Mjölnir's Windows 2K and XP Services Guide

[Mjölnir]

Mjölnir's Windows 2000/XP Services Guide

Table Of Contents

Foreword
Introduction
Preparation
Anatomy of a Service
Service Listing Format
Service Listing A
Service Listing B
Service Listing C
Service Listing D
Service Listing E
Service Listing F
Service Listing G - none listed
Service Listing H
Service Listing I
Service Listing J - none listed
Service Listing K - none listed
Service Listing L
Service Listing M
Service Listing N
Service Listing O - none listed
Service Listing P
Service Listing Q
Service Listing R
Service Listing S (part 1)
Service Listing S (part 2)
Service Listing T
Service Listing U
Service Listing V
Service Listing W (part 1)
Service Listing W (part 2)
Service Listing X - none listed
Service Listing Y - none listed
Service Listing Z - none listed
Registry Information
Batch Files

[Mjölnir]

Foreword

I started this guide way back in 'Nam (not really, but it was a long time ago). You all know what it's like to try and squeeze some extra gusto from an old pig of a machine that's running an OS that it probably shouldn’t have running in the first place, right? I wanted to know about turning off services and was fed-up with seeing conflicting information and the all-to-familiar line in the description of many Services (and in several other services guides):

“If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start”

The common mythconception seemed to be that disabling Services was the way to go about regaining some memory and improving system performance. The further I delved into this, the more obvious it was that this was not true.

To cut a long story short, I wanted nitty-gritty details, which meant a crapload of reading that would almost get this guide canned on more than one occasion. Anyway, it’s here now. I’ll put it on a website soon and will probably add more to it. Maybe some pictures, registry/batch files and probably Windows Vista services at some stage.
Enjoy!

Any comments or questions, please visit this thread and post in there. Cheers

____________________________________
| © Mjölnir 2006
| I reserve the rights to all content within this guide
| If you wish to replicate it in part or whole anywhere
| other than PCPerspective/AMDMB Forums, you must
| obtain my permission prior to doing so.

[Mjölnir]

Introduction


What are Services?

Windows Services are background applications that provide support to a wide range of features that Windows offers. Almost all services provide support to other applications (including other services) or they facilitate interaction with hardware. Applications can include those within Windows or even third-party software like antivirus programs and networking software. Hardware interaction includes not so important CD burning features through to essential support for hard drives and device configuration.


Should I Disable Services?

There’s a common myth-conception among PC enthusiasts that disabling as many services as possible will improve performance by freeing RAM and CPU resources for use by other programs, like games. The reality is that disabling services provides very little gain in terms of real world performance and doing so can have a detrimental effect on the system through instability or the inability of Windows to perform certain operations. If you’re resorting to disabling services for more RAM, you should install more physical RAM rather than “tweak” the services.

It’s true that some services are often targeted by malicious exploits, and that shutting down some of these services will close off potential security holes. This helps bolster security but is only one small step towards safer computing. Extra protection is recommended. Windows Updates fix a range of known security flaws across the Windows OS, including immunisation for services against certain exploits. Using firewalls, anti-virus, anti-spyware and anti-adware software are some other great ways to bolster security. Don’t forget to keep them updated! For a detailed report on how you can better protect your system, check out this detailed Spyware, Trojans and Viruses sticky thread.

This guide aims to give you a better idea of the roles various services play and whether it’s safe to stop them or if you’re likely to benefit from disabling them. Because of the integral role of services to the Windows user environment, great caution should be exercised when manipulating services. It’s also strongly recommended that you read various services guides for more information on each service.


Additional Information

Changing the settings of services is not recommended, however should you choose to alter your services from settings other than default, you do so at your own risk!!

• Networked computers run a greatly increased risk of encountering problems through mis-management of services.
• When changing services settings, only change one or two at a time.

If you are having a problem with a service, shutting it down is NOT a solution. What you should do is update your virus protection software and run it; search for solutions to your problem through the Microsoft Knowledge Base (KB) Support pages or Google. For more information on a problematic service, browse the Event Log (Start Menu > Run and type eventvwr.msc) for the service errors and then search using the error codes where applicable.

Various forms of malicious software (eg. trojans) are designed to hijack or mimick Windows services. If you suspect this has happened to you, compare the service’s name and executable name with the name of the executable or service that you suspect is malicious.

Windows Updates can include patches that immunise services from various exploits. Keep your system up to date with any “critical updates” available. There should be a Windows Update icon in the Start Menu or alternatively you can open Start Menu > Run and type wupdmgr.

