Windows Services

Windows Services What are services? By definition, it's a program that runs invisibly in the background. But can't the same thing be said for a number of programs that run in the background such as anti-virus programs? Yes, but the real difference is that services load and start running whether or not anyone logs into the computer, unlike a program that is launched from the Startup Folder under All Programs. There are two ways to view Services on your computer. The first is to use the MS Configuration Utility by typing msconfig.exe in the Run box accessed via the Start Menu, followed by clicking the Services tab. If you want a quick visual of which items are running or stopped, this is fine, but the information is limited. The preferred way to make changes to services is to launch services.msc from the Run option on the Start Menu. The Services window shown below will open.

Looking at the Services window you can see it has columns for Name, Description, Status, Startup Type and Log On As. This provides a quick overview of all the services on your computer. Detailed information is available by clicking any of the entries. The four captures below show the property sheet, by tabs, for the Alerter Service.

Create or Delete A Service in Windows XP Services are added from the Command Prompt. You need to know the actual service name as opposed to what Microsoft calls the Display Name. For example, if you wanted to create or delete the Help and Support service, the name used at the Command Prompt would be "helpsvc" rather than the Display Name of "Help and Support". The actual service name can

be obtained by typing services.msc in Run on the Start Menu and then double clicking the Display Name of the service. Once you know the name; To Create A Service • • •

Start | Run and type cmd in the Open: line. Click OK. Type: sc create <service name> Reboot the system

Fig. 01 To Delete A Service • • •

Start | Run and type cmd in the Open: line. Click OK. Type: sc delete <service name> Reboot the system

Fig. 02 If you prefer to work in the registry rather than through the command prompt to delete services; • • • •

Click Start | Run and type regedit in the Open: line. Click OK. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Scroll down the left pane, locate the service name, right click it and select Delete. Reboot the system

Alerter Service Service Name Default Settings

Alerter

Process Name

XP Home : Manual

svchost.exe -k LocalService

XP Pro : Manual XP Pro w/SP2 : Disabled

Microsoft Service Description

Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Workstation

Real World Description

If you're part of a network that sends and receives administrative alerts this service is for you.

Application Layer Gateway Service Service Name Default Settings Microsoft Service Description

Process Name

ALG

XP Home : Manual

alg.exe

XP Pro : Manual

Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall.

Dependencies Real World Description

One of the bits and pieces you need if you connect to the internet using Microsoft's Internet Connection Sharing or Internet Connection Firewall,

Application Management Service Service Name Default Settings

AppMgmt

Process Name

XP Home : Manual

svchost.exe -k netsvcs

XP Pro : Manual

Microsoft Service Description

Provides software installation services such as Assign, Publish, and Remove.

Dependencies

None

Real World Description

Used when you modify an application i.e. Add/Remove.

Automatic Updates Service Service Name

Wuauserv

Process Name

svchost.exe -k netsvcs

Default Settings

XP Home : Automatic

XP Pro : Automatic

Microsoft Service Description

Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site.

Dependencies

None

Real World Description

See the Microsoft Description above.

Is this service needed?

Recommended Setting:

Possibly

Automatic

Background Intelligent Transfer Service Service Name Default Settings

BITS

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic XP Pro w/SP2 : Manual

Microsoft Service Description

Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled.

Dependencies

Remote Procedure Call (RPC)

Real World Description

In theory this should be a useful service, especially since it can continue an interrupted download due to a logoff or shutdown situation. Unfortunately, it can also be prone to trouble when the resumption occurs. See the KB article listed in Notes section.

ClipBook Service Service Name Default Settings

ClipSrv

Process Name

XP Home : Manual

clipsrv.exe

XP Pro : Manual XP Pro w/ SP2

: Disabled

Microsoft Service Description

Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Network DDE

Real World

If you're heavy into cutting 'n' pasting random snippets to

Network DDE DSDM

Description

others on the LAN, this is your baby. If not, it's easy enough to fire it up on the few occasions it is needed.

