Windows Services

Windows Services
What are services? By definition, it's a program that runs invisibly in the background. But
can't the same thing be said for a number of programs that run in the background such as
anti-virus programs? Yes, but the real difference is that services load and start running
whether or not anyone logs into the computer, unlike a program that is launched from the
Startup Folder under All Programs.
There are two ways to view Services on your computer. The first is to use the MS
Configuration Utility by typing msconfig.exe in the Run box accessed via the Start Menu,
followed by clicking the Services tab. If you want a quick visual of which items are running or
stopped, this is fine, but the information is limited. The preferred way to make changes to
services is to launch services.msc from the Run option on the Start Menu. The Services
window shown below will open.
Looking at the Services window you can see it has columns for Name, Description, Status,
Startup Type and Log On As. This provides a quick overview of all the services on your
computer. Detailed information is available by clicking any of the entries. The four captures
below show the property sheet, by tabs, for the Alerter Service.
Create or Delete A Service in Windows XP
Services are added from the Command Prompt. You need to know the actual service name
as opposed to what Microsoft calls the Display Name. For example, if you wanted to create
or delete the Help and Support service, the name used at the Command Prompt would be
"helpsvc" rather than the Display Name of "Help and Support". The actual service name can
be obtained by typing services.msc in Run on the Start Menu and then double clicking the
Display Name of the service. Once you know the name;
To Create A Service
• Start | Run and type cmd in the Open: line. Click OK.
• Type: sc create <service name>
• Reboot the system
Fig. 01
To Delete A Service
• Start | Run and type cmd in the Open: line. Click OK.
• Type: sc delete <service name>
Fig. 02
If you prefer to work in the registry rather than through the command prompt to delete
services;
• Click Start | Run and type regedit in the Open: line. Click OK.
• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
• Scroll down the left pane, locate the service name, right click it and select Delete.
Alerter Service
svchost.exe -k
Service Name Alerter Process Name
LocalService
Default Settings XP Home : Manual XP Pro : Manual
XP Pro w/SP2 : Disabled
Notifies selected users and computers of administrative alerts.
Microsoft Service If the service is stopped, programs that use administrative
Description alerts will not receive them. If this service is disabled, any
services that explicitly depend on it will fail to start.
Dependencies Workstation
Real World If you're part of a network that sends and receives
Description administrative alerts this service is for you.
Application Layer Gateway Service
Service Name ALG Process Name alg.exe

Microsoft Service Provides support for 3rd party protocol plug-ins for Internet Connection
Description Sharing and the Windows Firewall.
Dependencies
One of the bits and pieces you need if you connect to the
Real World
internet using Microsoft's Internet Connection Sharing or
Description
Internet Connection Firewall,
Application Management Service
Service Name AppMgmt Process Name svchost.exe -k netsvcs

Microsoft Service Provides software installation services such as Assign, Publish,
Description and Remove.
Dependencies None
Real World
Used when you modify an application i.e. Add/Remove.
Description
Automatic Updates Service
Service Name Wuauserv Process Name svchost.exe -k netsvcs

Default Settings XP Home : Automatic XP Pro : Automatic
Enables the download and installation of Windows updates. If this service is
Microsoft Service
disabled, this computer will not be able to use the Automatic Updates feature or
Description
the Windows Update Web site.
Dependencies None
Real World
See the Microsoft Description above.
Description
Is this service Recommended
Possibly Automatic
needed? Setting:
Background Intelligent Transfer Service
Service Name BITS Process Name svchost.exe -k netsvcs

XP Pro w/SP2 : Manual
Transfers files in the background using idle network bandwidth. If the service
is stopped, features such as Windows Update, and MSN Explorer will be
Microsoft Service unable to automatically download programs and other information. If this
Description service is disabled, any services that explicitly depend on it may fail to transfer
files if they do not have a fail safe mechanism to transfer files directly through
IE in case BITS has been disabled.
Remote Procedure Call
Dependencies
(RPC)
In theory this should be a useful service, especially since it can
continue an interrupted download due to a logoff or shutdown
Real World
situation. Unfortunately, it can also be prone to trouble when
Description
the resumption occurs. See the KB article listed in Notes
section.
ClipBook Service
Service Name ClipSrv Process Name clipsrv.exe