Windows XP Service Pack 2 introduced some major changes to the structure of Windows Services. Some new services have been added and some existing services serve different purposes than they did prior to installing XP SP2 or have been removed completely. I’ve factored this into this guide as best as I can.

[Mjölnir]

Preparation

In case of disaster it is always a good idea to prepare recovery, in the hope of a fair chance of recovery.

Before editing services, you should be well prepared to return your computer to its original state. For a start, you should only manipulate one or two services at a time and you should keep a record of the default services settings. You can find those details here.

There are several things you can do to prepare your computer for changing services. They are prioritised – meaning that the first option will provide you with the best chance of a full recovery and the last choice will provide the least chance of recovery:

1. Create a backup image of the Windows partition or use the backup software for Windows XP (ntbackup.exe), run the Backup Wizard and back-up “Everything” or “Selected files, drives or network data…” (select the Windows Drive - C Drive). If you have a second drive or partition, you should store your backup file there. Before you perform this step, it is an idea to turn off any Software Firewalls or Antivirus software you may have running. Depending on the amount of data on your drives, this process could be quite lengthy.
2. Using System Restore, create a Restore Point. System Restore can be found in Start Menu > Programs > Accessories > System Tools. This option is less effective than a full back-up, however it does record the current state of the registry. Rolling back to this restore point and then restarting the PC should return your services to the state they were in prior to changing them.
3. If you are familiar with Windows Registry, use Regedit to export the following branch (highlight the Services key and use “Export” on the right-click menu: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
   If you need to restore the services again, you can double-click the REG file that has been created and reboot your PC. On restart, your services should be set up as they were before you started modifying them.

[Mjölnir]

Anatomy of a Windows Service


If you double-click a service in the Services Snap-in Utility, you will notice that there are four tabs: General, Log On, Recovery and Dependencies. This guide only covers the General and Dependencies tabs.


General Tab
This is the first of the four tabs. In here you will notice “Display Name”, “Description”, “Path to executable”, “Startup type”, “Service status” and some buttons (Start, Stop, Pause, Resume).

Display Name is to show the name of the current service you are viewing. The names in the list below should correspond with this name. If the name of the service is not in the list below, then it is a third party service, in which case you should hunt down details from Google or from the company that made the service.

Description is generally ambiguous, and contains warnings about shutting the service down. This indicates to me that MS don’t condone fiddling with services.

Path to executable shows the name of the executable and the process, service or window (DLL) it is associated with. Using the Task Manager’s Processes tab, you can get a vague understanding of the resource usage of this service. The information in this window can also serve as a reference in troubleshooting service problems.

Startup type offers three choices to determine if/when Windows will start a service:

• Automatic – allows the service to be automatically started at boot – if Windows chooses to start them (not all services set to Auto will start at bootup). Several services NEED to be on Auto in order to work properly (ie Remote Procedure Call). If you notice a Service that is set on Manual and it is starting on boot, this could mean that dependencies between it and another service are causing it to start. If this is the case, you should check if the default setting for that service is "Automatic" and restore it to default configuation.
• Manual – allows the service to be started on demand. “Manual” doesn't mean “user control”. It simply means that the service may be able to start, but isn't initialised when Windows boots. This option can be useful in reducing boot times, provided that the service is not essential to the everyday operation of the system. A good example of this is the Help and Support Service, which isn't used during every session. If it is stopped and set to Manual it won't start every time you load windows, but will still be able to start if you need to use the Help and Support tool.
• Disabled – prevents the service being loaded. You cannot Start or Stop a service that is Disabled. The ”Disabled” setting should exclusively for dealing with security issues – otherwise you should never have to use Disabled. Manual should be used if you want to stop a service booting at startup.

Service Status indicates whether the service is running or not.

The Start button allows you to start a service that is not running, and is not disabled.
The Stop button allows you to completely halt a service that is running.
The Pause button allows you to pause a service that is running.
The Resume button allows you to resume a paused service.


Dependencies Tab

This is the last tab on each Service's properties. It states which other services the currently selected service is dependent on or required by. The two panes are titled as follows:

• This service depends on the following System components - (depends on)
• The following System components require this service - (required by)

Particular attention needs to be paid to service dependencies. There may only be one service listed in the “required by” section, but that service in turn may be required by other services. This means that the current service may be indirectly required by more than one service and needs to be running for all of those services to be able to start. If a listed dependency service has a “+” sign next to it, click the “+” sign to see further dependency relationships for that service.