COM+ Event System Service Service Name Default Settings

EventSystem

Process Name

XP Home : Manual

svchost.exe

XP Pro : Manual

Microsoft Service Description

Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

One of the support files that you'll probably never have any use for, but if you disable it, the warning notices you receive are worse than leaving it enabled.

COM+ System Application Service Service Name Default Settings

COMSysApp

Process Name

XP Home : Manual

dllhost.exe

XP Pro : Manual

Microsoft Service Description

Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Basically, this is the application that controls COM+ Event System. One of the support files that you'll probably never have any use for, but if you disable it, the warning notices you receive are worse than leaving it enabled. Disabling this service will generate Event Log entries noting it isn't running. An annoyance, but not harmful.

Computer Browser Service Service Name Default Settings Microsoft Service

Browser

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Maintains an updated list of computers on the network and

Description

supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Server

Real World Description

Straightforward as can be, it keeps track of your computers on the network. If you're on a LAN, set it to Automatic. For stand alone systems, Disable is the way to go.

Workstation

Cryptographic Services Service Service Name Default Settings

CryptSvc

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Provides the annoying boxes that pop up telling you a driver you are about to install isn't digitally signed. If you disable this service you'll be flooded with uncertified driver notifications.

DCOM Server Process Launcher Service Name Default Settings

DcomLaunch

Process Name

XP Home : Not Available XP Home w/SP2: Automatic

svchost -k DcomLaunch

XP Pro :Not Available XP Pro w/SP2 : Automatic

Microsoft Service Description

Provides launch functionality for DCOM services.

Dependencies

No dependencies

DHCP Client Service Service Name Default Settings Microsoft Service

Dhcp

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Manages network configuration by registering and updating IP

Description

addresses and DNS names.

Dependencies

AFD Networking Support Environment

NetBios over Tcpip

Dependencies

TCP/IP Protocol Driver

IPSEC driver

Real World Description

This is how your computer gets a Dynamic IP address so you can connect to the internet. If Internet Connection Sharing is enabled, you need DHCP Client. Also required for most DSL/Cable connections.

Distributed Link Tracking Client Service Service Name Default Settings

TrkWks

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Maintains links between NTFS files within a computer or across computers in a network domain.

Dependencies

Remote Procedure Call (RPC)

Real World Description

For those that are part of a domain -and- use NTFS it has some value in keeping links across machines up to date, especially in the case of databases updated via the network.

Distributed Transaction Coordinator Service Service Name Default Settings

MSDTC

Process Name

XP Home : Manual

msdtc.exe

XP Pro : Manual

Microsoft Service Description

Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Closely related to Distributed Link Tracking Client discussed previously. Really serves no purpose for home user systems.

Security Accounts Manager

DNS Client Service Service Name Default Settings

Dnscache

Process Name

XP Home : Automatic

svchost.exe -k NetworkService

XP Pro : Automatic

Microsoft Service Description

Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

TCP/IP Protocol Driver

Real World Description

As the description above states, it caches Domain Name System (DNS) names for this computer. If disabled, it simply means the system will go upstream to resolve DNS names rather than use the cache.

Error Reporting Service Service Name Default Settings

ERSvc

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Allows error reporting for services and applications running in non-standard environments.

Dependencies

Remote Procedure Call (RPC)

Real World Description

This is responsible for the box that pops up wanting you to report an application error or system crash to Microsoft.

Event Log Service Service Name Default Settings

Eventlog

Process Name

XP Home : Automatic

services.exe

XP Pro : Automatic

Microsoft Service Description

Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped.

Dependencies

Remote Procedure Call (RPC)

Real World Description

One of the few services that actually cannot be stopped. Event logs can be viewed through the Microsoft Management Console.

Fast User Switching Compatibility Service Service Name

FastUser

Process Name

svchost.exe -k netsvcs

Switching Compatibility Default Settings

XP Home : Manual

XP Pro : Manual

Microsoft Service Description

Provides management for applications that require assistance in a multiple user environment.

Dependencies

Terminal Services

Real World Description

Supplies the 'Switch User' functionality associated with the logoff option. It's a nice touch if you really do have that many users that are constantly switching in and out of the same box.

