Mjölnir's Windows 2K and XP Services Guide

[Mjölnir]

Services Listing - M


MACHINE DEBUG MANAGER - (mdm.exe) [MDM]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service manages local and remote debugging services for Visual Studio components. Visual Studio components are not only installed by Visual Studio. Some components of MS Office may install this too, so don’t be surprised if this pops up in your service list. Use Disabled if you get sick of being asked “do you want to debug the script on this page”, otherwise, use Manual.
Guide: Stop, Disabled


MESSENGER - (services.exe) [Messenger]
Depends on: NetBIOS Interface, Plug n’ Play, Remote Procedure Call (RPC), Workstation
Required by: N/A
XP Home: Auto
XP Pro: Auto (Disabled in SP2)
2K Pro: Auto
Not to be confused with MSN Messenger or Windows Messenger. The Messenger Service can be just as potent as a backdoor to malicious softwares. It’s main purpose is to transmit NET SEND and Alerter messages across a network, however it has been widely exploited and is now a major security hole. Spam and Internet Popups make use of Messenger Service through the following UDP Ports (135, 137, 138) and TCP Ports (135, 139, 445). Close these ports if you wish to block these popups.
The only time this service should be needed is for a protected office network running Win2K/XP systems that utilise NET SEND commands or the Alerter Service. You can also visit www.grc.com for a program called “Shoot the Messenger” which can help deal with the vulnerability of this service.
Guide: Stop, Disabled


MS SOFTWARE SHADOW COPY PROVIDER - (dllhost.exe) [SwPrv]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service is used for Windows’ Backup facilities. If you use these, leave this service on Auto. Otherwise, leave it on Manual. Leaving it on Manual will save from receiving messages in Event Log about it not running. It won’t start if you don’t need it. See the Volume Shadow Copy Service for more information.
Guide: Stop, Manual

[Mjölnir]

Services Listing - N


NET LOGON - (lsass.exe) [Netlogon]
Depends on: Workstation
Required by: N/A
XP Home: Manual
XP Pro: Auto
2K Pro: Auto
This service provides security authentication mechanisms for computers and events logging onto a domain. If you are not on a domain, set this service to Manual, otherwise leave it on Auto. This service uses lsass.exe. See IPSEC Services for more information viruses.
Guide: Stop, Manual


NETMEETING REMOTE DESKTOP SHARING - (mnmsrvc.exe) [mnmsrvc]
Depends on: N/A
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service allows for remote desktop sharing, where a host sees and controls another PC from their own screen. In particular, this service allows any host to see your machine – provided that you grant access to them. You can also turn off further Remote Desktop options by going to Control Panel > System Properties > Remote and unchecking all sharing options in there. This service is of particular benefit to the corporate environment, but is literally a privacy and security risk for most others. One of the few services recommended to be set as Disabled.
Guide: Stop, Disabled


NETWORK CONNECTIONS - (svchost.exe) [Netman]
Depends on: Remote Procedure Call (RPC)
Required by: Windows Firewall / Internet Connection Sharing (ICS)
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service manages all of your network connections in the “Network and Dial-Up Connections” folder. If you use the internet or are part of a network, be sure to leave this on Manual. Never Disable this service unless you are on a totally stand-alone PC (no network or internet).
Guide: Start, Manual


NETWORK DDE - (netdde.exe) [NetDDE]
Depends on: Network DDE DSDM
Required by: Clipbook
XP Home: Manual
XP Pro: Manual (Disabled in SP2)
2K Pro: Manual
DDE (Dynamic Data Exchange) is exactly that – a service to transfer data using document protocols. Programs like Visual Basic, Word, Excel and databases using information over a network might use this, but not necessarily. The Clipbook Service relies heavily on it. There is a misconception that it is the same as COM+, however each has their individual specialities. Network DDE is essentially only for document and data exhanges, whereas COM+ is also capable of managing application sessions. Just as a precaution - in case some applications may require the Network DDE Service, you should leave this on Manual. If it’s not required, it won’t start so setting to Stop, Manual is a safe and effective option.
Guide: Stop, Manual


NETWORK DDE DSDM - (netdde.exe) [NetDDEdsdm]
Depends on: N/A
Required by: Network DDE
XP Home: Manual
XP Pro: Manual (Disabled in SP2)
2K Pro: Manual
This service manages network shares for the Network DDE Service, therefore working in close conjunction with the Network DDE Service. Also as a precaution, this service should be left on Manual. If you stop it, it won’t start unless it is needed.
Guide: Stop, Manual


NETWORK LOCATION AWARENESS (NLA) - (svchost.exe) [Nla]
Depends on: AFD Network Support Environment, TCP/IP Protocol Driver
Required by: Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS) (Pre XP SP2 only)
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service maintains a list of known network connections and various details about them. When the network connections are changed, this service updates and also informs network applications of the changes. Internet Connection Sharing and Internet Connection Firewall rely heavily on this service. It is strongly suggested that you do not alter the settings on this service, however if your system has Internet Connection Sharing/Internet Connection Firewall Service set to Automatic and use that service regularly, you may also like to set this service to Automatic. Otherwise leave it on the Default setting.
Guide: Start, Manual


NETWORK PROVISIONING - (svchost.exe) [xmlprov]
Depends on: N/A
Required by: N/A
XP Home: N/A
XP Pro: Manual SP2 ONLY!
2K Pro: N/A
This service provides a mechanism to develop and maintain a network configuration database consisting of authentication information and network details for the purpose of bolstering security and optimising networks. It’s particularly useful for wireless networks, though other network applications may make use of it. It won’t start unless it is needed and if it does start it will probably be providing greater security as the need arises. Leaving it on Default settings is recommended.
Guide: Stop, Manual