Some software may depend on two or more services that aren’t dependent on each other according to the Services properties. Some services only need to initiate only for the time it takes to perform a particular function (they might be started briefly during the Windows boot process and not start again for the rest of the session). On the same token, you may not notice if/when services start or not. Not having seen a service in operation isn’t good reason to assume that it is not a necessary service.


TIP: You can drag the Description field to the far right, so that Name, Status and Startup Type can be more easily viewed.

[Mjölnir]

Service Listing Format


SERVICE NAME - (Service Executable File) [Service Registry Name]

Depends on: Direct Dependencies
Required by: Direct Dependencies

XP Home: Default startup type
XP Pro: Default startup type
2K Pro: Default startup type

Description of the service.

Guide: Recommended settings

[Mjölnir]

Service Listing - A


ALERTER - (XP:svchost.exe | 2K:services.exe) [Alerter]
Depends on: Workstation
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
Alerter provides functionality for pop-up messages. The messages are predominantly for network use, though they can be utilised by the user in conjunction with some other features within Windows to provide warnings or alerts. If you are on a network that uses a pop-up message system, you may need to set this service to Automatic or Manual. If this service is disabled and you have issues with a website or network-based program, try starting this service.
Guide: Stop, Disabled


APPLICATION LAYER GATEWAY SERVICE - (alg.exe) [ALG]
Depends on: N/A
Required by: Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS) (Pre - SP2 ONLY!)
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
Provides third-party protocol plug-ins for Internet Connection Sharing and Internet Connection Firewall. Software that requires the access to the Internet may also require this service.
Guide: Start, Manual


APPLICATION MANAGEMENT - (svchost.exe) [AppMgmt]
Depends on: N/A
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
Provides functionality for various software services such as Windows Installer and Active Desktop. If it is disabled, problems may occur with installation or removal of software or with other features of software manipulation.
Guide: Start, Manual


ASP .NET STATE SERVICE - (aspnet_state.exe) [aspnet_state]
Depends on: N/A
Required by: N/A
XP Home: SP2 ONLY! Manual
XP Pro: SP2 ONLY! Manual
2K Pro: N/A
ASP .NET session states allow for user specific data to be stored on a network server. The data is then used by web-based applications accessed by the user to undertake certain operations available to the user. An example might be an online game, where your settings are stored on the server. When you access the game, ASP .NET State Service may be used to access your settings. It won’t start unless it is required, so leaving it on it’s default setting is fine.
Guide: Stop, Manual


AUTOMATIC UPDATES - (svchost.exe) [wuauserv]
Depends on: N/A
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service is used to log onto Windows Update to download and install security patches and hotfixes using Windows Update and Microsoft Update. It also alerts users when critical updates are available. This service can be stopped and disabled without adversely affecting Windows performance, though you will not be able to use Automatic Updates and you will not receive alerts unless it is running. Critical updates which patch security flaws are frequently released. Because of this, it is strongly recommended that you leave this service on the default settings.
Guide: Start, Auto

[Mjölnir]

Service Listing - B


BACKGROUND INTELLIGENT TRANSFER SERVICE - (XP:svchost.exe | 2K:services) [BITS]
Depends on: Remote Procedure Call (RPC), Workstation
Required by: N/A
XP Home: Auto
XP Pro: Auto (Manual in SP2)
2K Pro: Auto
Provides auto-resume functionality for downloads using some Microsoft software. It also provides support for asynchronous transfers using the HTTP 1.1 protocol. Windows XP Service Pack 2 includes a Download Manager for Internet Explorer. When SP2 arrives, it may be worth setting this service to Automatic.
Guide: Stop, Manual

[Mjölnir]

Service Listing - C


CLIPBOOK - (clipsrv.exe) [ClipSrv]
Depends on: Network DDE
Required by: N/A
XP Home: Manual
XP Pro: Manual (Disabled in SP2)
2K Pro: Manual
Allows users on a network to share information using a “cut-and-paste” method - a bit like using a whiteboard. Disabling this service prevents others from viewing this data, which also provides added security over networks. If you wish to use this feature, set it to Stop, Manual.
Guide: Stop, Disable


COM+ EVENT SYSTEM - (svchost.exe) [EventSystem]
Depends on: Remote Procedure Call (RPC)
Required by: System Event Notification
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service works in conjunction with the System Event Notification Service (SENS), which in turn works with Event Log. Windows uses SENS to track various system events, such as logons and network activity. In addition, it has an Event Class Object to support events made in programming. If you are programming at this level, you should understand the importance of COM+ Event System. If you're experiencing network problems, you should check that this service is running.
Guide: Start, Manual


