Print Spooler Service 31 Protected Storage Service 32 QoS RSVP Service 32 Remote Access Auto Connection Manager Service 33 Remote Access Connection

Transcription

1 INDEX INDEX 1 Services Guide for Windows XP 3 Please Read These s Relative To The Services Guide! 3 General tab 5 Log On Tab 6 Recovery tab 7 Tab 8 Explanation table set up for each service 9 GET TO THE LIST SERVICES 11 GET TO THE LIST PROCESSES NAME 12 Alerter Service 13 Application Layer Gateway Service 13 Application Management Service 13 Automatic Updates Service 14 Background Intelligent Transfer Service 14 ClipBook Service 15 COM+ Event System Service 15 COM+ System Application Service 16 Computer Browser Service 16 Cryptographic Services Service 17 DCOM Server Process Launcher 17 DHCP Client Service 18 Distributed Link Tracking Client Service 18 Distributed Transaction Coordinator Service 19 DNS Client Service 19 Error Reporting Service 20 Event Log Service 20 Fast User Switching Compatibility Service 21 Help and Support Service 21 Human Interface Device Access [SP2 Terminology] HID Input Service [Pre SP2 Terminology] 22 HTTP SSL 22 IMAPI CD-Burning COM Service 23 Indexing Service 23 Internet Connection - Firewall (ICF) / Sharing (ICS) Service 24 IPSEC Services Service 24 Logical Disk Manager Service 25 Logical Disk Manager Administrative Service 25 Machine Debug Manager Service 25 Messenger Service 26 MS Software Shadow Copy Provider Service 26 Net Logon Service 27 NetMeeting Remote Desktop Sharing Service 27 Network Connections Service 28 Network DDE Service 28 Network DDE DSDM Service 28 Network Location Awareness (NLA) Service 29 Network Provisioning Service 29 NT LM Security Support Provider Service 29 Performance Logs and Alerts Service 30 Plug and Play Service 30 Portable Media Serial Number Service 31 1

2 Print Spooler Service 31 Protected Storage Service 32 QoS RSVP Service 32 Remote Access Auto Connection Manager Service 33 Remote Access Connection Manager Service 33 Remote Desktop Help Session Manager Service 33 Service 34 Locator Service 34 Remote Registry Service 35 Removable Storage Service 35 Routing and Remote Access Service 36 ScriptBlocking Service 36 Secondary Logon Service 37 Security Accounts Manager Service 37 Security Center 38 Server Service 38 Shell Hardware Detection Service 39 Smart Card Service 39 Smart Card Helper Service 39 SSDP Discovery Service 40 System Event Notification Service 40 System Restore Service 41 Task Scheduler Service 41 TCP/IP NetBIOS Helper Service 42 Telephony Service 42 Telnet Service 43 Terminal Services Service 43 Themes Service 44 Uninterruptible Power Supply Service 44 Universal Plug and Play Device Host Service 45 Upload Manager Service 45 Volume Shadow Copy Service 46 WebClient Service 46 Windows Audio Service 47 Windows Firewall/Internet Connection Sharing (ICS) 47 Windows Image Acquisition (WIA) Service 48 Windows Installer Service 48 Windows Management Instrumentation Service 48 Windows Management Instrumentation Driver Extensions 49 Windows Time Service 49 Wireless Zero Configuration Service 49 WMI Performance Adapter Service 50 Workstation Service 50 2

3 Services Guide for Windows XP When I first sketched out the rough draft of what I wanted to include in The Elder Geek I wasn't going to have a section dealing with Services. There are a ton of sites out 'there' that go into excruciating detail on how to extract the last ounce of performance by fiddling with the default XP services. A few hundred s later from readers wanting to know why I didn't have a services section, here it is, ready for you to peruse. Frankly, I don't recommend you change any of the services from the default installation of XP. Yes, you may pick up a tiny performance gain by fiddling with the settings, but it won't be anything substantial. It's just my opinion, but if you are in a situation where these gains are necessary to achieve an increased level of system performance, it would be wiser to upgrade the physical system to one that is adequate to benefit from the XP operating system. Please Read These s Relative To The Services Guide! - Changing services settings can be just as dangerous as editing the registry. Have current -testedbackups of your system/data and understand how to restore them if something goes terribly wrong. - I have not broken down the settings into different 'configurations' for purposes such as game playing, etc. This seems pointless to me since each system is unique and requires configuring differently. - To edit the value for a service, launch services.msc from the Run option on the Start Menu. - The recommendations I've made regarding each service are based solely on my personal experience. What I've found or what works for me may bear no relation to what works for you. What are services? By definition, it's a program that runs invisibly in the background. But can't the same thing be said for a number of programs that run in the background such as anti-virus programs? Yes, but the real difference is that services load and start running whether or not anyone logs into the computer, unlike a program that is launched from the Startup Folder under All Programs. There are two ways to view Services on your computer. The first is to use the MS Configuration Utility by typing msconfig.exe in the Run box accessed via the Start Menu, followed by clicking the Services tab. If you want a quick visual of which items are running or stopped, this is fine, but the information is limited. The preferred way to make changes to services is to launch services.msc from the Run option on the Start Menu. The Services window shown below will open. Looking at the Services window you can see it has columns for Name,, Status, Startup Type and Log On As. This provides a quick overview of all the services on your computer. Detailed information is available by clicking any of the entries. The four captures below show the property sheet, by tabs, for the Alerter Service. 3