NT LM SECURITY SUPPORT PROVIDER - (lsass.exe) [NtLmSsp]
Depends on: N/A
Required by: Telnet
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service provides security for applications using the network and are not using pre-defined/named pipes. Microsoft Message Queuing (MSMQ) and Telnet both use this service, so if you are on a network that uses either of these two, you will need to have this set to at least Manual. This includes Telnet sessions over the Internet. When set to Manual, this Service won’t start unless it is required. You can set it to Stop, Manual if you don’t use MSMQ or Telnet. Having it on Manual still lets other applications access these security features should they require them. Just a precaution. Unlikely that it will get used on most home systems. This service uses lsass.exe. See IPSEC Services for further information.
Guide: Stop, Manual

[Mjölnir]

Services Listing - P


PERFORMANCE LOGS AND ALERTS - (smlogsvc.exe) [SysmonLog]
Depends on: N/A
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This Service can be used to schedule logging of performance regarding various aspects of your computer (or a remote computer) such as processor activity and paging file activity. It can also be set to alert you should certain parameters in performance be reached. Most people don’t require this service and it won’t start unless a Performance Log schedule has been created, so setting it to Manual would be quite sufficient. You can set or view Performance Log schedules with Performance Monitor (perfmon).
Guide: Stop, Manual


PLUG AND PLAY - (services.exe) [PlugPlay]
Depends on: N/A
Required by: Logical Disk Manager, Logical Disk Manager Administrative Service, Messenger, Smart Card, Telephony, Windows Audio
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service is an essential part of your Windows system. It allows a user to add and remove components without the need to manually configure the way the system uses it. This service is designed so that you can plug in a device and Windows will automatically configure it and seek drivers for it. Don’t disable it!
Guide: Start, Auto


PORTABLE MEDIA SERIAL NUMBER - (svchost.exe) [WmdmPmSp]
Depends on: N/A
Required by: N/A
XP Home: Auto
XP Pro: Auto (Manual in SP2)
2K Pro: N/A
This service retrieves the serial number of any portable media devices (cameras, MP3 players, etc) that you may attach to your computer and is part of Microsoft’s Digital Rights Management endeavours. If you stop this service and set it to Manual, you should have no problems, but if you do encounter problems with a device then set this service back to Auto.
Guide: Stop, Manual


PRINT SPOOLER - (spoolsv.exe) [Spooler]
Depends on: Remote Procedure Call (RPC)
Required by: Fax
XP Home: Manual
XP Pro: Manual (Auto in SP2)
2K Pro: Auto
This service allows you to print locally or over a network. If it is not running, you will not be able to print. If you don’t have a printer, you don’t use your PC for faxing and you don’t use any applications that use printing to file mechanisms (some CAD software and design software use this service to print to a file) then you should be able to set this service to Disabled or stop it and set it to Manual. Otherwise, you should leave it on the default setting.
Guide: Start, Auto


PROTECTED STORAGE - (lsass.exe) [ProtectedStorage]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
Protected Storage provides a safe and hidden storage area for sensitive data such as private keys (Encryption), ANY saved passwords (including AutoComplete and email passwords) and even some saved website information. If you disable this service, you will have to enter passwords for everything and any encrypted data will become inaccessible. Some sources suggest that stopping this service will provide added security, however doing so may result in some programs having limited functionality or not running at all. This service uses lsass.exe. See IPSEC Services for further information.
Guide: Start, Auto

[Mjölnir]

Services Listing - Q


QoS RSVP - (rsvp.exe) [RSVP]
Depends on: ADF Networking Support Environment, Remote Procedure Call (RPC), TCP/IP Protocol Driver
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: N/A
This service can be used by applications that support it to ensure a specific quality of service or specific amount of data flow. In layman’s terms, it provides network load management between supported applications. Some applications that may use it or may benefit from it include Internet Connection Sharing, Windows Media Player, NetMeeting and VoIP systems. QoS can allow applications to reserve up to 20% of your network bandwidth. This is often misconceived as QoS “stealing” 20% of your bandwidth. Not true. 100% of your bandwidth is available and if there is any remaining bandwidth left by an application using QoS, the excess will be available to other applications. If this service is disabled, QoS dependent applications may not run at all. You can find more information about this service on MS Knowledge Base Article Q316666.
Guide: Stop, Manual

[Mjölnir]

Services Listing - R


REMOTE ACCESS AUTO CONNECTION MANAGER - (svchost.exe) [RasAuto]
Depends on: Remote Access Connection Manager, Telephony
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service may also be referred to as the ‘autodial service’. When there is no network connection present and a link to a remote DNS or NetBIOS address is requested, the service will start and then attempt to create a connection to that link. Dial-up internet typically requires this service and some broadband ISP’s also require it as part of their login process. This service also maintains a database of connections previously established to assist users in making the same connections in the future. According to Microsoft, “disabling this service has no effect on the rest of the operating system. You will have to set up connections to remote computers manually”. See Remote Access Connection Manager Service for more information. If you experience problems connecting to a network or to the internet, I would suggest setting this back to Manual, or if you are experiencing connection problems while it is on manual, try setting it to Auto. Since this service only starts when it is needed, it is suggested that you leave it on default settings.
Guide: Stop, Manual