COM+ SYSTEM APPLICATION - (dllhost.exe) [COMSysApp]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
As the name suggests, this one is tied in with COM+ Event System Service and is also responsible for cataloguing, registering and providing other support for Component Object Model (COM+) based components. It is an important feature of .NET, allowing remote execution of some application procedures across a network also plays an important role for handling objects in some programming applications. This service uses dllhost.exe which can be easily exploited by malicious individuals or software. If you are running BootVIS, you might like to make sure this service is running.
Guide: Stop, Manual


COMPUTER BROWSER - (svchost.exe) [Browser]
Depends on: Server, Workstation
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service maintains a list of computers and other resources on your network. The list is predominantly for a host computer, though it may have it’s advantages on client computers and peer-to-peer networks that rarely change. If you are not on a network, then it not needed. Even if it is switched off on a network, you should be able to browse the network.
Guide: Stop, Manual


CRYPTOGRAPHIC SERVICES - (svchost.exe) [CryptSvc]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service essentially manages Signatures for Windows files (such as drivers) and also manages Certificates used by your computer and certificates for other computers on secured sites. If you use Windows Update, do any internet banking or even manage files on another site (like your website), then this service is pretty much required.
Guide: Start, Auto

[Mjölnir]

Service Listing - D


DCOM SERVER PROCESS LAUNCHER SERVICE - (svchost.exe) [DcomLaunch]
Depends on: N/A
Required by: N/A
XP Home: N/A
XP Pro: Auto SP2 ONLY!
2K Pro: N/A
With the introduction of XP Service Pack 2, the Remote Procedure Call (RPC) service was split into two services – one to handle local activity and one to handle remote activity. Prior to SP2, the RPC service was subject to a wide range of exploitation due to its integral relationship with many aspects of Windows. One theory behind the split is that if the RPC service is exploited, offenders would have limited access to the machine. Many services depend on the RPC service and now that it has been split into two, some of those services now depend on the DCOM Server Process Launcher, although (inexplicably) no dependencies are listed for it. Some features that rely on this service include Windows Firewall, Disk Management, Disk Defragmenter, InstallShield, System Information and Media Player 10 (burning). After disabling this service, you are likely to see error messages along the lines of “The RPC server is unavailable” or “A network error occurred in connecting to Windows Management Instrumentation”. This is an essential service - do not disable it!
Guide: Start, Auto


DHCP CLIENT – (svchost.exe) [Dhcp]
Depends on: AFD Networking Support Environment, NetBIOS over TCP/IP, TCP/IP Protocol Driver
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service allows your computer to be allocated with a dynamic IP address, which applies to most internet users. The service works with your DHCP server to obtain and update not only a dynamic IP address, but also Domain Name System (DNS) Server information. The only exceptions to this would be if your computer is not used to connect to the Internet AND is not part of a network.
Guide: Start, Auto


DISTRIBUTED LINK TRACKING CLIENT – (svchost.exe) [TrkWks]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
Basically, if you have are on a network of computers using NT File System (NTFS) and you make a link to a file then move that file to another computer on the network, this service will update the link so you can have up-to-date links to such files. If you’re using a FAT File System and are not part of a network, then it is safe to stop this service. If you are on a large network and are using NTFS, then you should leave this service on Automatic. If you’re on a home network, and move files around from one computer to another, you might find this service handy.
Guide: Stop, Manual


DISTRIBUTED TRANSACTION COORDINATOR – (msdtc.exe) [MSDTC]
Depends on: Remote Procedure Call (RPC), Security Accounts Manager
Required by: Microsoft Message Queuing
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service coordinates transactions for things such as message queuing, transactions over varying flie systems and complex databases. If you are on a large network, you probably should have this set to Start, Auto. Your company’s Network Administrators should be able to tell you if the network uses it. Otherwise, the default setting should be adequate.
Guide: Stop, Manual


DNS CLIENT – (svchost.exe) [Dnscache]
Depends on: TCP/IP Protocol Driver
Required by: IPSEC Services
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
This service resolves and caches Domain name System (DNS) names and also helps locate Active Directory domain controllers. Typically, if you are not on a Domain, you will not need this service – your computer will just ask further up the chain for resolution if it has to. However, if your internet connection requires that you specify DNS Server addresses, you should have this service running. If you use IPSEC Services, you will definitely need this service running. If you receive a message saying "DNS resolver failed to flush the cache", then you will need to start this service.
Guide: Stop, Manual

