The table below illustrates how I've set up the information for each service.... 3 Alerter Service... 4 Application Layer Gateway Service... 4 Application Management Service... 4 Automatic Updates Service... 5 Background Intelligent Transfer Service... 5 ClipBook Service... 6 COM+ Event System Service... 6 COM+ System Application Service... 7 Computer Browser Service... 7 Cryptographic Services Service... 8 DCOM Server Process Launcher... 8 DHCP Client Service... 9 Distributed Link Tracking Client Service... 9 Distributed Transaction Coordinator Service... 10 DNS Client Service... 10 Error Reporting Service...11 Event Log Service... 11 Fast User Switching Compatibility Service... 12 Help and Support Service... 12 Human Interface Device Access [SP2 Terminology] HID Input Service [Pre SP2 Terminology]... 13 HTTP SSL... 13 IMAPI CD-Burning COM Service... 14 Indexing Service... 14 Internet Connection - Firewall (ICF) / Sharing (ICS) Service... 15 IPSEC Services Service... 15 Logical Disk Manager Service... 16 Logical Disk Manager Administrative Service... 16 Machine Debug Manager Service... 16 Messenger Service... 17 MS Software Shadow Copy Provider Service... 17 Net Logon Service... 18 NetMeeting Remote Desktop Sharing Service... 18 Network Connections Service... 19 Network DDE Service... 19 Network DDE DSDM Service... 19 Network Location Awareness (NLA) Service... 20 Network Provisioning Service... 20 NT LM Security Support Provider Service... 21 Performance Logs and Alerts Service... 21 Plug and Play Service... 21 Portable Media Serial Number Service... 22 Print Spooler Service... 22 Protected Storage Service... 23 QoS RSVP Service... 24 Remote Access Auto Connection Manager Service... 24 Remote Access Connection Manager Service... 25 Remote Desktop Help Session Manager Service... 25 Service... 25 Locator Service... 26 Remote Registry Service... 26 Removable Storage Service... 27 Routing and Remote Access Service... 27
ScriptBlocking Service... 27 Secondary Logon Service... 28 Security Accounts Manager Service... 28 Security Center... 29 Server Service... 29 Shell Hardware Detection Service... 30 Smart Card Service... 30 Smart Card Helper Service... 30 SSDP Discovery Service...31 System Event Notification Service... 31 System Restore Service...31 Task Scheduler Service...32 TCP/IP NetBIOS Helper Service... 32 Telephony Service... 32 Telnet Service... 33 Terminal Services Service... 33 Themes Service... 34 Uninterruptible Power Supply Service... 34 Universal Plug and Play Device Host Service... 35 Upload Manager Service... 35 Volume Shadow Copy Service... 35 WebClient Service... 36 Windows Audio Service...36 Windows Firewall/Internet Connection Sharing (ICS)... 37 Windows Image Acquisition (WIA) Service... 37 Windows Installer Service... 37 Windows Management Instrumentation Service... 38 Windows Management Instrumentation Driver Extensions... 38 Windows Time Service... 38 Wireless Zero Configuration Service... 39 WMI Performance Adapter Service... 39 Workstation Service... 39
The table below illustrates how I've set up the information for each service. Service Name Alerter Process Name services.exe Real World Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. Workstation If you're part of a network that sends and receives administrative alerts this service is for you. Microsoft has assigned what they call a Display Name to each service. I've used that name to create the Services Index. It is the same name that appears in the Name column in the Services Window. Supposedly this name can be changed on the General tab if you want something more descriptive. Service Name - The name the service is actually called. This name is often quite cryptic while at other times easily identifiable. It comes from the General tab and cannot be modified. Process Name - The name of the actual process that is run when the service is activated. As you go through the services you'll no doubt wonder why svchost.exe is listed so many times as being the Process Name. The explanation can be found here. The Process Name is taken from the General tab. Default Settings - These are the default settings for the Home and Professional versions of XP when a clean installation is performed. - This is taken directly from the General tab. Some of the descriptions are easily understood while others make no sense at all to the average (or any other) user. - Lists any additional services that are required for the service to run. The information is taken from the tab. Real World - If I felt the was a bit vague or needed some clarification this is where I tried to give you a better idea of what the service does or why you might want it loaded. Is This Service Needed? - There are three choices here and I stress that these are strictly my opinion. A Yes means I believe it's essential to have this service running and set to Automatic. A Possibly means that depending on your hardware and software choices this service might be one you choose to have enabled. It might have an Automatic, Manual, or Disabled setting. A No means that I see no point in wasting the resources on the service and that your system shouldn't suffer any ill effects by having it disabled. It will have a Disabled Setting. Recommended Setting - Again, these are my opinions only, but I feel that for most situations this setting will give you a good balance between system functionality and resource conservation. - Anything else I want to toss in I think you might find helpful.