Help and Support Service Service Name

helpsvc

Default Settings

Process Name

XP Home : Automatic

svchost.exe

XP Pro : Automatic

Microsoft Service Description

Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

This connects to the online help via Microsoft available from the Help and Support option on the Start Menu.

Human Interface Device Access [SP2 Terminology] HID Input Service [Pre SP2 Terminology] Service Name Default Settings

HidServ

Process Name

XP Home : Disabled

svchost.exe -k netsvcs

XP Pro : Disabled

Microsoft Service Description

Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

If you have a peripheral that uses the items mentioned in the description above this is what lets it work.

HTTP SSL Service Name Default Settings

Process Name

HTTPFilter

XP Home : Not Available

svchost.exe -k HTTPFilter

XP Pro : Not Available XP Pro w/SP2 : Manual

Microsoft Service Description

This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

HTTP

Real World Description

Another added security provision for sites that make use of HTTPS such as banking and e-commerce sites. Set it to Manual and it will kick in when needed, although just to be on the safe side I set it to Automatic.

IMAPI CD-Burning COM Service Service Name Default Settings Microsoft Service Description

ImapiService

Process Name

XP Home : Manual

imapi.exe

XP Pro : Manual

Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies Real World Description

As it says, if you want to have the XP CD burning capability, this will give you the power to Burn Baby, Burn. If you have a problem with burning CD's, check Auto Update for a patch and then set this service to Automatic.

Indexing Service Service Name Default Settings

cisvc

Process Name

XP Home : Manual

cisvc.exe

XP Pro : Manual

Microsoft Service Description

Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.

Dependencies

Remote Procedure Call (RPC)

Real World

It can speed things up search in the windows explorer.

Description

Internet Connection - Firewall (ICF) / Sharing (ICS) Service Service Name Default Settings

SharedAccess

Process Name

XP Home : Manual

svchost.exe

XP Pro : Automatic XP Pro w/SP2 : Eliminated in SP2

Microsoft Service Description

Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.

Dependencies

Application Layer Gateway Service

Network Connections

Dependencies

Network Location Awareness

Remote Access Connection Manager

Real World Description

As it says above. Set this service to the same setting used for Application Layer Gateway Service. IPSEC Services Service

Service Name Default Settings

PolicyAgent

Process Name

XP Home : Automatic

lsass.exe

XP Pro : Automatic

Microsoft Service Description

Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.

Dependencies

Remote Procedure Call (RPC)

Dependencies

TCP/IP Protocol Driver

Real World Description

Primarily a host authentication device used with data transfer and encryption operations on a domain.

IPSEC Driver

Logical Disk Manager Service Service Name Default Settings

Microsoft Service Description

dmserver

Process Name

XP Home : Manual

svchost.exe

XP Pro : Automatic

Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start.

Remote Procedure Call (RPC)

Dependencies

Plug and Play

Real World Description

Essential to managing and updating the hard drives. Works in conjunction with Disk Management plug-in in Microsoft Management Console.

Logical Disk Manager Administrative Service Service Name Default Settings

dmadmin

Process Name

XP Home : Manual

dmadmin.exe /com

XP Pro : Manual

Microsoft Service Description

Configures hard disk drives and volumes. The service only runs for configuration processes and then stops.

Dependencies

Plug and Play

Dependencies

Remote Procedure Call (RPC)

Real World Description

Works in concert with Logical Disk Manager, but can be set to Manual and it will be started and stopped as stated above.

Logical Disk Manager

Machine Debug Manager Service Service Name Default Settings

MDM

Process Name

XP Home : Manual

mdm.exe

XP Pro : Manual

Microsoft Service Description

Manages local and remote debugging for Visual Studio debuggers

Dependencies

Remote Procedure Call (RPC)

Messenger Service Service Name Default Settings

Messenger

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic XP Pro w/SP2

Microsoft Service Description

: Disabled

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows

Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start. Dependencies

NetBIOS Interface

Plug and Play

Dependencies

Remote Procedure Call (RPC)

Workstation

MS Software Shadow Copy Provider Service Service Name Default Settings

SwPrv

Process Name

XP Home : Manual

dllhost.exe

XP Pro : Manual

Microsoft Service Description

Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Related to using the Microsoft Backup Utility. If you use it, you might want to set this to Manual.