4 General Tab Log On Tab Recovery Tab Tab 4

5 General tab 5

6 Log On Tab 6

7 Recovery tab 7

8 Tab 8

9 Explanation table set up for each service The table below illustrates how I've set up the information for each service. Service Name Alerter Process Name services.exe Real World Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. Workstation If you're part of a network that sends and receives administrative alerts this service is for you. Microsoft has assigned what they call a Display Name to each service. I've used that name to create the Services Index. It is the same name that appears in the Name column in the Services Window. Supposedly this name can be changed on the General tab if you want something more descriptive. Service Name - The name the service is actually called. This name is often quite cryptic while at other times easily identifiable. It comes from the General tab and cannot be modified. Process Name - The name of the actual process that is run when the service is activated. As you go through the services you'll no doubt wonder why svchost.exe is listed so many times as being the Process Name. The explanation can be found here. The Process Name is taken from the General tab. Default Settings - These are the default settings for the Home and Professional versions of XP when a clean installation is performed. - This is taken directly from the General tab. Some of the descriptions are easily understood while others make no sense at all to the average (or any other) user. - Lists any additional services that are required for the service to run. The information is taken from the tab. Real World - If I felt the was a bit vague or needed some clarification this is where I tried to give you a better idea of what the service does or why you might want it loaded. Is This Service Needed? - There are three choices here and I stress that these are strictly my opinion. A Yes means I believe it's essential to have this service running and set to Automatic. A Possibly means that depending on your hardware and software choices this service might be one you choose to have enabled. It might have an Automatic, Manual, or Disabled setting. A No means that I see no point in wasting the resources on the service and that your system shouldn't suffer any ill effects by having it disabled. It will have a Disabled Setting. Recommended Setting - Again, these are my opinions only, but I feel that for most situations this setting will give you a good balance between system functionality and resource conservation. - Anything else I want to toss in I think you might find helpful. 9

10 What's The Number One Question Asked About Services? Without a doubt the most asked question is what is svchost.exe and why is it running so many times at once. That's a fair question, especially if you've looked in Task Manager and seen it listed three or four times, each instance gobbling up memory. The official answer, straight from the mouth of Microsoft is: "Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs)." I know; that didn't tell you one whole hell of a lot, but if you really want to know more about it and why it appears so many times concurrently, KB Article Q is just a click away for the answers. Happy (boring) reading. A of svchost.exe in Windows XP 10

11 GET TO THE LIST SERVICES Alerter Service Application Layer Gateway Service Application Management Service Automatic Updates Service Background Intelligent Transfer Service ClipBook Service COM+ Event System Service COM+ System Application Service Computer Browser Service Cryptographic Services Service DCOM Server Process Launcher DHCP Client Service Distributed Link Tracking Client Service Distributed Transaction Coordinator Service DNS Client Service Error Reporting Service Event Log Service Fast User Switching Compatibility Service Help and Support Service HID Input Service HTTP SSL IMAPI CD-Burning COM Service Indexing Service Internet Connection - Firewall (ICF) / Sharing (ICS) Service IPSEC Services Service Logical Disk Manager Service Logical Disk Manager Administrative Service Machine Debug Manager Service Messenger Service MS Software Shadow Copy Provider Service Net Logon Service NetMeeting Remote Desktop Sharing Service Network Connections Service Network DDE Service Network DDE DSDM Service Network Location Awareness (NLA) Service Network Provisioning Service NT LM Security Support Provider Service Performance Logs and Alerts Service Plug and Play Service Portable Media Serial Number Service Print Spooler Service Protected Storage Service QoS RSVP Service Remote Access Auto Connection Manager Service Remote Access Connection Manager Service Remote Desktop Help Session Manager Service Service Locator Service Remote Registry Service Removable Storage Service Routing and Remote Access Service ScriptBlocking Service Secondary Logon Service Security Accounts Manager Service Security Center Server Service Shell Hardware Detection Service Smart Card Service Smart Card Helper Service SSDP Discovery Service System Event Notification Service System Restore Service Task Scheduler Service TCP/IP NetBIOS Helper Service Telephony Service Telnet Service Terminal Services Service Themes Service Uninterruptible Power Supply Service Universal Plug and Play Device Host Service Upload Manager Service Volume Shadow Copy Service WebClient Service Windows Audio Service Windows Firewall/Internet Connection Sharing (ICS) Windows Image Acquisition (WIA) Service Windows Installer Service Windows Management Instrumentation Service Windows Management Instrumentation Driver Extensions Windows Time Service Wireless Zero Configuration Service WMI Performance Adapter Service Workstation Service 11