[Mjölnir]

Service Listing - E


ERROR REPORTING SERVICE – (svchost.exe) [ERSvc]
Depends on: Remote Procedure Call (RPC)
Required by: IPSEC Services (Pre XP SP2 only)
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service is self-explanatory. If your system receives an error of some kind, it provides the functionality to report the error to Microsoft, or to another source, depending on how you have configured this service. The reports are sent for the purpose of troubleshooting, though many Windows users view this feature as a compromise to privacy and security. If you can see yourself benefiting from this service, set it to Stop, Manual.
Guide: Stop, Disable


EVENT LOG – (svchost.exe) [Eventlog]
Depends on: N/A
Required by: Windows Management Instrumentation
XP Home: Auto
XP Pro: Auto
2K Pro: Auto
Event Log cannot be stopped, so don’t disable it. Even if you do manage to disable it, your system will most likely take significantly longer to boot into Windows. This service provides functionality for logging system events such as logging in and out, changes in service state, system and application errors. Many errors are listed using the event log, without the user knowing there is a problem. You can view the event log by typing eventvwr.msc in the Start Menu’s Run command box.
Guide: Start, Auto

[Mjölnir]

Service Listing - F


FAST USER SWITCHING COMPATIBILITY – (svchost.exe) [FastUserSwitchingCompatibility]
Depends on: Terminal Services
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service is a gem if more than one user uses the same machine. Combined with Terminal Services, it allows a user to leave the computer, preserving the state that they had left it, and allow a second or third user to log in. If you’re a single user, and if you prefer the “Classic” Windows layout, you can set this service to Stop, Manual. Before you stop it, you might like to go to Control panel > User Accounts then select Change the way users log on or off and uncheck the Use Fast User Switching option.
Guide: Start, Auto


FAX – (fxssvc.exe) [Fax]
Depends on: Plug and Play, Print Spooler, Remote Procedure Call (RPC), Telephony
Required by: N/A
XP Home: Not installed by default
XP Pro: Not installed by default
2K Pro: Not installed by default
This service is not installed on Windows by default, though if you do install Fax functionality so you can use your computer to send and receive faxes, this service will appear. It may appear if you install some fax-capable hardware such as a Fax-Modem. If you are never going to use your computer to send faxes, I suggest that you remove it using Control Panel > Add/Remove Programs > Add/Remove Windows Components. If you use faxes regularly, I suggest that you set this service to Start, Auto.
Guide: Stop, Manual

[Mjölnir]

Services Listing - H


HELP AND SUPPORT – (svchost.exe) [helpsvc]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Auto
XP Pro: Auto
2K Pro: N/A
This service manages the “Help and Support” function on your computer. It also connects to Microsoft’s online help support documentation sites should you click on anything in “Help and Support” that requires the online documentation. If you set this to Disabled, it will prevent access to the “Help and Support” function, however some sources claim that it will reset itself to Auto. If you set it to Stop, Manual, it should not start when windows starts, and will only start when you use the “Help and Support” function and not every time Windows starts. Before Windows XP Service Pack 2, the Help and Support function relied on the operation of the Upload Manager Service.
Guide: Stop, Manual


HID INPUT SERVICE – (svchost.exe) [HidServ]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Disabled
XP Pro: Disabled
2K Pro: N/A
This service manages Human Interface Devices, such as some Mice, Joysicks, Internet Keyboards, Scanners, and other assorted peripherals that may have assignable buttons or controls for user input. If these devices are assigned particular functions (like a joysick being assigned with keyboard shortcuts), then this service may be required. It's quite likely that you do have a device like this or will use one at some point. If you are having problems with an HID peripheral, try setting it to Start, Auto. As a side note, some devices can change their predefined input buttons when this service is set to Start, Auto, so if you have a fancy keyboard or mouse, try setting this to Start, Auto to see if there are any changes to the button’s functionality.
Guide: Stop, Disabled


HTTP SSL - (svchost.exe) [HTTPFilter]
Depends on: HTTP Driver
Required by: N/A
XP Home: N/A
XP Pro: Manual SP2 ONLY!
2K Pro: N/A
"This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL)." HTTP SSL is another service introduced with XP Service Pack 2 that manages security between your PC and secure websites or other applications that use HTTPS technology. It’s recommended that this service be left on default settings and not disabled.
Guide: Stop, Manual

[Mjölnir]