Net Logon Service Service Name Default Settings

Netlogon

Process Name

XP Home : Manual

lsass.exe

XP Pro : Manual XP Pro w/SP2 : Manual

Microsoft Service Description

Supports pass-through authentication of account logon events for computers in a domain.

Dependencies

Workstation

Real World Description

Domain Authentication, used when you log into the Domain. No domain? No Net Logon needed in spite of the way the name sounds.

NetMeeting Remote Desktop Sharing Service

Service Name Default Settings Microsoft Service Description

mnmsrvc

Process Name

XP Home : Manual

mnmsrvc.exe

XP Pro : Manual

Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies Real World Description

Makes it possible for a remote user with NetMeeting to access your computer.

Network Connections Service Service Name Default Settings

Netman

Process Name

XP Home : Manual

svchost.exe -k netsvcs

XP Pro : Manual

Microsoft Service Description

Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Basically, it controls the network and your ability to connect to the internet via Dial-Up.

Network DDE Service Service Name Default Settings

NetDDE

Process Name

XP Home : Manual

netdde.exe

XP Pro : Manual XP Pro w/SP2 : Disabled

Microsoft Service Description

Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Network DDE DSDM

Network Location Awareness (NLA) Service Service Name

Nla

Process Name

svchost.exe -k netsvcs

Default Settings

XP Home : Manual

XP Pro : Manual

Microsoft Service Description

Collects and stores network configuration and location information, and notifies applications when this information changes.

Dependencies

AFD Networking Support Environment

Real World Description

A part of the Internet Connection Sharing (ICS) component. It is also related with firewall.

TCP/IP Protocol Driver

Network Provisioning Service Service Name Default Settings

xmlprov

Process Name

XP Home : Not Available

svchost.exe -k netsvcs

XP Pro : Not Available XP Pro w/SP2 : Manual

Microsoft Service Description

Manages XML (XML (Extensible Markup Language) configuration files on a domain basis for automatic network provisioning.

Dependencies

Remote Procedure Call (RPC)

NT LM Security Support Provider Service Service Name Default Settings Microsoft Service Description

NtLmSsp

Process Name

XP Home : Manual

lsass.exe

XP Pro : Manual

Provides security to remote procedure call (RPC) programs that use transports other than named pipes.

Dependencies Real World Description

Provides support for Telnet and Message Queuing Performance Logs and Alerts Service

Service Name Default Settings

Microsoft Service Description

Dependencies

SysmonLog

Process Name

XP Home : Manual

smlogsvc.exe

XP Pro : Manual

Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start.

Real World Description

Another way to monitor system performance. If the box and network stats interest you, set this to Manual. If ignorance is bliss, Disabled is the way to go.

Plug and Play Service Service Name Default Settings Microsoft Service Description

PlugPlay

Process Name

XP Home : Automatic

services.exe

XP Pro : Automatic

Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.

Dependencies Real World Description

This is the automatic discovery of devices attached to your computer.

Portable Media Serial Number Service Service Name Default Settings

WmdmPmSp

Process Name

XP Home : Automatic

svchost.exe

XP Pro : Automatic XP Pro w/SP2 : Manual

Microsoft Service Description

Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device.

Dependencies Real World Description

Retrieves a serial number embedded into portable music players.

Print Spooler Service Service Name Default Settings

Spooler

Process Name

XP Home : Manual

spoolsv.exe

XP Pro : Manual XP Pro w/SP2 : Automatic

Microsoft Service Description

Loads files to memory for later printing.

Dependencies

Remote Procedure Call (RPC)

Real World Description

We used to call this the print que, but spooler works also.

Protected Storage Service Service Name

ProtectedStorage Process Name

Default Settings

XP Home : Automatic

lsass.exe

XP Pro : Automatic

Microsoft Service Description

Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.