Alerter Service Service Name Alerter Process Name svchost.exe -k LocalService Real World XP Pro w/sp2 : Disabled Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. Workstation If you're part of a network that sends and receives administrative alerts this service is for you. Is this service needed? Possibly Recommended Setting: Disabled Application Layer Gateway Service Service Name ALG Process Name alg.exe Real World Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows Firewall. One of the bits and pieces you need if you connect to the internet using Microsoft's Internet Connection Sharing or Internet Connection Firewall, Application Management Service Service Name AppMgmt Process Name svchost.exe -k netsvcs Provides software installation services such as Assign, Publish, and Remove. None Real World Used when you modify an application i.e. Add/Remove.
Automatic Updates Service Service Name Wuauserv Process Name svchost.exe -k netsvcs Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site. None Real World See the Microsoft above. Is this service needed? Possibly Recommended Setting: Automatic If you choose to update manually this service is not needed. Personally, I manually run update every morning so I have this service disabled. It's been my experience that Automatic Update has missed an occasional update as well as delaying the time from when the update was released to when Automatic Update states it's available. Your experience may vary. Background Intelligent Transfer Service Service Name BITS Process Name svchost.exe -k netsvcs XP Pro w/sp2 : Manual Real World Transfers files in the background using idle network bandwidth. If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information. If this service is disabled, any services that explicitly depend on it may fail to transfer files if they do not have a fail safe mechanism to transfer files directly through IE in case BITS has been disabled. In theory this should be a useful service, especially since it can continue an interrupted download due to a logoff or shutdown situation. Unfortunately, it can also be prone to trouble when the resumption occurs. See the KB article listed in s section. Is this service needed? No Recommended Setting: Manual Update Available for the Background Intelligent Transfer Service (Only for pre-sp2 systems)
ClipBook Service Service Name ClipSrv Process Name clipsrv.exe XP Pro w/ SP2 : Disabled Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. Network DDE Network DDE DSDM Real World If you're heavy into cutting 'n' pasting random snippets to others on the LAN, this is your baby. If not, it's easy enough to fire it up on the few occasions it is needed. Is this service needed? No Recommended Setting: Disabled COM+ Event System Service Service Name EventSystem Process Name svchost.exe Real World Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. One of the support files that you'll probably never have any use for, but if you disable it, the warning notices you receive are worse than leaving it enabled. *See System Event Notification Service
COM+ System Application Service Service Name COMSysApp Process Name dllhost.exe Real World Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Basically, this is the application that controls COM+ Event System. One of the support files that you'll probably never have any use for, but if you disable it, the warning notices you receive are worse than leaving it enabled. Disabling this service will generate Event Log entries noting it isn't running. An annoyance, but not harmful. The Manual setting avoids the Event Log entries. *See COM+ Event System *See System Event Notification Service Computer Browser Service Service Name Browser Process Name svchost.exe -k netsvcs Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. Server Workstation Real World Straightforward as can be, it keeps track of your computers on the network. If you're on a LAN, set it to Automatic. For stand alone systems, Disable is the way to go. Is this service needed? Possibly Recommended Setting: Automatic
Cryptographic Services Service Service Name CryptSvc Process Name svchost.exe -k netsvcs Real World Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Provides the annoying boxes that pop up telling you a driver you are about to install isn't digitally signed. If you disable this service you'll be flooded with uncertified driver notifications. I set this to Manual and if it's needed it starts. If you get errors or repeated calls for the service, set it to Automatic. A lot depends on how many unsigned drivers are on your system and of what type drivers. DCOM Server Process Launcher Service Name DcomLaunch Process Name svchost -k DcomLaunch Default Settings XP Home : Not Available XP Pro :Not Available XP Home w/sp2: Automatic XP Pro w/sp2 : Automatic Provides launch functionality for DCOM services. No dependencies Real World Is this service needed? Yes Recommended Setting: Automatic (This service added with SP2)