XP Pro w/ SP2 : Disabled

Enables ClipBook Viewer to store information and share it with remote
Microsoft Service computers. If the service is stopped, ClipBook Viewer will not be able to share
Description information with remote computers. If this service is disabled, any services that
explicitly depend on it will fail to start.
Dependencies Network DDE Network DDE DSDM
Real World If you're heavy into cutting 'n' pasting random snippets to
others on the LAN, this is your baby. If not, it's easy enough to
Description
fire it up on the few occasions it is needed.
COM+ Event System Service
Service Name EventSystem Process Name svchost.exe

Supports System Event Notification Service (SENS), which provides
automatic distribution of events to subscribing Component Object Model
Microsoft Service
(COM) components. If the service is stopped, SENS will close and will not be
Description
able to provide logon and logoff notifications. If this service is disabled, any
Dependencies
(RPC)
One of the support files that you'll probably never have any
Real World
use for, but if you disable it, the warning notices you receive
Description
are worse than leaving it enabled.
COM+ System Application Service
Service Name COMSysApp Process Name dllhost.exe

Manages the configuration and tracking of Component Object
Model (COM)+-based components. If the service is stopped,
Microsoft Service
most COM+-based components will not function properly. If
Description
this service is disabled, any services that explicitly depend on
it will fail to start.
Dependencies
(RPC)
Basically, this is the application that controls COM+ Event
System. One of the support files that you'll probably never
Real World have any use for, but if you disable it, the warning notices you
Description receive are worse than leaving it enabled. Disabling this
service will generate Event Log entries noting it isn't running.
An annoyance, but not harmful.
Computer Browser Service
Service Name Browser Process Name svchost.exe -k netsvcs

Microsoft Service Maintains an updated list of computers on the network and
supplies this list to computers designated as browsers. If this
service is stopped, this list will not be updated or maintained. If
Description
Dependencies Server Workstation
Straightforward as can be, it keeps track of your computers on
Real World
the network. If you're on a LAN, set it to Automatic. For stand
Description
alone systems, Disable is the way to go.
Cryptographic Services Service
Service Name CryptSvc Process Name svchost.exe -k netsvcs

Provides three management services: Catalog Database
Service, which confirms the signatures of Windows files;
Protected Root Service, which adds and removes Trusted Root
Microsoft Service Certification Authority certificates from this computer; and Key
Description Service, which helps enroll this computer for certificates. If this
service is stopped, these management services will not
function properly. If this service is disabled, any services that
Dependencies
(RPC)
Provides the annoying boxes that pop up telling you a driver
Real World
you are about to install isn't digitally signed. If you disable this
Description
service you'll be flooded with uncertified driver notifications.
DCOM Server Process Launcher
Service Name DcomLaunch Process Name svchost -k DcomLaunch

Default Settings XP Home : Not Available XP Pro :Not Available
XP Home w/SP2: Automatic XP Pro w/SP2 : Automatic

Microsoft Service
Provides launch functionality for DCOM services.
Description
Dependencies No dependencies
DHCP Client Service
Service Name Dhcp Process Name svchost.exe -k netsvcs

Microsoft Service Manages network configuration by registering and updating IP
Description addresses and DNS names.
AFD Networking Support
Dependencies NetBios over Tcpip
Environment
Dependencies TCP/IP Protocol Driver IPSEC driver
This is how your computer gets a Dynamic IP address so you
Real World can connect to the internet. If Internet Connection Sharing is
Description enabled, you need DHCP Client. Also required for most
DSL/Cable connections.
Distributed Link Tracking Client Service
Service Name TrkWks Process Name svchost.exe -k netsvcs

Microsoft Service Maintains links between NTFS files within a computer or across
Description computers in a network domain.
Dependencies
(RPC)
For those that are part of a domain -and- use NTFS it has some
Real World
value in keeping links across machines up to date, especially in
Description
the case of databases updated via the network.
Distributed Transaction Coordinator Service
Service Name MSDTC Process Name msdtc.exe

Coordinates transactions that span multiple resource
managers, such as databases, message queues, and file
Microsoft Service
systems. If this service is stopped, these transactions will not
Description
occur. If this service is disabled, any services that explicitly
depend on it will fail to start.
Dependencies Security Accounts Manager
(RPC)
Real World Closely related to Distributed Link Tracking Client discussed
Description previously. Really serves no purpose for home user systems.
DNS Client Service
svchost.exe -k
Service Name Dnscache Process Name
NetworkService
Resolves and caches Domain Name System (DNS) names for
this computer. If this service is stopped, this computer will not
Microsoft Service
be able to resolve DNS names and locate Active Directory
Description
domain controllers. If this service is disabled, any services that
Dependencies TCP/IP Protocol Driver
As the description above states, it caches Domain Name
Real World System (DNS) names for this computer. If disabled, it simply
Description means the system will go upstream to resolve DNS names
rather than use the cache.
Error Reporting Service
Service Name ERSvc Process Name svchost.exe -k netsvcs