Dependencies

Remote Procedure Call (RPC)

Real World Description

By 'sensitive data' they mean passwords, encryption data, etc. Closely tied into other 'features' like AutoComplete. The Protected Storage service certainly needs to be active if you are using Outlook Express, otherwise you have to type the password every time you want to check your emails. So it doesn't just have to do with autocomplete or password storage for Internet Explorer.

QoS RSVP Service Service Name

RSVP

Default Settings

Process Name

XP Home : Manual

rsvp.exe

XP Pro : Manual

Microsoft Service Description

Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.

Dependencies

AFD Networking Support Environment

Dependencies

Remote Procedure Call (RPC)

Real World Description

Supposedly provides a form of load balancing that shifts bandwidth between applications where it's most needed.

TCP/IP Protocol Driver

Remote Access Auto Connection Manager Service Service Name Default Settings Microsoft Service Description

RasAuto

Process Name

XP Home : Manual

svchost.exe -k netsvcs XP Pro : Manual

Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.

Dependencies

Remote Access Connection Manager

Telephony

Allows you to click an embedded link and automatically access the network. Can also play a role in DUN and DSL/Cable connections.

Real World Description

Remote Access Connection Manager Service Service Name

RasMan

Default Settings

Process Name

XP Home : Manual

Microsoft Service Description

Creates a network connection.

Dependencies

Telephony

Real World Description

Exactly what it says above.

svchost.exe -k netsvcs

XP Pro : Manual

Remote Desktop Help Session Manager Service Service Name Default Settings

RDSessMgr

Process Name

XP Home : Manual

sessmgr.exe

XP Pro : Manual

Microsoft Service Description

Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.

Dependencies

Remote Procedure Call (RPC)

Real World Description

If you're a Remote Desktop user, keep this enabled.

Remote Procedure Call (RPC) Service Service Name Default Settings

RpcSs

Process Name

XP Home : Manual

svchost -k rpcss

XP Pro : Manual

XP Pro w/SP2 : Automatic Microsoft Service Description

Provides the endpoint mapper and other miscellaneous RPC services.

Dependencies Real World Description

Its A Very Important Service And Required By Some Core Operation To Run By System.

Remote Procedure Call (RPC) Locator Service Service Name Default Settings

RpcLocator

Process Name

XP Home : Manual

locator.exe

XP Pro : Manual

Microsoft Service Description

Manages the RPC name service database.

Dependencies

Workstation

Remote Registry Service Service Name Default Settings

RemoteRegistry

Process Name

XP Home : Not Available

svchost.exe -k LocalService

XP Pro : Automatic

Microsoft Service Description

Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Removable Storage Service Service Name Default Settings

NtmsSvc

Process Name

XP Home : Manual

svchost.exe -k netsvcs

XP Pro : Manual

Microsoft Service Description

No Description Given

Dependencies

Remote Procedure Call (RPC)

Real World Description

Used for things like Zip Drives, Tape Drives, Graphics Pens.

outing and Remote Access Service Service Name Default Settings

RemoteAccess

Process Name

XP Home : Disabled

svchost.exe -k netsvcs

XP Pro : Manual XP Pro w/SP2 : Disabled

Microsoft Service Description

Offers routing services to businesses in local area and wide area network environments.

Dependencies

NetBIOSGroup

Real World Description

Allows LAN and WAN dial in access to the computer.

Remote Procedure Call (RPC)

ScriptBlocking Service Service Name Default Settings Microsoft Service Description

Process Name XP Home :

XP Pro :

None

Dependencies Real World Description

Installed by Symantec and relates to malicious script blocking.

Secondary Logon Service Service Name Default Settings Microsoft Service Description

seclogon

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies Real World Description

When Microsoft says 'Alternate Credentials' they are talking about the [Run As...] command which appears on the context menu, allowing a Limited User to run an executable as a higher level user.

Security Accounts Manager Service

Service Name Default Settings

SamSs

Process Name

XP Home : Automatic

lsass.exe

XP Pro : Automatic

Microsoft Service Description

Stores security information for local user accounts.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Related to the Secondary Logon function and another security info warehouse, similar to Protected Storage.