DHCP Client Service Service Name Dhcp Process Name svchost.exe -k netsvcs Manages network configuration by registering and updating IP addresses and DNS names. AFD Networking Support Environment NetBios over Tcpip TCP/IP Protocol Driver IPSEC driver Real World This is how your computer gets a Dynamic IP address so you can connect to the internet. If Internet Connection Sharing is enabled, you need DHCP Client. Also required for most DSL/Cable connections. Is this service needed? Possibly Recommended Setting: Automatic Not needed if you have a static IP address (very few home users have static IP addresses) or if it's a stand alone computer. Distributed Link Tracking Client Service Service Name TrkWks Process Name svchost.exe -k netsvcs Real World Maintains links between NTFS files within a computer or across computers in a network domain. For those that are part of a domain -and- use NTFS it has some value in keeping links across machines up to date, especially in the case of databases updated via the network. 10/17/2002 - I originally listed this service as not needed and recommended it be disabled. If you are using the FAT32 file system that advice still applies. However, as more and more users gravitate to NTFS and judging from the number of readers that have written, I've changed this to a Possibly needed service and suggest it be set to Manual.
Distributed Transaction Coordinator Service Service Name MSDTC Process Name msdtc.exe Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. Security Accounts Manager Real World Closely related to Distributed Link Tracking Client discussed previously. Really serves no purpose for home user systems. Is this service needed? No Recommended Setting: Disabled DNS Client Service Service Name Dnscache Process Name svchost.exe -k NetworkService Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. Real World TCP/IP Protocol Driver As the description above states, it caches Domain Name System (DNS) names for this computer. If disabled, it simply means the system will go upstream to resolve DNS names rather than use the cache. Is this service needed? No Recommended Setting: Disabled Start this service if you receive a 'DNS Resolver Failed To Flush The Cache' message.
Error Reporting Service Service Name ERSvc Process Name svchost.exe -k netsvcs Allows error reporting for services and applications running in nonstandard environments. Real World This is responsible for the box that pops up wanting you to report an application error or system crash to Microsoft. Is this service needed? No Recommended Setting: Disabled I find screaming an obscenity at the offending application much more therapeutic than reporting the crash to Microsoft. To each his/her own. Event Log Service Service Name Eventlog Process Name services.exe Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Real World One of the few services that actually cannot be stopped. Event logs can be viewed through the Microsoft Management Console. Is this service needed? Yes Recommended Setting: Automatic See Microsoft Management Console for more info.
Fast User Switching Compatibility Service Service Name FastUser Switching Compatibility Process Name svchost.exe -k netsvcs Provides management for applications that require assistance in a multiple user environment. Real World Terminal Services Supplies the 'Switch User' functionality associated with the logoff option. It's a nice touch if you really do have that many users that are constantly switching in and out of the same box. Is this service needed? No Recommended Setting: Manual Help and Support Service Service Name helpsvc Process Name svchost.exe Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World This connects to the online help via Microsoft available from the Help and Support option on the Start Menu. Is this service needed? No Recommended Setting: Automatic This XP feature has received a lot of bad press, but it can be quite useful. It may not be everybody's cup of tea, but it can provide a lot of good info or quick pointers to info on the Microsoft site. In spite of the "No" above for service needed, I'd still set it to Automatic.