REMOTE ACCESS CONNECTION MANAGER - (svchost.exe) [RasMan]
Depends on: Telephony
Required by: Internet Connection Sharing (ICS)/Internet Connection Firewall (ICF) (Pre-SP2 only!), Remote Access Auto Connection Manager
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service manages the task of establishing, maintaining and terminating network connections. This service will always run, unless there are no network connections in the Network Connections folder. Disabling this service will damage functionality of some parts of the Windows OS, including the Network Connections folder. Leave it on default settings.
Guide: Start, Manual


REMOTE DESKTOP HELP SESSION MANAGER - (sessmgr.exe) [RDSessMgr]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: N/A
Allows [other] users to remotely access and control the desktop of the current machine. It is designed for the purpose of allowing helpdesk support personnel to see what you are seeing. Unless your computer is part of a workplace network that does actually utilise this service, it is strongly recommended that you Disable this service since it is often exploited to gain unauthorised entry into a machine. If you don’t need this service, you should open System Properties, then in the ‘Remote’ tab untick the ‘Remote Assistance’ and ‘Remote Desktop’ options.
Guide: Stop, Disabled


REMOTE PROCEDURE CALL (RPC) - (svchost.exe) [RpcSs]
Depends on: N/A
Required by: Background Intelligent Transfer Sevice, COM+ Event System, COM+ System Application, Cryptographic Services, Distributed Link Tracking Client, Distributed Transaction Coordinator, Error Reporting Service, Fax, Help and Support, HID Input Service, Indexing Service, IPSEC Services, Logical Disk Manager, Logical Disk Manager Administrative Service, Messenger, MS Software Shadow Copy Provider, Network Connections, Print Spooler, Protected Storage, QoS RSVP, Remote Desktop Help Session Manager, Remote Registry, Removable Storage, Routing and Remote Access, Security Accounts Manager, Shell Hardware Detection, System Restore Service, Task Scheduler, Telephony, Telnet, Terminal Services, Upload Manager, Volume Shadow Copy, Windows Audio, Windows Image Acquisition, Windows Installer, Windows Management Instrumentation, Wireless Zero Configuration, WMI Performance Adaptor
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
Do not disable this service!! This is one of the most critical services on your Windows system. Many other Services as well as a wide variety of software packages depend on the RPC Service, hence disabling this service will most likely result in irreversible problems with your Windows system and/or the inability to boot into Windows. The primary role of the RPC Service is to provide a seamless mechanism for one computer to be able to execute a variety functions on remote systems. The RPC Service also provides functionality to local software and services. RPC will most likely change it’s setting from the default of Manual to Auto, which is why this guide recommends setting the RPC Service to Start, Auto.
Guide: Start, Auto


REMOTE PROCEDURE CALL (RPC) LOCATOR - (locator.exe) [RpcLocator]
Depends on: Workstation
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service allows network applications to use names that the user can comprehend by mapping a name to a “binding handle”. A binding handle is a network object, which includes network addresses or protocol sequences. Typically most users won’t need this, however some applications or configurations will make use of it, so it is recommended that you leave it on Manual. It won’t start if it’s not needed.
Guide: Stop, Manual


REMOTE REGISTRY - (svchost.exe) [RemoteRegistry]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: N/A
XP Pro: Auto
2K Pro: N/A
This Service allows a remote machine to gain access to the local machine (and vice-versa) for the explicit purpose of manipulating the registry. It may be a useful function in the workplace environment, allowing I.T. Administrators to remotely make relevant changes to the registry. Unfortunately this service can be exploited in order to gain unauthorised access to your machine or make unwanted changes (damage). The vast majority of home users will most likely not have any reason to allow their registry to be accessed across a network or the Internet, hence this guide strongly advises that you disable this Service.
Guide: Stop, Disabled


REMOVABLE STORAGE - (svchost.exe) [NtmsSvc]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service is used for removable media (excluding most CD/DVD drives and floppy drives) such as Tape Storage and ZIP Drives. It may affect some other removeable drives such as USB Mass Storage (UMS) devices and could have an effect on “hot swappable” Serial ATA (SATA) Hard Drives on newer systems. Usually it won’t have an effect on the system’s operation, but since it has potential to adversely affect some devices, It’s recommended to leave it on Manual so it can start if it needs to. If you have problems with removable storage devices, or even your CD/DVD drives, consider setting this to Automatic.
Guide: Stop, Manual


ROUTING AND REMOTE ACCESS - (svchost.exe) [RemoteAccess]
Depends on: NetBIOSGroup, Remote Procedure Call (RPC)
Required by: N/A
XP Home: Disabled
XP Pro: Manual (Disabled in SP2)
2K Pro: Disabled
This service is primarily designed to allow remote access to your PC or to use routing functions when certain network configurations are used. If your PC is part of a workplace network, consult your IT Admin to find out if this service is required. For typical home use, it is recommended that you disable this service for security reasons.
Guide: Stop, Disabled

[Mjölnir]

Services Listing - S (part 1)


SECONDARY LOGON - (svchost.exe) [seclogon]
Depends on: N/A
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service allows processes to run under a different username. When this service is running, you can set a program to “Run As” and choose a different user to run that program. It’s handy for running programs that require higher privileges (like installing programs or drivers) under a limited user account without having to log in under an Administrator account. In most cases you can stop and disable this service without having an adverse effect on the operation of your system. It’s recommended that you stop it and set it to Manual. It won’t start every time you boot Windows but will still be available if you need it.
Guide: Stop, Manual