Security Center Service Name Default Settings

Process Name

wscsvc

XP Home : Not Available

svchost.exe -k netsvcs

XP Pro : Not Available XP Pro w/SP2 : Automatic

Microsoft Service Description

Monitors system security settings and configurations.

Dependencies

Remote Procedure Call (RPC)

Dependencies

Windows Management Instrumentation

Event Log

Server Service Service Name Default Settings Microsoft Service Description

lanmanserver

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies Real World Description

Provides basic file and print services on the LAN. No LAN? You don't need this.

Shell Hardware Detection Service Service Name Default Settings Microsoft Service

ShellHWDetection Process Name XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Provides notifications for AutoPlay hardware events.

Description Dependencies

Remote Procedure Call (RPC)

Real World Description

Testing shows that it's related to AutoPlay functionality such as digital cameras, CD ROM's

Smart Card Service Service Name Default Settings

SCardSvr

Process Name

XP Home : Manual

SCardSvr.exe

XP Pro : Manual

Microsoft Service Description

Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Plug and Play

Real World Description

Just what the description says. If you have a Smart Card you need this.

Smart Card Helper Service Service Name Default Settings

SCardDrv

Process Name

XP Home : Manual

SCardSvr.exe

XP Pro : Manual XP Pro w/SP2 : Eliminated in SP2

Microsoft Service Description

Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies Real World Description

The same as Smart Card except this is for legacy cards that don't support Plug and Play.

System Event Notification Service Service Name Default Settings Microsoft Service Description

SENS

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of

these events. Dependencies

COM+ Event System

Real World Description

Whether your system actually has need for this depends on what you have installed, but many applications have processes that are run through System Event Notification.

SSDP Discovery Service Service Name Default Settings

SSDPSRV

Process Name

XP Home : Manual

svchost.exe -k LocalService

XP Pro : Manual

Microsoft Service Description

Enables discovery of UPnP devices on your home network.

Dependencies

HTTP

Real World Description

Remember, a UPnP device is external (not inside the computer case) and a part of the local network. Universal Plug and Play (UPnP) is a set of networking protocols promulgated by the UPnP Forum. The goals of UPnP are to allow devices to connect seamlessly and to simplify the implementation of networks in the home (data sharing, communications, and entertainment) and in corporate environments for simplified installation of computer components. UPnP achieves this by defining and publishing UPnP device control protocols (DCP) built upon open, Internet-based communication standards. The term UPnP is derived from plug-and-play, a technology for dynamically attaching devices directly to a computer, although UPnP is not directly related to the earlier plug-and-play technology. UPnP devices are "plug-and-play" in that when connected to a network they automatically announce their network address and supported device and services types, enabling clients that recognize those types to immediately begin using the device.

System Restore Service Service Name Default Settings

srservice

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer>Properties

Dependencies

Remote Procedure Call (RPC)

Real World Description

Allows you to take a snapshot of your system and then roll it back to that particular point in time.

Task Scheduler Service Service Name Default Settings

Schedule

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

TCP/IP NetBIOS Helper Service Service Name Default Settings

LmHosts

Process Name

XP Home : Automatic

svchost.exe -k LocalService

XP Pro : Automatic

Microsoft Service Description

Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.

Dependencies

AFD Networking Support Environment

Net BT

Telephony Service Service Name Default Settings

TapiSrv

Process Name

XP Home : Manual

svchost.exe -k netsvcs

XP Pro : Manual

Microsoft Service Description

Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Basically controls all dialup activity and in some cases DSL/Cable activity.

Telnet Service

Plug and Play

Service Name Default Settings

TlntSvr

Process Name

XP Home : Not Available

tlntsvr.exe

XP Pro : Manual XP Pro w/SP2 : Disabled

Microsoft Service Description

Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

NT LM Security Support Provider

Dependencies

Remote Procedure Call (RPC)

TCP/IP Protocol Driver

Terminal Services Service Service Name Default Settings

TermService

Process Name

XP Home : Manual

svchost -k DComLaunch

XP Pro : Manual

Microsoft Service Description

Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.