Human Interface Device Access [SP2 Terminology] HID Input Service [Pre SP2 Terminology] Service Name HidServ Process Name svchost.exe -k netsvcs Default Settings XP Home : Disabled XP Pro : Disabled Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. Real World If you have a peripheral that uses the items mentioned in the description above this is what lets it work. HTTP SSL Service Name HTTPFilter Process Name svchost.exe -k HTTPFilter Default Settings XP Home : Not Available XP Pro : Not Available XP Pro w/sp2 : Manual This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If this service is disabled, any services that explicitly depend on it will fail to start. HTTP Real World Another added security provision for sites that make use of HTTPS such as banking and e-commerce sites. Set it to Manual and it will kick in when needed, although just to be on the safe side I set it to Automatic. Is this service needed? Possibly Recommended Setting: Automatic (This service added with SP2)
IMAPI CD-Burning COM Service Service Name ImapiService Process Name imapi.exe Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start. Real World As it says, if you want to have the XP CD burning capability, this will give you the power to Burn Baby, Burn. If you have a problem with burning CD's, check Auto Update for a patch and then set this service to Automatic. Yes, you -do- have to have a CD burner installed or else this is useless. It -does not- turn a standard CD Drive into a CD-R or CD-RW. Indexing Service Service Name cisvc Process Name cisvc.exe Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. Real World What Microsoft said above. What they don't say is that this service tends to run amok, indexing far more than necessary and starting without warning. For the benefit it provides, the resource usage is far from an equal tradeoff. However, in all fairness, if you have a reasonably powered machine you might as well leave Indexing Service on. It can speed things up a bit and most of the systems capable of running XP efficiently shouldn't be bogged down by having this service running. If it does take a noticeable performance hit it's really time to consider upgrading. Before disabling, uninstall this via the Add/Remove Programs Control Panel applet.
Internet Connection - Firewall (ICF) / Sharing (ICS) Service Service Name SharedAccess Process Name svchost.exe Default Settings XP Home : Manual XP Pro : Automatic Real World XP Pro w/sp2 : Eliminated in SP2 Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Application Layer Gateway Service Network Location Awareness Network Connections Remote Access Connection Manager As it says above. Set this service to the same setting used for Application Layer Gateway Service. Is this service needed? Possibly Recommended Setting: Automatic IPSEC Services Service Service Name PolicyAgent Process Name lsass.exe Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. IPSEC Driver TCP/IP Protocol Driver Real World Primarily a host authentication device used with data transfer and encryption operations on a domain. Normally I'd set this to No/Disable but a few reports have trickled in saying this service was needed. Until I can prove/disprove them, I've changed it to Possibly/Manual.
Logical Disk Manager Service Service Name dmserver Process Name svchost.exe Default Settings XP Home : Manual XP Pro : Automatic Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. Plug and Play Real World Essential to managing and updating the hard drives. Works in conjunction with Disk Management plug-in in Microsoft Management Console. Is this service needed? Yes Recommended Setting: Automatic Logical Disk Manager Administrative Service Service Name dmadmin Process Name dmadmin.exe /com Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. Plug and Play Logical Disk Manager Real World Works in concert with Logical Disk Manager, but can be set to Manual and it will be started and stopped as stated above. Is this service needed? Yes Recommended Setting: Manual Machine Debug Manager Service Service Name MDM Process Name mdm.exe Manages local and remote debugging for Visual Studio debuggers Real World Is this service needed? Yes Recommended Setting: Manual
Messenger Service Service Name Messenger Process Name svchost.exe -k netsvcs XP Pro w/sp2 : Disabled Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start. NetBIOS Interface Plug and Play Workstation Real World Is this service needed? No Recommended Setting: Disabled MS Software Shadow Copy Provider Service Service Name SwPrv Process Name dllhost.exe Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Related to using the Microsoft Backup Utility. If you use it, you might want to set this to Manual, but otherwise --- Is this service needed? No Recommended Setting: Disabled
Net Logon Service Service Name Netlogon Process Name lsass.exe XP Pro w/sp2 : Manual Supports pass-through authentication of account logon events for computers in a domain. Workstation Real World Domain Authentication, used when you log into the Domain. No domain? No Net Logon needed in spite of the way the name sounds. Is this service needed? No Recommended Setting: Disabled NetMeeting Remote Desktop Sharing Service Service Name mnmsrvc Process Name mnmsrvc.exe Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Makes it possible for a remote user with NetMeeting to access your computer. Is this service needed? No Recommended Setting: Disabled If you figure out why anyone would want to allow this service to run, let me know.