SECURITY ACCOUNTS MANAGER - (lsass.exe) [SamSs]
Depends on: Remote Procedure Call (RPC)
Required by: Distributed Transaction Coordinator
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service manages security information for each user. If you use policies or templates (Group Policy, System Policy, Security Policy, etc), you will definitely need this service. Various programs also add or amend policies. For this reason alone, it is worth leaving this service on Auto. Security Accounts Manager is also fundamental to networking technologies which use SAM databases. If the service is not started, the PC will probably not be allowed access to the network or may have restricted privileges. This service uses lsass.exe. See IPSEC Services for further information.
Guide: Start, Auto


SECURITY CENTER - (lsass.exe, wscntfy.exe) [wscsvc]
Depends on: Remote Procedure Call (RPC), Windows Management Instrumentation
Required by: N/A
XP Home: Auto SP2 ONLY!
XP Pro: Auto SP2 ONLY!
2K Pro: N/A
This service monitors Windows XP’s security settings as well as antivirus software and firewalls. It also monitors the state of Automatic Updates. Although the service is executable is listed as lsass.exe, it also initialises wscntfy.exe. If you’re confident with managing your security applications yourself or if your security apps have automated features, you might like to disable this service. You’ll still be able to get updates and access limited configuration options in Security Center without this service. Before disabling, users should un-tick the three alert options under the “Change the way Security Centre alerts me” menu. When Windows XP Service Pack 2 was released, there were reports that disabling this service may affect Windows stability. If you disable it bear this in mind, and if you experience instability, re-enable this service. This service uses lsass.exe. See IPSEC Services for further information.
Guide: Stop, Disabled


SERVER - (svchost.exe) [lanmanserver]
Depends on: N/A
Required by: Computer Browser
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service facilitates File and Printer Sharing on your PC. It also If it’s stopped, any shared printers or files that you had on your PC will no longer be shared with other PC’s, though you should still be able to view shares from other networked PC’s provided that the Workstation Service is running. In some cases, disabling File and Printer Sharing can cause this service to “vanish” from the services list. If that’s the case, enable File and Printer Sharing again and the service should reappear. If you don’t share files or printers and you’re ultra-paranoid about security, you may see fit to disable this service, however removing "File and Printer Sharing" from network connections has the same effect.
Guide: Start, Auto


SHELL HARDWARE DETECTION - (svchost.exe) [ShellHWDetection]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service provides Autoplay functionality to removable media like CD/DVD drives and USB storage devices. Disabling this service should disable Autoplay and will also cause DVD drives to be labelled as CD drives in Windows Explorer, though they will still function as DVD drives. Disabling Autoplay is recommended for all removable media because it scans Windows Meta File data. A serious vulnerability in Windows Meta File has been found on all Windows platforms made after Windows 98. Windows Updates include a fix for this. It’s recommended that you leave this service and disable Autoplay from somewhere else (which wont affect the naming of DVD drives) such as in the Group Policy Editor or with TweakUI 1.33 (available at the Microsoft website). There is also a third-party fix for the WMF vulnerability available here.
Guide: Start, Auto


SMART CARD - (SCardSvr.exe) [SCardSvr]
Depends on: Plug and Play
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service supports the use of Smart Cards for authentication locally or over networks. Unless you’re using Smart Cards, there’s no need to be running this service. If you stop it and leave it on Manual it won’t start, though it is also safe to disable it.
Guide: Stop, Manual


SMART CARD HELPER - (SCardSvr.exe) [SCardDrv]
Depends on: N/A
Required by: N/A
XP Home: Manual (Removed in SP2 – combined with Smart Card)
XP Pro: Manual (Removed in SP2 – combined with Smart Card)
2K Pro: Manual
This service provides Legacy support for the Smart Card service, allowing Windows to function with Smart Card devices that aren’t Plug N Play compliant. This service was integrated with the Smart Card Service with the introduction of Windows Service Pack 2. Like the Smart Card service, if you stop it and leave it on Manual it won’t start, though it is also safe to disable it.
Guide: Stop, Manual

[Mjölnir]

Services Listing - S (part 2)


SSDP DISCOVERY - (svchost.exe) [SSDPSRV]
Depends on: N/A
Required by: Universal Plug and Play Device Host
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service allows the computer to find Universal PnP devices (not to be confused with Plug N Play devices) over an Internet Protocol (IP) network such as networked printers or storage devices and network gateway devices (including routers, firewalls and Internet Connection Sharing hosts), through to networked home security devices. It works in conjunction with the Universal Plug and Play Device Host service. Windows’ UPnP implementation has been a major security vulnerability, largely because the ports used (1900 and 5000) were left “wide open” for communication into unprotected machines. The vulnerability has allegedly been fixed, however the ports still remain open. Shutting down this service and the Universal Plug and Play Device Host service will ensure that the ports are closed. Alternatively you can download and run UnPlug N Pray from here. In most cases there is no need to have this service running, since most capable UPnP devices will still operate without this service running, however a select few DirectX games may require it in order to connect. If you use MSN Messenger and are behind a router, you may also require this service to make use of some advanced features such as voice-chat, whiteboard, etc. If you do wish to use UPnP functionality, you will need both this service and the Universal Plug and Play Device Host service running.
Guide: Stop, Disabled


SYSTEM EVENT NOTIFICATION - (svchost.exe) [SENS]
Depends on: COM+ Event System
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service monitors logon, power and networking events and reports or logs accordingly to applications which subscribe to it. Internet Explorer 5.x and later uses this service to trigger the “Work Offline” prompt, which is probably only applicable to portable computers and dial-up networking. Synchronisation Manager (mobsync.exe) also relies on this service to be running in order to receive connect/disconnect and logon/logoff event notifications. Some applications relating to power on portable PC’s may also require this service, along with some applications which use networking. It is recommended that you leave this service on default settings.
Guide: Start, Auto