Dependencies

Remote Procedure Call (RPC)

Themes Service Service Name Default Settings

Themes

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Manual XP Pro w/SP2

Microsoft Service Description

: Automatic

Provides user experience theme management.

Dependencies Real World Description

If you like the themes in XP, this makes them available. Setting this to Automatic allows all users to access themes if they wish.

Uninterruptible Power Supply Service

Service Name Default Settings Microsoft Service Description

UPS

Process Name

XP Home : Manual

ups.exe

XP Pro : Manual

Manages an uninterruptible power supply (UPS) connected to the computer.

Dependencies Real World Description

Just what it says above. How your UPS connects to the computer really determines whether this is needed. Many USB connected UPS's don't need this service.

Universal Plug and Play Device Host Service Service Name Default Settings

upnphost

Process Name

XP Home : Manual

svchost.exe -k LocalService

XP Pro : Manual

Microsoft Service Description

Provides support to host Universal Plug and Play devices.

Dependencies

HTTP

SSDP Discovery Service

Upload Manager Service Service Name Default Settings

uploadmgr

Process Name

XP Home : Automatic

svchost.exe

XP Pro : Automatic

Microsoft Service Description

Manages synchronous and asynchronous file transfers between clients and servers on the network. If this service is stopped, synchronous and asynchronous file transfers between clients and servers on the network will not occur. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Volume Shadow Copy Service Service Name Default Settings Microsoft Service Description

VSS

Process Name

XP Home : Manual

vssvc.exe

XP Pro : Manual

Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow

copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. Dependencies

Remote Procedure Call (RPC)

WebClient Service Service Name Default Settings

WebClient

Process Name

XP Home : Automatic

svchost.exe -k LocalService

XP Pro : Automatic

Microsoft Service Description

Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

WebDav Client Redirector

Windows Audio Service Service Name Default Settings

AudioSrv

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Plug and Play

Remote Procedure Call (RPC)

Windows Firewall/Internet Connection Sharing (ICS) Service Name Default Settings

SharedAccess

Process Name

XP Home : Not Available

svchost.exe -k netsvcs

XP Pro : Not Available XP Pro w/SP2 : Automatic

Microsoft Service Description

Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.

Dependencies

Network Connections

Dependencies

Windows Management

Event Log / Remote Procedure Call

Instrumentation

(RPC)

Windows Image Acquisition (WIA) Service Service Name

stisvc

Default Settings

Process Name

XP Home : Manual

svchost.exe -k imgsvc

XP Pro : Manual

Microsoft Service Description

Provides image acquisition services for scanners and cameras.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Controls web cams, cameras, and scanners.

Windows Installer Service Service Name

MSIServer

Default Settings

Process Name

XP Home : Manual

msiexec.exe /V

XP Pro : Manual

Microsoft Service Description

Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Remote Procedure Call (RPC)

Real World Description

Used to install applications that use .msi installation files.

Windows Management Instrumentation Service Service Name Default Settings

Winmgmt

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Event Log

Remote procedure Call (RPC)

Windows Management Instrumentation Driver Extensions

Service Name Default Settings Microsoft Service Description

Wmi

Process Name

XP Home : Not Available

svchost.exe -k netsvcs

XP Pro : Manual

Provides systems management information to and from drivers.

Dependencies

Windows Time Service Service Name Default Settings Microsoft Service Description

W32Time

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.

Dependencies

Wireless Zero Configuration Service Service Name Default Settings

WZCSVC

Process Name

XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Microsoft Service Description

Provides automatic configuration for the 802.11 adapters

Dependencies

NDIS Usermode I/O Protocol

Real World Description

Auto configuration for wireless network devices.

Remote Procedure Call (RPC)

WMI Performance Adapter Service Service Name Default Settings

WmiApSrv

Process Name

XP Home : Manual

wmiapsrv.exe

XP Pro : Manual

Microsoft Service Description

Provides performance library information from WMI HiPerf providers.

Dependencies

Remote Procedure Call

(RPC)

Workstation Service Service Name Default Settings Microsoft Service Description

lanmanworkstatio Process Name n XP Home : Automatic

svchost.exe -k netsvcs

XP Pro : Automatic

Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.