Network Connections Service Service Name Netman Process Name svchost.exe -k netsvcs Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Real World Basically, it controls the network and your ability to connect to the internet via Dial-Up. Is this service needed? Yes Recommended Setting: Automatic Network DDE Service Service Name NetDDE Process Name netdde.exe XP Pro w/sp2 : Disabled Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Network DDE DSDM Real World So far, the only thing I know related to this service is Clipbook. Is this service needed? No Recommended Setting: Disabled Network DDE DSDM Service Service Name NetDDEdsdm Process Name netdde.exe XP Pro w/sp2 : Disabled Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World So far, the only thing I know related to this service is Clipbook. Is this service needed? No Recommended Setting: Disabled
Network Location Awareness (NLA) Service Service Name Nla Process Name svchost.exe -k netsvcs Collects and stores network configuration and location information, and notifies applications when this information changes. AFD Networking Support Environment TCP/IP Protocol Driver Real World A part of the Internet Connection Sharing (ICS) component. If ICS is disabled, change this to disabled. 11/06/2002 From: Patrik TEG Reader Comments about Network Location Awareness (NLA) service. The Network Location Awareness service doesn't just have to do with internet connection sharing but also with the built in firewall so you should suggest this service to be automatic as well. TEG: I agree that Internet Connection Firewall is also impacted by NLA and if you use ICF setting it to Automatic won't hurt a thing. Network Provisioning Service Service Name xmlprov Process Name svchost.exe -k netsvcs Default Settings XP Home : Not Available XP Pro : Not Available XP Pro w/sp2 : Manual Manages XML configuration files on a domain basis for automatic network provisioning. Real World (This service added with SP2)
NT LM Security Support Provider Service Service Name NtLmSsp Process Name lsass.exe Provides security to remote procedure call (RPC) programs that use transports other than named pipes. Real World Provides support for Telnet and Message Queuing Is this service needed? Possibly Recommended Setting: Disabled Performance Logs and Alerts Service Service Name SysmonLog Process Name smlogsvc.exe Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Another way to monitor system performance. If the box and network stats interest you, set this to Manual. If ignorance is bliss, Disabled is the way to go. Is this service needed? Possibly Recommended Setting: Disabled Plug and Play Service Service Name PlugPlay Process Name services.exe Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. Real World This is the automatic discovery of devices attached to your computer. Is this service needed? Yes Recommended Setting: Automatic One of the best features of XP - that truly works, at least most of the time.
Portable Media Serial Number Service Service Name WmdmPmSp Process Name svchost.exe XP Pro w/sp2 : Manual Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. Real World Retrieves a serial number embedded into portable music players. Is this service needed? No Recommended Setting: Disabled Update: 10/13/2002 - I've received a number of letters from readers in response to my request for information about this service. Obviously, if you are using a Portable Music Player it would be best to have this service enabled. Print Spooler Service Service Name Spooler Process Name spoolsv.exe XP Pro w/sp2 : Automatic Loads files to memory for later printing. Real World We used to call this the print que, but spooler works also. Is this service needed? Possibly Recommended Setting: Automatic What this doesn't tell you is that if you have it disabled your printers won't work. Of course, if you don't have a printer (local or network) then kill this service.
Protected Storage Service Service Name ProtectedStorage Process Name lsass.exe Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. Real World By 'sensitive data' they mean passwords, encryption data, etc. Closely tied into other 'features' like AutoComplete. Is this service needed? Possibly Recommended Setting: Automatic While this service is not needed, most users will want it to avoid constantly having to type passwords. However, be aware it does carry risks, especially if your firewall security and security patch updating is lax.
QoS RSVP Service Service Name RSVP Process Name rsvp.exe Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. AFD Networking Support Environment TCP/IP Protocol Driver Real World Supposedly provides a form of load balancing that shifts bandwidth between applications where it's most needed. Is this service needed? No Recommended Setting: Disabled The following is a direct quote from Microsoft. "There have been claims in various published technical articles and newsgroup postings that Windows XP always reserves 20 percent of the available bandwidth for QoS. These claims are incorrect. The information in the "Clarification about QoS in End Computers That Are Running Windows XP" section of this article correctly describes the behavior of Windows XP systems." I'd suggest you read the entire Knowledge Base article Q316666 and decide for yourself whether you think this is needed. Remote Access Auto Connection Manager Service Service Name RasAuto Process Name svchost.exe -k netsvcs Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Remote Access Connection Manager Telephony Real World Allows you to click an embedded link and automatically access the network. Can also play a role in DUN and DSL/Cable connections. Best to set this to Manual to begin with and if you have problems, change it to Automatic.