Services Listing - I


IMAPI CD-BURNING COM SERVICE – (imapi.exe) [ImapiService]
Depends on: N/A
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: N/A
This service allows Windows XP to burn CD’s itself. If you have third-party burning software (like Nero Burning ROM or Adaptec Easy CD Creator), then there is no need to use this service – your PC will still be able to burn without it running. If you can’t burn with your third-party software, try setting this to Auto or Disabled (it may interfere with your burning software if you are using Windows XP without Service Pack 2).
Guide: Stop, Manual


INDEXING SERVICE – (cisvc.exe) [CiSvc]
Depends on: Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service indexes various details of the structure of data and files on your partitions. The purpose of indexing is to create a faster means of finding specific files by using a query language – very much like using a database. You can configure which directories it indexes by going to Start Menu > Run and typing ciadv.msc in the box, then go into System > Directories and configure as you like. Adding directories to this will cause the Indexing Service to start each time you boot into Windows. If you don’t want to use this service, I recommend that you remove the listed directories and then set the service to Stop, Manual. Alternatively, you can go to Control Panel > Add/Remove Programs, then click on Add/Remove Windows Components and remove it that way. For a home system, this service will probably never be used.
Guide: Stop, Manual


INTERNET CONNECTION FIREWALL (ICF) / INTERNET CONNECTION SHARING (ICS) – (svchost.exe) [SharedAccess]
Depends on: Application Layer Gateway, Network Connections, Network Location Awareness (NLA), Remote Access Connection Manager
Required by: N/A
XP Home: Manual (N/A in SP2 – see Windows Firewall/Internet Connection Sharing Service)
XP Pro: Auto (N/A in SP2 – see Windows Firewall/Internet Connection Sharing Service)
2K Pro: Auto (Only ICS is available)
This service was renamed in Windows XP with the introduction of Service Pack 2. It provides functionality for the Windows XP Firewall and Windows 2K/XP’s Internet Connection Sharing functionality. It also contributes to network address translation services, along with the Application Layer Gateway Service. In a nutshell, ICF gives your computer basic protection from malicious users and ICS allows multiple computers to use a single internet connection using a single computer as a host or “gateway’ from the network to the internet. By default, internet connections made on your computer will be behind the WinXP firewall and in some cases can fail to function properly if this service is Disabled. Because of it’s close nature to the Application Layer Gateway Service, it is recommended that you leave this service on Auto. Should you choose to not run the Firewall, you can simply go to Start > Settings > Network Connections, then go to Properties > Advanced on the desired connection and un-check the box in the Internet Connection Firewall text area. Alternatively, global settings can be configured using Group Policy (gpedit.msc) under Computer Configuration > Administrative Templates > Network > Network Connections. Change the Firewall or Connection Sharing setting to Enabled as desired.
Guide: Start, Auto


IPSEC SERVICES - (lsass.exe) [PolicyAgent]
Depends on: IPSEC Driver, Remote Procedure Call, TCP/IP Protocol Driver
Required by: N/A
XP Home: Manual
XP Pro: Auto
2K Pro: Auto
This service supports various security functions on your PC and for networks such as authentication of some types of accounts and also encryption services. LSASS stands for Local Security Authentication Server Service. It has been the subject of various nasty viruses, including the “Sasser” virus. It is strongly recommended that you visit the Microsoft site and download the relevant updates to protect your PC against “Sasser”. If the “lsass.exe” file is in any place other than c:\windows\system32 or c:\WINNT\system32, it is possible that your PC may have contracted a worm such as “Nimos”. If you are on a network that requires special security functions, leave this on Auto.
Guide: Stop, Manual

[Mjölnir]

Services Listing - L


LOGICAL DISK MANAGER - (svchost.exe) [dmserver]
Depends on: Plug n’ Play, Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Auto
2K Pro: Auto
This service detects and monitors new hard drives that may be installed on your system, internal or external. It sends disk volume information, such as partition details to the Logical Disk Manager Administrative Service in the case of configuration changes. In any case, this service should be left on Auto.
Guide: Start, Auto


LOGICAL DISK MANAGER ADMINISTRATIVE SERVICE - (dmadmin.exe) [dmadmin]
Depends on: Logical Disk Manager, Plug n’ Play, Remote Procedure Call (RPC)
Required by: N/A
XP Home: Manual
XP Pro: Manual
2K Pro: Manual
This service is used to configure hard disks and volumes. It’s only needed as changes are made to the hard drives and then it stops, however, because of it’s close relation to Logical Disk Manager Service, it needs to be able to run when changes are required. Use Manual.
Guide: Stop, Manual