDefendMalware detection. Cannot be disabled.Automatic (Running)
Windows Defender FirewallmpssvcFirewall. Cannot be disabled.Automatic (Running)
Windows Encryption Provider Host ServiceWEPHOSTSVCExchange Active Sync (EAS) policies for Email encryption with 3rd parties.Manual (Trigger Start)
Windows Error Reporting ServiceWerSvcAllows errors to be reported.Manual (Trigger Start)
Windows Event CollectorWecsvcRemote event log management.Manual
Windows Event LogEventLogManage and query event logs.Automatic (Running)
Windows Font Cache ServiceFontCacheCache font data.Automatic (Running)
Windows Image Acquisition (WIA)stisvcImage acquisition for scanners and cameras.Manual
Windows Insider ServicewisvcUsed only for Windows insider - beta testing of new versions of Windows.Manual (Trigger Start)
Windows InstallermsiserverInstall applications from an .MSI or .MSP package. Cannot be disabled.Manual
Windows License Manager ServiceLicenseManagerWindows Store.Manual (Trigger Start)
Windows Management InstrumentationWinmgmtWindows Management Instrumentation (WMI)Automatic (Running)
Windows Management ServiceWManSvcProvisioning and enrolment servicesManual
Windows Mobile Hotspot Serviceicssvc Share a Mobile Data Connection with another device.Manual (Trigger Start)
Windows Modules InstallerTrustedInstaller Windows Update, installer service.Manual
Windows Perception ServicespectrumVirtual Reality ServiceManual (Trigger Start)
Windows Perception Simulation ServiceperceptionsimulationEnables spatial perception simulation - camera and spatial input simulation.Manual
Windows Push Notifications System ServiceWpnServicePush NotificationsAutomatic (Running)
Windows Push Notifications User Service_?????WpnUserService_?????Local and push notifications: tile, toast and raw.Automatic (Running)
Windows PushToInstall ServicePushToInstallWindows Store.Manual
Windows Remote Management (WS-Management)WinRMRemote ManagementManual
Windows SearchWSearchSearch content indexing.Automatic (Delayed Start, Running)
Windows Security ServiceSecurityHealthServiceDevice protection.Manual
Windows TimeW32TimeDate and Time Synchronisation.Manual (Trigger Start)
Windows UpdatewuauservWindows Update.Manual (Trigger Start)
Windows Update Medic ServiceWaaSMedicSvcRemediation and protection of Windows Update components.Manual
WinHTTP Web Proxy Auto-Discovery ServiceWinHttpAutoProxySvcWeb Proxy Auto-Discovery over HTTP.Manual (Running)
Wired AutoConfigdot3svcIEEE 802.1 authentication over Ethernet.Manual
WLAN AutoConfigWlanSvc Connect and Disconnect from a Wireless LAN, it is strongly recommended that this service is left set to Automatic if a Wireless Card is installed.Automatic
WMI Performance AdapterwmiApSrvProvide performance information from WMI providers to clients on the network.Manual
WorkstationLanmanWorkstation Connect to remote servers using SMB 2.0 or 3.0Automatic (Running)
WWAN AutoConfigWwanSvc Manages Mobile Broadband Data Connections (GSM and CDMA) by auto-configuring the network.Manual
Xbox Accessory Management ServiceXboxGipSvc Xbox Accessories.Manual (Trigger Start)
Xbox Live Auth ManagerXblAuthManager Xbox Authentication.Manual
Xbox Live Game SaveXblGameSaveXbox sync with game server.Manual (Trigger Start)
Xbox Live Networking ServiceXboxNetApiSvcXbox API.Manual

The links above will open a Google search for the service name targeted at Microsoft.com, this will often find a more detailed description of what the service does.

Clicking the headers of the table above will sort by that column.

Per-User Services

Some of the services listed above are per-user services, indicated by ????? at the end of the service name, this represents a locally unique identifier (LUID), a 4 to 7 digit string thats unique to each user of the computer.

Per-user services are created when a user signs into Windows and are stopped and deleted when that user signs out.

Disabling Services

It is inadvisable to disable a service without being aware of the consequences, always start by setting the service to manual, reboot and test for any problems.

A service set to manual will be automatically restarted if another service is dependent on it.
A service set to disabled will not restart even if it's required to boot the machine!

If a service crashes the machine at startup, you can DISABLE it using the recovery console.

Stopping or disabling a service will generally save a small amount of memory and will reduce the number of software interrupts (cpu message queue.) The main reason for tinkering with services is to harden the system against security vulnerabilities. Disable everything that you don’t need or use - then any future problems with those services cannot affect the machine.

To document all the services currently installed:

SC QUERY state= all |findstr "DISPLAY_NAME STATE" >my_services.csv

Many services communicate and send data directly to Microsoft servers, while this is not generally something to lose sleep over. Managing the running of these services might be a consideration if confidentiality or anonymity is highly important to you.

Remove a service completely

To delete a service use the SC DELETE command:
SC delete NameofServiceTodelete

Built-in Service Accounts

In addition to other Default User & Group accounts there are 3 built-in accounts, designed for running background services.

Local Service Account (NT AUTHORITY\LOCAL SERVICE) - has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard the system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session without credentials. (This account is not supported for running SQL Server services.)

Network Service Account (NT AUTHORITY\NETWORK SERVICE) - has more access to resources and objects than members of the Users group. Services that run as the Network Service account access network resources by using the credentials of the computer account.

Local System Account (NT AUTHORITY\SYSTEM) - a very high-privileged built-in account. It has extensive privileges on the local system and acts as the computer on the network.

The security group All Services (NT SERVICES\ALL SERVICES) includes all service processes that are configured on the system. Membership of this group is controlled by the OS.

Managed Service Accounts provide automatic password management and simplified service principal name (SPN) management.
(Primarily intended for IIS). Managed Service accounts are created in PowerShell with New-ADServiceAccount

Files:
windows\system32\drivers\etc\services

“The service we render to others is really the rent we pay for our room on this earth. It is obvious that man is himself a traveler; that the purpose of this world is not 'to have and to hold' but 'to give and serve.' There can be no other meaning” - Sir Wilfred T. Grenfell

Related:

SC - Service Control.
TASKLIST - List running tasks and services.
MSINFO32 - Windows System Information.
PORTQRY - Enumerate local services, SQL Server instances, Local ports, and the DLL modules loaded.
ServiceStatus.ps1 - List all services (PowerShell).
Safe Mode - Press F8 during bootup to start with minimal services running.
WMIC SERVICE - WMI access to services.
DComCnfg - Disable/configure Component Services.
Revert Service Defaults - List of default Services.
Q137890 - SRVANY - create an NT Service from any executable.
Not supported on current OS's use a Scheduled Task instead.


 
Copyright © 1999-2020 SS64.com
Some rights reserved