12 GET TO THE LIST PROCESSES NAME alg.exe cisvc.exe clipsrv.exe dllhost.exe (COMSysApp) dllhost.exe (SwPrv) dmadmin.exe /com imapi.exe lsass.exe (PolicyAgent) lsass.exe (Netlogon) lsass.exe (NtLmSsp) lsass.exe (ProtectedStorage) lsass.exe (SamSs) locator.exe mdm.exe mnmsrvc.exe msdtc.exe msiexec.exe /V netdde.exe (NetDDE) netdde.exe (NetDDEdsdm) rsvp.exe SCardSvr.exe (SCardSvr) SCardSvr.exe (SCardDrv) services.exe (Eventlog) services.exe (PlugPlay) sessmgr.exe smlogsvc.exe spoolsv.exe svchost.exe (EventSystem) svchost.exe (helpsvc) svchost.exe (SharedAccess) svchost.exe (dmserver) svchost.exe (WmdmPmSp) svchost.exe (SSDPSRV) svchost.exe (uploadmgr) svchost.exe k (Alert) svchost.exe k (HTTPFilter) svchost.exe k (RemoteRegistry) svchost.exe k (LmHosts) svchost.exe k (upnphost) svchost.exe k (WebClient) svchost -k DcomLaunch (DcomLaunch) svchost -k DComLaunch (TermService) svchost.exe -k imgsvc svchost -k rpcss svchost.exe -k netsvcs (AppMgmt) svchost.exe -k netsvcs (Wuauserv) svchost.exe -k netsvcs (BITS) svchost.exe -k netsvcs (Browser) svchost.exe -k netsvcs (CryptSvc) svchost.exe -k netsvcs (Dhcp) svchost.exe -k netsvcs (TrkWks) svchost.exe -k netsvcs (ERSvc) svchost.exe -k netsvcs (FastUser Switching Compatibility) svchost.exe -k netsvcs (HidServ) svchost.exe -k netsvcs (Messenger) svchost.exe -k netsvcs (Netman) svchost.exe -k netsvcs (Nla) svchost.exe -k netsvcs (xmlprov) svchost.exe -k netsvcs (RasAuto) svchost.exe -k netsvcs (RasMan) svchost.exe -k netsvcs (NtmsSvc) svchost.exe -k netsvcs (RemoteAccess) svchost.exe -k netsvcs (seclogon) svchost.exe -k netsvcs (wscsvc) svchost.exe -k netsvcs (lanmanserver) svchost.exe -k netsvcs (ShellHWDetection) svchost.exe -k netsvcs (SENS) svchost.exe -k netsvcs (srservice) svchost.exe -k netsvcs (schedule) svchost.exe -k netsvcs (TapiSrv) svchost.exe -k netsvcs (Themes) svchost.exe -k netsvcs (AudioSrv) svchost.exe -k netsvcs (SharedAccess) svchost.exe -k netsvcs (Minmgmt) svchost.exe -k netsvcs (Wmi) svchost.exe -k netsvcs (W32Time) svchost.exe -k netsvcs (WZCSVC) svchost.exe -k netsvcs (lanmanworkstation) svchost.exe -k NetworkService tlntsvr.exe ups.exe vssvc.exe wmiapsrv.exe 12

13 Alerter Service Service Name Alerter Process Name svchost.exe -k LocalService Real World XP Pro w/sp2 : Disabled Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. Workstation If you're part of a network that sends and receives administrative alerts this service is for you. Is this service needed? Possibly Recommended Setting: Disabled Application Layer Gateway Service Service Name ALG Process Name alg.exe Real World Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall. One of the bits and pieces you need if you connect to the internet using Microsoft's Internet Connection Sharing or Internet Connection Firewall, Application Management Service Service Name AppMgmt Process Name svchost.exe -k netsvcs Provides software installation services such as Assign, Publish, and Remove. None Real World Used when you modify an application i.e. Add/Remove. 13