SYSTEM RESTORE SERVICE - (svchost.exe) [srservice]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
System Restore makes a backup (Restore Point) of the registry and some important Windows files after certain program and device installations for the purpose of rolling back to a previous state should you encounter problems. It also attempts to protect the “restore point” data by denying users access to it’s files. Restore point data is stored in the “System Volume Information” folder on the root directory of each partition on a Windows XP system. Restore Points are an excellent way to roll back from a damaged registry or a botched software installation. In other versions of Windows (except Windows ME), problems like this may only be fixed by reinstalling Windows. System Restore folders are also a major target for malicious software because they are protected and provide a way of injecting malicious files back into the system. Many antivirus and other malicious software scanners can’t access the protected folders meaning that nasties hiding in a System Restore folder would very likely reinfect the PC at a later stage. Disabling the service or turning off System Restore via Control Panel > System Properties will delete all Restore Points, including any malicious software contained within them. It is highly recommended that System Restore is stopped one way or another when cleaning an infected machine. Disabling this service won’t adversely affect the operation of Windows but it will deny you some very powerful recovery options. Because of those options, it is recommended that you leave it on default settings.
Guide: Start, Auto

[Mjölnir]

Services Listing - T


TASK SCHEDULER - (svchost.exe) [Schedule]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service serves two purposes. The obvious one is that it is used for scheduling various tasks or programs to be initiated at particular times - ranging from internal programs such as Disk Defragmenter or Backup facilities to third-party programs of the user’s choice like some virus scanners. Some software may depend on this service to perform it’s duties, such as scanning or updating functions of antivirus software. The second purpose is to facilitate Windows Prefetching (C:\%WINDIR%\Prefetch). Windows Prefetching is the process of loading certain aspects of Windows or other installed software to make them load faster. If you disable Task Scheduler, you also disable Windows Prefetching, along with any tasks that have been scheduled. Manipulating the Windows Prefetch folder or removing its contents is commononly touted as a “tweak”, though the tweak has been "debunked" on several sites. The effects of the "tweak" may vary from one PC to the next, so it's up to you to decide if it works for you or not. Disabling this service doesn't cut down on memory usage, and since disabling it diminishes the system's functionality, this guide recommends leaving it on default settings.
Guide: Start, Auto


TCP/IP NetBIOS HELPER - (svchost.exe) [LmHosts]
Depends on: AFD, NetBIOS over TCPIP
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service enables NETBIOS over TCP/IP connections, which in turn allows your computer to resolve NetBIOS names over a network. If your network is using NetBIOS and WINS (many static IP LAN’s and VPN’s use this), you should leave this setting enabled. Some online games servers also rely on this setting when pinging the master browser to get a list of available game servers. It is claimed by some sources that this service is a security risk, which is not entirely true. Provided that you keep Windows updated, the security flaws associated with this service are typically a result of poor configuration on the user’s part, such as lack of passwords on shares on NetBIOS enabled networks. You might like to try disabling this service if you’re not connected to a network (or if you use DHCP), but if you have problems with your network or online games, put it back on default settings.
Guide: Start, Auto


TELEPHONY - (svchost.exe) [TapiSrv]
Depends on: Plug and Play, Remote Procedure Call (RPC)
Required by: Remote Access Auto Connection Manager, Remote Access Connection Manager
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service provides functionality for telephony devices and some IP devices connected to the computer and applications that use them. These devices include dial-up modems, DSL modems, faxes, IP phones (PABX). If you don’t have any of the above, are not on a network or have a DSL router that establishes the connection for you, then disabling this service shouldn’t have any effect on your system. This service won’t start unless it is needed, so there is also little point in disabling it.
Guide: Stop, Manual


TELNET - (tlntsvr.exe) [TlntSvr]
Depends on: NT LM Security Support Provider, Remote Procedure Call (RPC), TCP/IP Protocol Driver
Required by: N/A
XP Home: N/A
XP Pro: Manual (Disabled in SP2)
2K Pro: Manual (Disabled in SP2)
This service enables the Telnet Networking Protocol, which allows users and applications to log into the computer remotely. It is also used by some POP3 servers (not very common) and is also useful for data acquisition with local Serial devices. A variety of security exploits have been targeted at this service, allowing people easy, unauthorised access to Telnet-enabled machines. Windows’ Telnet listens for activity on Port 23. Unless you require the use of Telnet, it is strongly recommended that you disable this service.
Guide: Stop, Disabled


TERMINAL SERVICES - (svchost.exe) [TermService]
Depends on: Remote Procedure Call (RPC)
Required by: Fast User Switching Compatibility
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service allows multiple users to be logged into the machine locally and also facilitates remote login features such as Desktop Sharing, Remote Assistance and Terminal Server. With Fast User Switching Compatibility enabled, multiple users can log into their account without having to log out of other accounts, which can be very handy in multi user environments but is not necessary in single-user environments (see also Fast User Switching Service). This service alone (or with Fast User Switching Compatibility) doesn’t pose a security threat, provided that Windows is up to date. Because of the advantages of Fast User Switching, the recommendation has been left at the default settings, however if you’re a single user who doesn’t need the above remote login features, there won’t be adverse effects from disabling this service.
Guide: Start, Auto