Remote Access Connection Manager Service Service Name RasMan Process Name svchost.exe -k netsvcs Creates a network connection. Telephony Real World Exactly what it says above. Definitely required if you are using Internet Connection Sharing. Remote Desktop Help Session Manager Service Service Name RDSessMgr Process Name sessmgr.exe Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the tab of the Properties dialog box. Real World If you're a Remote Desktop user, keep this enabled. Otherwise -- Is this service needed? No Recommended Setting: Disabled Service Service Name RpcSs Process Name svchost -k rpcss XP Pro w/sp2 : Automatic Provides the endpoint mapper and other miscellaneous RPC services. Real World Nobody is exactly sure what this service does, but kill it off and watch your system quickly die. It's a fact that a multitude of the other services depend on this service running. Is this service needed? Yes! Recommended Setting: Automatic
Locator Service Service Name RpcLocator Process Name locator.exe Real World Manages the RPC name service database. Workstation I don't know what this does by Microsoft's description, but as important as is to XP's operation, I figure I'll leave the Locator running also. Remote Registry Service Service Name RemoteRegistry Process Name svchost.exe -k LocalService Default Settings XP Home : Not Available XP Pro : Automatic Real World Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. Do -you- want someone editing -your- registry remotely? I didn't think so. Disabled. Is this service needed? Possibly Recommended Setting: Disabled 1/26/2004 - I've received a number of e-mails from readers saying I should reconsider the "Absolutely Not" rating I originally posted for this service. The 1/26/2004 from Patrick, shown below, is typical of the ones I've received, so for the time being I'm changing the recommendation to "Possibly" and will continue to monitor the e-mail for additional responses on whether it should be downgraded again. 06/29/2005 - I have once again changed the Recommended Setting to Disabled and suggest you scroll down and read the notes sent in by TEG site visitors. I'm going to leave the "Possibly" in place rather than change it to an "Absolutely Not" scenario, but in 99% of the situations most are likely to encounter, the dangers of having it enabled far outweigh the benefits.
Removable Storage Service Service Name NtmsSvc Process Name svchost.exe -k netsvcs No Given Real World Used for things like Zip Drives, Tape Drives, Graphics Pens. Some users have reported disabling has had a negative effect on their CD ROM, but these reports have been few and far between. Routing and Remote Access Service Service Name RemoteAccess Process Name svchost.exe -k netsvcs Default Settings XP Home : Disabled XP Pro : Manual XP Pro w/sp2 : Disabled Offers routing services to businesses in local area and wide area network environments. NetBIOSGroup Real World Allows LAN and WAN dial in access to the computer. Is this service needed? Possibly Recommended Setting: Disabled Doubtful this is needed on a home machine. ScriptBlocking Service Service Name Process Name Default Settings XP Home : XP Pro : None Real World Installed by Symantec and relates to malicious script blocking. Is this service needed? Possibly Recommended Setting: Automatic Updated 10/12/2002 - I originally set this to Disabled but a number of readers have written to say they feel it should be set to Automatic, and I agree.