14 Automatic Updates Service Service Name Wuauserv Process Name svchost.exe -k netsvcs Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site. None Real World See the Microsoft above. Is this service needed? Possibly Recommended Setting: Automatic If you choose to update manually this service is not needed. Personally, I manually run update every morning so I have this service disabled. It's been my experience that Automatic Update has missed an occasional update as well as delaying the time from when the update was released to when Automatic Update states it's available. Your experience may vary. Background Intelligent Transfer Service Service Name BITS Process Name svchost.exe -k netsvcs XP Pro w/sp2 : Manual Real World Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled. In theory this should be a useful service, especially since it can continue an interrupted download due to a logoff or shutdown situation. Unfortunately, it can also be prone to trouble when the resumption occurs. See the KB article listed in s section. Is this service needed? No Recommended Setting: Manual Update Available for the Background Intelligent Transfer Service (Only for pre-sp2 systems) 14

15 ClipBook Service Service Name ClipSrv Process Name clipsrv.exe XP Pro w/ SP2 : Disabled Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. Network DDE Network DDE DSDM Real World If you're heavy into cutting 'n' pasting random snippets to others on the LAN, this is your baby. If not, it's easy enough to fire it up on the few occasions it is needed. Is this service needed? No Recommended Setting: Disabled COM+ Event System Service Service Name EventSystem Process Name svchost.exe Real World Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. One of the support files that you'll probably never have any use for, but if you disable it, the warning notices you receive are worse than leaving it enabled. *See System Event Notification Service 15

16 COM+ System Application Service Service Name COMSysApp Process Name dllhost.exe Real World Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Basically, this is the application that controls COM+ Event System. One of the support files that you'll probably never have any use for, but if you disable it, the warning notices you receive are worse than leaving it enabled. Disabling this service will generate Event Log entries noting it isn't running. An annoyance, but not harmful. The Manual setting avoids the Event Log entries. *See COM+ Event System *See System Event Notification Service Computer Browser Service Service Name Browser Process Name svchost.exe -k netsvcs Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. Server Workstation Real World Straightforward as can be, it keeps track of your computers on the network. If you're on a LAN, set it to Automatic. For stand alone systems, Disable is the way to go. Is this service needed? Possibly Recommended Setting: Automatic 16

17 Cryptographic Services Service Service Name CryptSvc Process Name svchost.exe -k netsvcs Real World Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Provides the annoying boxes that pop up telling you a driver you are about to install isn't digitally signed. If you disable this service you'll be flooded with uncertified driver notifications. I set this to Manual and if it's needed it starts. If you get errors or repeated calls for the service, set it to Automatic. A lot depends on how many unsigned drivers are on your system and of what type drivers. DCOM Server Process Launcher Service Name DcomLaunch Process Name svchost -k DcomLaunch Default Settings XP Home : Not Available XP Pro :Not Available XP Home w/sp2: Automatic XP Pro w/sp2 : Automatic Provides launch functionality for DCOM services. No dependencies Real World Is this service needed? Yes Recommended Setting: Automatic (This service added with SP2) 17

18 DHCP Client Service Service Name Dhcp Process Name svchost.exe -k netsvcs Manages network configuration by registering and updating IP addresses and DNS names. AFD Networking Support Environment NetBios over Tcpip TCP/IP Protocol Driver IPSEC driver Real World This is how your computer gets a Dynamic IP address so you can connect to the internet. If Internet Connection Sharing is enabled, you need DHCP Client. Also required for most DSL/Cable connections. Is this service needed? Possibly Recommended Setting: Automatic Not needed if you have a static IP address (very few home users have static IP addresses) or if it's a stand alone computer. Distributed Link Tracking Client Service Service Name TrkWks Process Name svchost.exe -k netsvcs Real World Maintains links between NTFS files within a computer or across computers in a network domain. For those that are part of a domain -and- use NTFS it has some value in keeping links across machines up to date, especially in the case of databases updated via the network. 10/17/ I originally listed this service as not needed and recommended it be disabled. If you are using the FAT32 file system that advice still applies. However, as more and more users gravitate to NTFS and judging from the number of readers that have written, I've changed this to a Possibly needed service and suggest it be set to Manual. 18

19 Distributed Transaction Coordinator Service Service Name MSDTC Process Name msdtc.exe Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. Security Accounts Manager Real World Closely related to Distributed Link Tracking Client discussed previously. Really serves no purpose for home user systems. Is this service needed? No Recommended Setting: Disabled DNS Client Service Service Name Dnscache Process Name svchost.exe -k NetworkService Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. Real World TCP/IP Protocol Driver As the description above states, it caches Domain Name System (DNS) names for this computer. If disabled, it simply means the system will go upstream to resolve DNS names rather than use the cache. Is this service needed? No Recommended Setting: Disabled Start this service if you receive a 'DNS Resolver Failed To Flush The Cache' message. 19