THEMES - (svchost.exe) [Themes]
Depends on: N/A
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
Themes allow the default trademark bubbly 3D appearance of Windows XP to be used and manipulated through the under Control Panel > Display Settings > Themes. The alternative is the flat 2D appearance that Windows 95,98,ME and 2000 use, called “Classic Desktop”. When this service is disabled, you will simply lose access to the Desktop themes available under the Themes Tab. However if you want to use custom skins for the Desktop environment, you may need this service. In XP Pro, you can remove the Themes tab for individual users through Group Policy Editor (gpedit.msc) under User Configuration > Administrative Templates > Control Panel > Display > Desktop Themes. The Themes service itself utilises little to no RAM at all. In fact it’s whether or not you use themes for your Desktop that dictates resource usage, regardless of whether this service is running or not. The detailed textures from the “bubbly” 3D themes put a greater load on the system than the “Classic Desktop” layout. To minimise RAM usage and make the desktop environment more responsive, use “Classic Desktop” and turn off any animation/transition effects. You can do this in Control Panel > System Properties > Advanced > Performance Settings > Visual Effects and then in Control Panel > Display Properties > Appearance > Effects. The Themes service isn’t required if you do this, so it won’t matter if you disable it. You’ll still be able to customise the colours and sizes through Control Panel > Display > Appearance > Advanced without the flashy 3D appearance that Themes use. Because you only lose the ability to use themes by disabling this, it’s recommended that you leave it at default settings and use “Classic Desktop” mode.
Guide: Start, Auto

[Mjölnir]

Services Listing - U


UNINTERRUPTIBLE POWER SUPPLY - (ups.exe) [UPS]
Depends on: N/A
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service allows Windows to work with a UPS connected via Serial or USB port, allowing users to configure the UPS through Control Panel > Power Options > UPS or have the UPS to shut down the PC if the need arises. Many UPS units these days don’t require this service and/or have their own management software. The service is stopped by default and you probably won’t allow you to start it unless there is a UPS connected to the PC. If you don’t have a UPS unit, there’s nothing to gain and no adverse effects from disabling this service. Leave on default settings.
Guide: Stop, Manual


UNIVERSAL PLUG AND PLAY DEVICE HOST - (svchost.exe) [upnphost]
Depends on: HTTP, SSDP Discovery Service
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: N/A
Not to be confused with Plug N Play (which should NEVER be disabled). This service works with the SSDP Discovery service and provides functionality to Universal PnP devices over an Internet Protocol (IP) network such as networked printers or storage devices, networking hardware and networked home security devices. Windows’ UPnP implementation has been a major security vulnerability, largely because the ports used (1900 and 5000) were left “wide open” for communication into unprotected machines. The vulnerability has allegedly been fixed, however the ports still remain open. Shutting down this service and the SSDP service will ensure that the ports are closed. Alternatively you can download and run UnPlug N Pray from http://www.grc.com/UnPnP/UnPnP.htm . In most cases there is no need to have this service running, since most capable UPnP devices will still operate without this service running, however a select few DirectX games may require it in order to connect. If you use MSN Messenger and are behind a router, you may also require this service to make use of some advanced features such as voice-chat, whiteboard, etc. If you do wish to use UPnP functionality, you will need both this service and the SSDP Discovery service running.
Guide: Stop, Disabled


UPLOAD MANAGER - (svchost.exe) [uploadmgr]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto (Removed in SP2)
XP Pro: Auto (Removed in SP2)
2K Pro: N/A
This service is essentially a networking technology designed for communication between your computer and some Microsoft online features. In Windows XP prior to Service Pack 2, the Windows Help and Support tool relied on this service to function properly. With the release of Service Pack 2, online access is governed by whether the Help and Support Service is running or not. The Upload Manager also provided access to Microsoft’s online driver installation database. It is recommended that manufacturer’s reference drivers are used for each device on your PC since they are typically more up to date and typically deliver better functionality to your devices. The Upload Manager service may also affect Internet Connection Sharing, so if you are using Internet Connection Sharing and are experiencing problems, you should restore this service to its default settings.
Guide: Stop, Disabled

[Mjölnir]

Services Listing - V


VOLUME SHADOW COPY - (vssvc.exe) [VSS]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service works in conjunction with the MS Shadow Copy Provider Service, enabling the computer to take a snapshot of a storage volume or shared folder while it is online. That is, a complete and accurate snapshot can be taken of a volume at a given point in time, while it is being accessed by various processes. If you have backup software or you use the Windows Backup utility, you should leave this service set to default settings. It won’t start unless it is needed, so there is no benefit to disabling it if you don’t use backup software.
Guide: Stop, Manual

[Mjölnir]

Service Listing - W (part 1)


WEBCLIENT - (svchost.exe) [WebClient]
Depends on: WebDav Client Redirector
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
WebClient allows Windows and some applications to use the WebDAV (Web-based Distributing, Authoring and Versioning) protocol, which is a set of extensions to HTTP designed for the purpose of creating and manipulating files on a remote storage location, usually on the World Wide Web. Apple’s iDisk service is one such storage system that requires this service to be running. Some dotNET features may also require this feature in order to fully function. If you’re having problems with some MS software that use online features, you might like to try turning this service on. This service has also been known to cause problems with accessing networks on systems without XP Service Pack 2. If you’re experiencing any of the symptoms as described in MS KB Article 832161 you might like to try disabling this service. In most cases this service can be shut down with no ill effect.
Guide: Stop, Disabled