Secondary Logon Service Service Name seclogon Process Name svchost.exe -k netsvcs Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World When Microsoft says 'Alternate Credentials' they are talking about the [Run As...] command which appears on the context menu, allowing a Limited User to run an executable as a higher level user. Is this service needed? Possibly Recommended Setting: Automatic I find this feature very useful but it does compromise security so be aware of what it can allow. Security Accounts Manager Service Service Name SamSs Process Name lsass.exe Stores security information for local user accounts. Real World Related to the Secondary Logon function and another security info warehouse, similar to Protected Storage. Is this service needed? Possibly Recommended Setting: Automatic
Security Center Service Name wscsvc Process Name svchost.exe -k netsvcs Default Settings XP Home : Not Available XP Pro : Not Available Monitors system security settings and configurations. Windows Management Instrumentation Event Log Real World XP Pro w/sp2 : Automatic Is this service needed? Possibly Recommended Setting: See '' Section Only available when SP2 is installed. Whether or not this service is needed or not is a tough call. For an experienced user that constantly monitors firewall and anti-virus programs by an alternate method, the answer is not needed. For others, I'd suggest leaving it on Automatic. It does provide visual feedback and the little balloons in the Notification Area are hard to ignore, which is good for those lax on security. Server Service Service Name lanmanserver Process Name svchost.exe -k netsvcs Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Provides basic file and print services on the LAN. No LAN? You don't need this. Is this service needed? Possibly Recommended Setting: Automatic
Shell Hardware Detection Service Service Name ShellHWDetection Process Name svchost.exe -k netsvcs Provides notifications for AutoPlay hardware events. Real World Testing shows that it's related to AutoPlay functionality such as digital cameras, CD ROM's Is this service needed? Possibly Recommended Setting: Automatic Smart Card Service Service Name SCardSvr Process Name SCardSvr.exe Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. Plug and Play Real World Just what the description says. If you have a Smart Card you need this. Is this service needed? Possibly Recommended Setting: Disabled Smart Card Helper Service Service Name SCardDrv Process Name SCardSvr.exe XP Pro w/sp2 : Eliminated in SP2 Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start. Real World The same as Smart Card except this is for legacy cards that don't support Plug and Play. Is this service needed? Possibly Recommended Setting: Disabled
SSDP Discovery Service Service Name SSDPSRV Process Name svchost.exe -k LocalService Enables discovery of UPnP devices on your home network. HTTP Real World Remember, a UPnP device is external (not inside the computer case) and a part of the local network. For more info on UPnP, click here. They are not the same thing as PnP devices. Is this service needed? Possibly Recommended Setting: Disabled System Event Notification Service Service Name SENS Process Name svchost.exe -k netsvcs Real World Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. COM+ Event System Whether your system actually has need for this depends on what you have installed, but many applications have processes that are run through System Event Notification. Best to leave it on Automatic. Is this service needed? Possibly Recommended Setting: Automatic System Restore Service Service Name srservice Process Name svchost.exe -k netsvcs Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties Real World Allows you to take a snapshot of your system and then roll it back to that particular point in time. Is this service needed? Possibly Recommended Setting: Automatic I'll take some heat for this, but I like this service. I hear about it being a resource hog, not needed because of XP's stability, and on and on, but it's cheap insurance when configured properly and great for less experienced users or ones who aren't overly discriminating about what they download.
Task Scheduler Service Service Name Schedule Process Name svchost.exe -k netsvcs Real World Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. I just think of this as an aid to my memory as I get older and more forgetful. It's used in conjunction with programs that like to run on a schedule, such as virus scanners, backups, defrag utilities, etc. If you can remember every task that needs to be done without help, disable this service. Is this service needed? Possibly Recommended Setting: Automatic TCP/IP NetBIOS Helper Service Service Name LmHosts Process Name svchost.exe -k LocalService Real World Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. AFD Networking Support Environment Net BT Rather a relic from the days when NetBIOS and WINS were an integral part of the network, but this service is seldom needed today. Telephony Service Service Name TapiSrv Process Name svchost.exe -k netsvcs Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. Plug and Play Real World Basically controls all dialup activity and in some cases DSL/Cable activity.
Telnet Service Service Name TlntSvr Process Name tlntsvr.exe Default Settings XP Home : Not Available XP Pro : Manual XP Pro w/sp2 : Disabled Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. NT LM Security Support Provider TCP/IP Protocol Driver Real World A remote login 'feature' that is a major security hole. Unless you have a specific reason to use this, keep it disabled. Even Microsoft has changed the default to Disabled with the release of SP2. Is this service needed? No Recommended Setting: Disabled Terminal Services Service Service Name TermService Process Name svchost -k DComLaunch Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. Real World If you use any of the services listed in the description above, set this to manual. If not, disabled is the way to go.
Themes Service Service Name Themes Process Name svchost.exe -k netsvcs Default Settings XP Home : Automatic XP Pro : Manual XP Pro w/sp2 : Automatic Provides user experience theme management. Real World If you like the themes in XP, this makes them available. Setting this to Automatic allows all users to access themes if they wish. It's beyond me why this was changed to Automatic in SP2. Anyone have any ideas? Uninterruptible Power Supply Service Service Name UPS Process Name ups.exe Manages an uninterruptible power supply (UPS) connected to the computer. Real World Just what it says above. How your UPS connects to the computer really determines whether this is needed. Many USB connected UPS's don't need this service. If you don't have a UPS, get one. Prices are cheaper than ever and they afford great system and data protection.