20 Error Reporting Service Service Name ERSvc Process Name svchost.exe -k netsvcs Allows error reporting for services and applications running in nonstandard environments. Real World This is responsible for the box that pops up wanting you to report an application error or system crash to Microsoft. Is this service needed? No Recommended Setting: Disabled I find screaming an obscenity at the offending application much more therapeutic than reporting the crash to Microsoft. To each his/her own. Event Log Service Service Name Eventlog Process Name services.exe Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Real World One of the few services that actually cannot be stopped. Event logs can be viewed through the Microsoft Management Console. Is this service needed? Yes Recommended Setting: Automatic See Microsoft Management Console for more info. 20

21 Fast User Switching Compatibility Service Service Name FastUser Switching Compatibility Process Name svchost.exe -k netsvcs Provides management for applications that require assistance in a multiple user environment. Real World Terminal Services Supplies the 'Switch User' functionality associated with the logoff option. It's a nice touch if you really do have that many users that are constantly switching in and out of the same box. Is this service needed? No Recommended Setting: Manual Help and Support Service Service Name helpsvc Process Name svchost.exe Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World This connects to the online help via Microsoft available from the Help and Support option on the Start Menu. Is this service needed? No Recommended Setting: Automatic This XP feature has received a lot of bad press, but it can be quite useful. It may not be everybody's cup of tea, but it can provide a lot of good info or quick pointers to info on the Microsoft site. In spite of the "No" above for service needed, I'd still set it to Automatic. 21

22 Human Interface Device Access [SP2 Terminology] HID Input Service [Pre SP2 Terminology] Service Name HidServ Process Name svchost.exe -k netsvcs Default Settings XP Home : Disabled XP Pro : Disabled Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. Real World If you have a peripheral that uses the items mentioned in the description above this is what lets it work. HTTP SSL Service Name HTTPFilter Process Name svchost.exe -k HTTPFilter Default Settings XP Home : Not Available XP Pro : Not Available XP Pro w/sp2 : Manual This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start. HTTP Real World Another added security provision for sites that make use of HTTPS such as banking and e-commerce sites. Set it to Manual and it will kick in when needed, although just to be on the safe side I set it to Automatic. Is this service needed? Possibly Recommended Setting: Automatic (This service added with SP2) 22

23 IMAPI CD-Burning COM Service Service Name ImapiService Process Name imapi.exe Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start. Real World As it says, if you want to have the XP CD burning capability, this will give you the power to Burn Baby, Burn. If you have a problem with burning CD's, check Auto Update for a patch and then set this service to Automatic. Yes, you -do- have to have a CD burner installed or else this is useless. It -does not- turn a standard CD Drive into a CD-R or CD-RW. Indexing Service Service Name cisvc Process Name cisvc.exe Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. Real World What Microsoft said above. What they don't say is that this service tends to run amok, indexing far more than necessary and starting without warning. For the benefit it provides, the resource usage is far from an equal tradeoff. However, in all fairness, if you have a reasonably powered machine you might as well leave Indexing Service on. It can speed things up a bit and most of the systems capable of running XP efficiently shouldn't be bogged down by having this service running. If it does take a noticeable performance hit it's really time to consider upgrading. Before disabling, uninstall this via the Add/Remove Programs Control Panel applet. 23

24 Internet Connection - Firewall (ICF) / Sharing (ICS) Service Service Name SharedAccess Process Name svchost.exe Default Settings XP Home : Manual XP Pro : Automatic Real World XP Pro w/sp2 : Eliminated in SP2 Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Application Layer Gateway Service Network Location Awareness Network Connections Remote Access Connection Manager As it says above. Set this service to the same setting used for Application Layer Gateway Service. Is this service needed? Possibly Recommended Setting: Automatic IPSEC Services Service Service Name PolicyAgent Process Name lsass.exe Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. IPSEC Driver TCP/IP Protocol Driver Real World Primarily a host authentication device used with data transfer and encryption operations on a domain. Normally I'd set this to No/Disable but a few reports have trickled in saying this service was needed. Until I can prove/disprove them, I've changed it to Possibly/Manual. 24