WINDOWS AUDIO - (svchost.exe) [AudioSrv]
Depends on: Plug and Play, Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service supports audio playback within Windows. Disabling it will prevent sounds from being played back through audio devices. If you disable it, most programs that use or create sounds will still operate, but they won’t be able to deliver any audio as such. For example, you might be able to play a movie, but you won’t get the audio. Leave it on default settings.
Guide: Start, Auto


WINDOWS FIREWALL/INTERNET CONNECTION SHARING - (svchost.exe) [SharedAccess]
Depends on: Network Connections, Windows Management Instrumentation
Required by: N/A
XP Home: Auto SP2 ONLY! (see Internet Connection Firewall/Internet Connection Sharing Service)
XP Pro: Auto SP2 ONLY! (see Internet Connection Firewall/Internet Connection Sharing Service)
2K Pro: N/A (see Internet Connection Firewall/Internet Connection Sharing Service)
This service was introduced with the release of Service Pack 2. It provides functionality for the Windows XP Firewall and Windows 2K/XP’s Internet Connection Sharing functionality. It also contributes to network address translation services, along with the Application Layer Gateway Service. In a nutshell, ICF gives your computer basic protection from malicious users and ICS allows multiple computers to use a single internet connection using a single computer as a host or “gateway’ from the network to the internet. By default, internet connections made on your computer will be behind the WinXP firewall and in some cases can fail to function properly if this service is Disabled. Because of it’s close nature to the Application Layer Gateway Service, it is recommended that you leave this service on Auto. Should you choose to not run the Firewall, you can simply open the Properties page on a network connection and under the Advanced option un-check the box in the Internet Connection Firewall text area. Alternatively, global settings can be configured using Group Policy Editor (gpedit.msc) under Computer Configuration > Administrative Templates > Network > Network Connections. Change the Firewall or Connection Sharing setting to Enabled as desired.
Guide: Start, Auto


WINDOWS IMAGE AQUISITION (WIA) - (svchost.exe) [stisvc]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: N/A
This service supports the Windows Image Aquisition (WIA) interface used by Windows and some applications an alternative or replacement to the TWAIN interface. Its purpose is to interact with cameras, scanners and the like to capture or “acquire” images. When some applications are installed that use the WIA interface, especially those with real-time camera detection, they may change the Startup Type of this Service to Automatic. Many imaging devices don’t require the use of the WIA interface, so you might like to try setting it to Stop, Manual and checking if it starts up when you start Windows or use your imaging device. If no programs call this service, it won’t start when set to Stop, Manual, however if something does call it and you’re sure you can use your imaging devices without the WIA interfaces, it should be fairly safe to Disable this service. If you’re having problems with imaging devices, you might like to try setting this service to Automatic.
Guide: Stop, Manual


WINDOWS INSTALLER - (msiexec.exe) [MSIServer]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service provides functionality to software installation packages which use .MSI files. A wide range of installers use Windows installer, ranging from driver installation packages and some Windows updates/hotfixes, through to games and other applications. This service also allows the Add/Remove Programs applet to make use of repair, reinstall and remove options for currently installed software. Some sources suggest to Disable this service if you need to remove the option to install software or modify installed software via its installation tools. In this case, it is recommended that you leave this service on default settings and use security settings in Group Policy and Security Templates to restrict these actions accordingly.
Guide: Stop, Manual


WINDOWS MANAGEMENT INSTRUMENTATION (WMI) SERVICE - (svchost.exe) [Minmgmt]
Depends on: Remote Procedure Call (RPC)
Required by: Security Center, Windows Firewall/Internet Connection Sharing (ICS)
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
Windows Management Instrumentation (WMI) is a set of extensions to the Windows Driver Model and is Microsoft’s implementation of the Web Based Enterprise Management (WBEM) standards, which are in turn based on the Common Interface Model (CIM) standards. The idea of these standards is to provide uniform characteristics in devices and applications by different manufacturers so that they can all be managed in a similar fashion. In short, WMI provides a centralised system of management to a wide range of drivers, services and applications. It also provides event logging services, facilitates various security and permissions features, allows for various system configuration options and also collects and distributes information on request to programs or people both locally or remotely. In short, it is a fundamental service that should not be disabled. The WMI interface can be accessed through the Microsoft Management Console (MMC) or manipulated through various command lines, though the vast majority of users would have no need to access it.
Guide: Start, Auto


WINDOWS MANAGEMENT INSTRUMENTATION DRIVER EXTENSIONS SERVICE - (svchost.exe) [WMI]
Depends on: N/A
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service works in conjunction with the Windows Management Instrumentation (WMI) Service, tracking drivers which are registered or configured to publish WMI information. It only starts if it is needed, and if it is disabled, applications that require it will try and start it again. Leave it on default settings.
Guide: Stop, Manual

[Mjölnir]

Services Listing - W (part 2)


WINDOWS TIME SERVICE - (svchost.exe) [W32Time]
Depends on: N/A
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service allows for the system time to be synchronised with a server of your choice. By default it is configured to a Microsoft server, however this can be altered by going to Control Panel > Date and Time > Internet Time and typing in the address of the server you wish to synchronise with. When this option is used, the synchronisation will take place once every seven days. It is safe to disable this service and you will save yourself a small amount of RAM. If you do disable this service, you’ll either have to set the time manually or use a third party program to synchronise the system time.
Guide: Stop, Disabled