Universal Plug and Play Device Host Service Service Name upnphost Process Name svchost.exe -k LocalService Provides support to host Universal Plug and Play devices. HTTP SSDP Discovery Service Real World Remember, a UPnP device is external (not inside the computer case) and a part of the local network. For more info on UPnP, click here. They are not the same thing as PnP devices. Upload Manager Service Service Name uploadmgr Process Name svchost.exe Manages synchronous and asynchronous file transfers between clients and servers on the network. If this service is stopped, synchronous and asynchronous file transfers between clients and servers on the network will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Is this service needed? Possibly Recommended Setting: Disabled Volume Shadow Copy Service Service Name VSS Process Name vssvc.exe Real World Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. Related to using the Microsoft Backup Utility. If you use it, you might want to set this to Manual, but otherwise --- Should have the same setting as MS Software Shadow Copy Provider Is this service needed? No Recommended Setting: Disabled
WebClient Service Service Name WebClient Process Name svchost.exe -k LocalService Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. Real World WebDav Client Redirector Truthfully, I haven't been able to locate anyone that can tell me whether this service is needed or not. I've had it Disabled, Manual, and Automatic with no conclusive evidence. It's a crapshoot. Windows Audio Service Service Name AudioSrv Process Name svchost.exe -k netsvcs Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Plug and Play Real World Controls all audio functions. If you don't have sound capability, disable. Is this service needed? Possibly Recommended Setting: Automatic
Windows Firewall/Internet Connection Sharing (ICS) Service Name SharedAccess Process Name svchost.exe -k netsvcs Default Settings XP Home : Not Available XP Pro : Not Available XP Pro w/sp2 : Automatic Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Network Connections Windows Management Instrumentation Real World Event Log / Remote Procedure Call (RPC) Leave this on Automatic even if you're running a third-party firewall - and if you aren't running one, stop what you're doing right now, turn off the machine and don't start it up again until you have one installed and running. Yes, it's that important. Is this service needed? Yes Recommended Setting: Automatic Available after installation of SP2. Windows Image Acquisition (WIA) Service Service Name stisvc Process Name svchost.exe -k imgsvc Provides image acquisition services for scanners and cameras. Real World Controls web cams, cameras, and scanners. Windows Installer Service Service Name MSIServer Process Name msiexec.exe /V Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package. If this service is disabled, any services that explicitly depend on it will fail to start. Real World Used to install applications that use.msi installation files.
Windows Management Instrumentation Service Service Name Winmgmt Process Name svchost.exe -k netsvcs Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Event Log Remote procedure Call (RPC) Real World If you don't want your computer to work, set this to Disabled. Is this service needed? Yes! Recommended Setting: Automatic See Q305992 regarding WMI and System Restore Windows Management Instrumentation Driver Extensions Service Name Wmi Process Name svchost.exe -k netsvcs Default Settings XP Home : Not Available XP Pro : Manual Provides systems management information to and from drivers. Real World As it states above, but I don't understand why it isn't available in XP Home. Can anyone answer that for me? Is this service needed? Yes Recommended Setting: Manual Windows Time Service Service Name W32Time Process Name svchost.exe -k netsvcs Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World If you like to synchronize your clock to a time server this is the way to go. Is this service needed? Possibly Recommended Setting: Disabled
Wireless Zero Configuration Service Service Name WZCSVC Process Name svchost.exe -k netsvcs Provides automatic configuration for the 802.11 adapters NDIS Usermode I/O Protocol Real World Auto configuration for wireless network devices. No wireless devices? Disable the service. Is this service needed? Possibly Recommended Setting: Disabled WMI Performance Adapter Service Service Name WmiApSrv Process Name wmiapsrv.exe Provides performance library information from WMI HiPerf providers. Real World Workstation Service Service Name lanmanworkstation Process Name svchost.exe -k netsvcs Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Real World There are a number of items that can be impacted by disabling this service. I strongly recommend you read through Microsoft Security Bulletin MS03-049 - Buffer Overrun in the Workstation Service Could Allow Code Execution (828749), especially the " Workarounds" section, and then decide if you want it enabled or disabled. Is this service needed? Possibly Recommended Setting: Automatic