25 Logical Disk Manager Service Service Name dmserver Process Name svchost.exe Default Settings XP Home : Manual XP Pro : Automatic Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. Plug and Play Real World Essential to managing and updating the hard drives. Works in conjunction with Disk Management plug-in in Microsoft Management Console. Is this service needed? Yes Recommended Setting: Automatic Logical Disk Manager Administrative Service Service Name dmadmin Process Name dmadmin.exe /com Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. Plug and Play Logical Disk Manager Real World Works in concert with Logical Disk Manager, but can be set to Manual and it will be started and stopped as stated above. Is this service needed? Yes Recommended Setting: Manual Machine Debug Manager Service Service Name MDM Process Name mdm.exe Manages local and remote debugging for Visual Studio debuggers Real World Is this service needed? Yes Recommended Setting: Manual 25

26 Messenger Service Service Name Messenger Process Name svchost.exe -k netsvcs XP Pro w/sp2 : Disabled Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start. NetBIOS Interface Plug and Play Workstation Real World Is this service needed? No Recommended Setting: Disabled MS Software Shadow Copy Provider Service Service Name SwPrv Process Name dllhost.exe Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Related to using the Microsoft Backup Utility. If you use it, you might want to set this to Manual, but otherwise --- Is this service needed? No Recommended Setting: Disabled 26

27 Net Logon Service Service Name Netlogon Process Name lsass.exe XP Pro w/sp2 : Manual Supports pass-through authentication of account logon events for computers in a domain. Workstation Real World Domain Authentication, used when you log into the Domain. No domain? No Net Logon needed in spite of the way the name sounds. Is this service needed? No Recommended Setting: Disabled NetMeeting Remote Desktop Sharing Service Service Name mnmsrvc Process Name mnmsrvc.exe Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Makes it possible for a remote user with NetMeeting to access your computer. Is this service needed? No Recommended Setting: Disabled If you figure out why anyone would want to allow this service to run, let me know. 27

28 Network Connections Service Service Name Netman Process Name svchost.exe -k netsvcs Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Real World Basically, it controls the network and your ability to connect to the internet via Dial-Up. Is this service needed? Yes Recommended Setting: Automatic Network DDE Service Service Name NetDDE Process Name netdde.exe XP Pro w/sp2 : Disabled Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Network DDE DSDM Real World So far, the only thing I know related to this service is Clipbook. Is this service needed? No Recommended Setting: Disabled Network DDE DSDM Service Service Name NetDDEdsdm Process Name netdde.exe XP Pro w/sp2 : Disabled Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World So far, the only thing I know related to this service is Clipbook. Is this service needed? No Recommended Setting: Disabled 28

29 Network Location Awareness (NLA) Service Service Name Nla Process Name svchost.exe -k netsvcs Collects and stores network configuration and location information, and notifies applications when this information changes. AFD Networking Support Environment TCP/IP Protocol Driver Real World A part of the Internet Connection Sharing (ICS) component. If ICS is disabled, change this to disabled. Network Provisioning Service Service Name xmlprov Process Name svchost.exe -k netsvcs Default Settings XP Home : Not Available XP Pro : Not Available XP Pro w/sp2 : Manual Manages XML configuration files on a domain basis for automatic network provisioning. Real World (This service added with SP2) NT LM Security Support Provider Service Service Name NtLmSsp Process Name lsass.exe Provides security to remote procedure call (RPC) programs that use transports other than named pipes. Real World Provides support for Telnet and Message Queuing Is this service needed? Possibly Recommended Setting: Disabled 29

30 Performance Logs and Alerts Service Service Name SysmonLog Process Name smlogsvc.exe Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Another way to monitor system performance. If the box and network stats interest you, set this to Manual. If ignorance is bliss, Disabled is the way to go. Is this service needed? Possibly Recommended Setting: Disabled Plug and Play Service Service Name PlugPlay Process Name services.exe Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. Real World This is the automatic discovery of devices attached to your computer. Is this service needed? Yes Recommended Setting: Automatic One of the best features of XP - that truly works, at least most of the time. 30

31 Portable Media Serial Number Service Service Name WmdmPmSp Process Name svchost.exe XP Pro w/sp2 : Manual Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. Real World Retrieves a serial number embedded into portable music players. Is this service needed? No Recommended Setting: Disabled Update: 10/13/ I've received a number of letters from readers in response to my request for information about this service. Obviously, if you are using a Portable Music Player it would be best to have this service enabled. Print Spooler Service Service Name Spooler Process Name spoolsv.exe XP Pro w/sp2 : Automatic Loads files to memory for later printing. Real World We used to call this the print que, but spooler works also. Is this service needed? Possibly Recommended Setting: Automatic What this doesn't tell you is that if you have it disabled your printers won't work. Of course, if you don't have a printer (local or network) then kill this service. 31