WIRELESS ZERO CONFIGURATION SERVICE - (svchost.exe) [WZCSVC]
Depends on: NDIS Usermode I/O Protocol
Required by: Remote Procedure Call (RPC)
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service enables Windows to facilitate wireless network adaptors, providing options such as the ability to manually or automatically configure wireless networking hardware and also to gather information on available wireless networks, such as signal strength and security mechanisms in use by those networks. Prior to Windows XP Service Pack 2, this utility was in it’s infancy and was renowned for it’s connection and security problems. XP Service Pack 2 introduced significant improvements to Windows’ wireless networking functionality, meaning it is capable of reliably connecting to most typical wireless networks as well as using the typical wireless security protocols available. On some wireless networks, it may not be able to connect reliably, in which case it is recommended that you use the wireless client software provided by the manufacturer of your wireless adaptor. In other cases, the Windows wireless client may be more reliable. Generally the manufacturer’s software is specifically designed for the features of your wireless adaptor and often contains a broader range of configuration options than the Windows wireless client. If you use the manufacturer’s software or don’t have a wireless adaptor in your computer, this service should be Disabled. If you use the Windows wireless client, you will need this service set to Start, Automatic.
Guide: Stop, Disabled


WMDM PMSP SERVICE – (MsPMSPSv.exe) [WMDM PMSP Service]
Depends on: N/A
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service provides support for the SDMI protocol (Secure Digital Music Initiative). It’s pretty much a piracy protection mechanism for Windows Media Player. If you don’t use Media Player’s online facilities and think you can trust yourself to not pirate copyrighted media, you can set this service to Disabled. You can also remove it completely by going to Start Menu > Run and typing "mspmspsv –u" (without the ")
Guide: Stop, Disabled


WMI PERFORMANCE ADAPTOR SERVICE - (wmiapsrv.exe) [WmiApSrv]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: N/A
This service facilitates High Performance WMI Providers. A WMI Provider is a software extension in the form of a DLL file designed to gather specific WMI information. A High Performance WMI Provider is designed to gather the data at a much greater speed than typical WMI Providers. See the Windows Management Instrumentation Service for more details. This service won’t start unless there are HiPerf providers on your system that require it (unlikely), so there is nothing gained by disabling this service.
Guide: Stop, Manual


WORKSTATION SERVICE - (svchost.exe) [lanmanworkstation]
Depends on: N/A
Required by: Alerter, Computer Browser, Messenger, Net Logon, Remote Procedure Call (RPC) Locator
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service is the backbone of Windows’ networking and communications. In a nutshell, it provides support and configuration options for Microsoft Networks and allows the Microsoft Networks interface to use networking hardware. Under Microsoft Networks, will be sent through the Workstation Service and will be redirected to the appropriate local or remote network resource. Without this service, you won’t be able to access the internet, shared files and printers or any other network resource. Some other networking interfaces (perhaps Novell Networks) may be able to function independently of this service. If you wish to remove network functionality, you should remove “Client for Microsoft Networks” from within the properties of any networking adaptors your PC may have. Leave this service on default settings.
Guide: Start, Automatic

[Mjölnir]

Registry Information


This is strictly for advanced users. Altering Registry settings can lead to system instability.

Once you have established suitable settings for your services, you can create a Registry file to make all of the desired changes in one hit. Changing services with a registry file is very handy if you have multiple PC's or if you're sick of going through and manually setting them each time you reinstall Windows. If you do this, I suggest making a batch file to start or stop the services accordingly, since the registry file is unable to do this and sometimes services may remain in a default started state when they are set to Manual or in some cases, a stopped state when they are set to Automatic. Run the batch file before you run the registry file and then restart the PC. This doesn't apply to the Disabled option, since the services should be prevented from starting on subsequent reboots.

The services that you see listed in the Services MMC Snap-in are listed in amongst many other hidden system services. Be very careful about which services you edit and also the registry name of the service. Check and double-check any registry files you create. You can find the services listing in the registry at:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]


Editing a Service

The only thing you should consider altering in the registry for services is the startup type, however you may also like to alter the descripion to something more informative. The startup codes are as follows:

• dword:00000002 = Automatic
• dword:00000003 = Manual
• dword:00000004 = Disabled

Here is a sample code for a registry file that will set the Help and Support Service's Startup type to Manual:

Windows Registry Editor Version 5.00

; Help And Support
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc]
"Start"=dword:00000003

[Mjölnir]

Batch Files


Batch files are also for advanced users, but they are fairly easy to get the hang of. Gamers and Folders might find this handy if they are struggling to squeeze out every last bit of processing power they can. The idea is that just before a game, you run a batch file to stop some services that you know aren’t going to be needed during gameplay and then start them again after you have finished playing your game. As mentioned earlier in the guide, if you think you need to do this. you should install more physical RAM instead. Bear in mind that many services are still needed to support various features of games.

As mentioned in the previous section (Registry Information), you should make a batch file to stop/start services that you're intending to alter with a registry file.

The commands you can use to change the state of a service are:
net pause “SERVICENAME” to pause a running service
net continue “SERVICENAME” to resume a service that has been paused
net stop “SERVICENAME” to stop a running service
net start “SERVICENAME” to start a service that has been stopped

“SERVICENAME” must correspond with the service's Display Name, which can be viewed in the Services Snap-In Tool (services.msc). As an example, to stop the Help and Support Service, the following command line would be put into your batch file:

net stop "Help and Support"

[Mjölnir]

Change Log

011206
Minor changes to Introduction.

281206
Corrected default settings for Logical Disk Manager Service.

080307
Modified Task Scheduler Service information.
Changed recommended setting for Task Scheduler Service.