32 Protected Storage Service Service Name ProtectedStorage Process Name lsass.exe Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. Real World By 'sensitive data' they mean passwords, encryption data, etc. Closely tied into other 'features' like AutoComplete. Is this service needed? Possibly Recommended Setting: Automatic While this service is not needed, most users will want it to avoid constantly having to type passwords. However, be aware it does carry risks, especially if your firewall security and security patch updating is lax. QoS RSVP Service Service Name RSVP Process Name rsvp.exe Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. AFD Networking Support Environment TCP/IP Protocol Driver Real World Supposedly provides a form of load balancing that shifts bandwidth between applications where it's most needed. Is this service needed? No Recommended Setting: Disabled The following is a direct quote from Microsoft. "There have been claims in various published technical articles and newsgroup postings that Windows XP always reserves 20 percent of the available bandwidth for QoS. These claims are incorrect. The information in the "Clarification about QoS in End Computers That Are Running Windows XP" section of this article correctly describes the behavior of Windows XP systems." I'd suggest you read the entire Knowledge Base article Q and decide for yourself whether you think this is needed. 32

33 Remote Access Auto Connection Manager Service Service Name RasAuto Process Name svchost.exe -k netsvcs Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Remote Access Connection Manager Telephony Real World Allows you to click an embedded link and automatically access the network. Can also play a role in DUN and DSL/Cable connections. Best to set this to Manual to begin with and if you have problems, change it to Automatic. Remote Access Connection Manager Service Service Name RasMan Process Name svchost.exe -k netsvcs Creates a network connection. Telephony Real World Exactly what it says above. Definitely required if you are using Internet Connection Sharing. Remote Desktop Help Session Manager Service Service Name RDSessMgr Process Name sessmgr.exe Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the tab of the Properties dialog box. Real World If you're a Remote Desktop user, keep this enabled. Otherwise -- Is this service needed? No Recommended Setting: Disabled 33

34 Service Service Name RpcSs Process Name svchost -k rpcss XP Pro w/sp2 : Automatic Provides the endpoint mapper and other miscellaneous RPC services. Real World Nobody is exactly sure what this service does, but kill it off and watch your system quickly die. It's a fact that a multitude of the other services depend on this service running. Is this service needed? Yes! Recommended Setting: Automatic Locator Service Service Name RpcLocator Process Name locator.exe Real World Manages the RPC name service database. Workstation I don't know what this does by Microsoft's description, but as important as is to XP's operation, I figure I'll leave the Locator running also. 34

35 Remote Registry Service Service Name RemoteRegistry Process Name svchost.exe -k LocalService Default Settings XP Home : Not Available XP Pro : Automatic Real World Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. Do -you- want someone editing -your- registry remotely? I didn't think so. Disabled. Is this service needed? Possibly Recommended Setting: Disabled 1/26/ I've received a number of s from readers saying I should reconsider the "Absolutely Not" rating I originally posted for this service. The 1/26/2004 from Patrick, shown below, is typical of the ones I've received, so for the time being I'm changing the recommendation to "Possibly" and will continue to monitor the for additional responses on whether it should be downgraded again. 06/29/ I have once again changed the Recommended Setting to Disabled and suggest you scroll down and read the notes sent in by TEG site visitors. I'm going to leave the "Possibly" in place rather than change it to an "Absolutely Not" scenario, but in 99% of the situations most are likely to encounter, the dangers of having it enabled far outweigh the benefits. Removable Storage Service Service Name NtmsSvc Process Name svchost.exe -k netsvcs No Given Real World Used for things like Zip Drives, Tape Drives, Graphics Pens. Some users have reported disabling has had a negative effect on their CD ROM, but these reports have been few and far between. 35

36 Routing and Remote Access Service Service Name RemoteAccess Process Name svchost.exe -k netsvcs Default Settings XP Home : Disabled XP Pro : Manual XP Pro w/sp2 : Disabled Offers routing services to businesses in local area and wide area network environments. NetBIOSGroup Real World Allows LAN and WAN dial in access to the computer. Is this service needed? Possibly Recommended Setting: Disabled Doubtful this is needed on a home machine. ScriptBlocking Service Service Name Process Name Default Settings XP Home : XP Pro : None Real World Installed by Symantec and relates to malicious script blocking. Is this service needed? Possibly Recommended Setting: Automatic Updated 10/12/ I originally set this to Disabled but a number of readers have written to say they feel it should be set to Automatic, and I agree. 36

37 Secondary Logon Service Service Name seclogon Process Name svchost.exe -k netsvcs Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World When Microsoft says 'Alternate Credentials' they are talking about the [Run As...] command which appears on the context menu, allowing a Limited User to run an executable as a higher level user. Is this service needed? Possibly Recommended Setting: Automatic I find this feature very useful but it does compromise security so be aware of what it can allow. Security Accounts Manager Service Service Name SamSs Process Name lsass.exe Stores security information for local user accounts. Real World Related to the Secondary Logon function and another security info warehouse, similar to Protected Storage. Is this service needed? Possibly Recommended Setting: Automatic 37

38 Security Center Service Name wscsvc Process Name svchost.exe -k netsvcs Default Settings XP Home : Not Available XP Pro : Not Available Monitors system security settings and configurations. Windows Management Instrumentation Event Log Real World XP Pro w/sp2 : Automatic Is this service needed? Possibly Recommended Setting: See '' Section Only available when SP2 is installed. Whether or not this service is needed or not is a tough call. For an experienced user that constantly monitors firewall and anti-virus programs by an alternate method, the answer is not needed. For others, I'd suggest leaving it on Automatic. It does provide visual feedback and the little balloons in the Notification Area are hard to ignore, which is good for those lax on security. Server Service Service Name lanmanserver Process Name svchost.exe -k netsvcs Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Provides basic file and print services on the LAN. No LAN? You don't need this. Is this service needed? Possibly Recommended Setting: Automatic 38

39 Shell Hardware Detection Service Service Name ShellHWDetection Process Name svchost.exe -k netsvcs Real World Microsoft doesn't provide a description, but testing shows that it's related to AutoPlay functionality such as digital cameras, CD ROM's Is this service needed? Possibly Recommended Setting: Automatic Smart Card Service Service Name SCardSvr Process Name SCardSvr.exe Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. Plug and Play Real World Just what the description says. If you have a Smart Card you need this. Is this service needed? Possibly Recommended Setting: Disabled Smart Card Helper Service Service Name SCardDrv Process Name SCardSvr.exe XP Pro w/sp2 : Eliminated in SP2 Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start. Real World The same as Smart Card except this is for legacy cards that don't support Plug and Play. Is this service needed? Possibly Recommended Setting: Disabled 39

40 SSDP Discovery Service Service Name SSDPSRV Process Name svchost.exe -k LocalService Enables discovery of UPnP devices on your home network. HTTP Real World Remember, a UPnP device is external (not inside the computer case) and a part of the local network. For more info on UPnP, click here. They are not the same thing as PnP devices. Is this service needed? Possibly Recommended Setting: Disabled System Event Notification Service Service Name SENS Process Name svchost.exe -k netsvcs Real World Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. COM+ Event System Whether your system actually has need for this depends on what you have installed, but many applications have processes that are run through System Event Notification. Best to leave it on Automatic. Is this service needed? Possibly Recommended Setting: Automatic 40

41 System Restore Service Service Name srservice Process Name svchost.exe -k netsvcs Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties Real World Allows you to take a snapshot of your system and then roll it back to that particular point in time. Is this service needed? Possibly Recommended Setting: Automatic I'll take some heat for this, but I like this service. I hear about it being a resource hog, not needed because of XP's stability, and on and on, but it's cheap insurance when configured properly and great for less experienced users or ones who aren't overly discriminating about what they download. Task Scheduler Service Service Name Schedule Process Name svchost.exe -k netsvcs Real World Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. I just think of this as an aid to my memory as I get older and more forgetful. It's used in conjunction with programs that like to run on a schedule, such as virus scanners, backups, defrag utilities, etc. If you can remember every task that needs to be done without help, disable this service. Is this service needed? Possibly Recommended Setting: Automatic 41

42 TCP/IP NetBIOS Helper Service Service Name LmHosts Process Name svchost.exe -k LocalService Real World Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. AFD Networking Support Environment Net BT Rather a relic from the days when NetBIOS and WINS were an integral part of the network, but this service is seldom needed today. Telephony Service Service Name TapiSrv Process Name svchost.exe -k netsvcs Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. Plug and Play Real World Basically controls all dialup activity and in some cases DSL/Cable activity. 42

43 Telnet Service Service Name TlntSvr Process Name tlntsvr.exe Default Settings XP Home : Not Available XP Pro : Manual XP Pro w/sp2 : Disabled Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. NT LM Security Support Provider TCP/IP Protocol Driver Real World A remote login 'feature' that is a major security hole. Unless you have a specific reason to use this, keep it disabled. Even Microsoft has changed the default to Disabled with the release of SP2. Is this service needed? No Recommended Setting: Disabled Terminal Services Service Service Name TermService Process Name svchost -k DComLaunch Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. Real World If you use any of the services listed in the description above, set this to manual. If not, disabled is the way to go. 43