Microsoft Service Allows error reporting for services and applications running in
Description non-standard environments.
Dependencies
(RPC)
Real World This is responsible for the box that pops up wanting you to
Description report an application error or system crash to Microsoft.
Event Log Service
Service Name Eventlog Process Name services.exe

Enables event log messages issued by Windows-based
Microsoft Service
programs and components to be viewed in Event Viewer. This
Description
service cannot be stopped.
Dependencies
(RPC)
One of the few services that actually cannot be stopped. Event
Real World
logs can be viewed through the Microsoft Management
Description
Console.
Fast User Switching Compatibility Service
Service Name FastUser Process Name svchost.exe -k netsvcs

Switching
Compatibility
Microsoft Service Provides management for applications that require assistance
Description in a multiple user environment.
Dependencies Terminal Services
Supplies the 'Switch User' functionality associated with the
Real World
logoff option. It's a nice touch if you really do have that many
Description
users that are constantly switching in and out of the same box.
Help and Support Service
Service Name helpsvc Process Name svchost.exe

Enables Help and Support Center to run on this computer. If
Microsoft Service this service is stopped, Help and Support Center will be
Description unavailable. If this service is disabled, any services that
Dependencies
(RPC)
Real World This connects to the online help via Microsoft available from
Description the Help and Support option on the Start Menu.
Human Interface Device Access [SP2 Terminology]

HID Input Service [Pre SP2 Terminology]
Service Name HidServ Process Name svchost.exe -k netsvcs

Default Settings XP Home : Disabled XP Pro : Disabled
Enables generic input access to Human Interface Devices
(HID), which activates and maintains the use of predefined hot
Microsoft Service buttons on keyboards, remote controls, and other multimedia
Description devices. If this service is stopped, hot buttons controlled by
this service will no longer function. If this service is disabled,
any services that explicitly depend on it will fail to start.
Dependencies
(RPC)
Real World If you have a peripheral that uses the items mentioned in the
Description description above this is what lets it work.
HTTP SSL
svchost.exe -k
Service Name HTTPFilter Process Name
HTTPFilter
Default Settings XP Home : Not Available XP Pro : Not Available
This service implements the secure hypertext transfer protocol (HTTPS) for the
Microsoft Service
HTTP service, using the Secure Socket Layer (SSL). If this service is disabled,
Description
Dependencies HTTP
Another added security provision for sites that make use of HTTPS such as
Real World
banking and e-commerce sites. Set it to Manual and it will kick in when
Description
needed, although just to be on the safe side I set it to Automatic.
IMAPI CD-Burning COM Service
Service Name ImapiService Process Name imapi.exe

Manages CD recording using Image Mastering Applications
Programming Interface (IMAPI). If this service is stopped, this
Microsoft Service
computer will be unable to record CDs. If this service is
Description
disabled, any services that explicitly depend on it will fail to
start.
Dependencies
As it says, if you want to have the XP CD burning capability,
Real World this will give you the power to Burn Baby, Burn. If you have a
Description problem with burning CD's, check Auto Update for a patch and
then set this service to Automatic.
Indexing Service
Service Name cisvc Process Name cisvc.exe

Indexes contents and properties of files on local and remote
Microsoft Service
computers; provides rapid access to files through flexible
Description
querying language.
Dependencies
(RPC)
Real World It can speed things up search in the windows explorer.
Description
Internet Connection - Firewall (ICF) / Sharing (ICS) Service
Service Name SharedAccess Process Name svchost.exe

Default Settings XP Home : Manual XP Pro : Automatic
XP Pro w/SP2 : Eliminated in SP2
Provides network address translation, addressing, name
Microsoft Service
resolution and/or intrusion prevention services for a home or
Description
small office network.
Application Layer Gateway
Dependencies Network Connections
Service
Network Location Remote Access Connection
Dependencies
Awareness Manager
Real World As it says above. Set this service to the same setting used for
Description Application Layer Gateway Service.
IPSEC Services Service
Service Name PolicyAgent Process Name lsass.exe

Microsoft Service Manages IP security policy and starts the ISAKMP/Oakley (IKE)
Description and the IP security driver.
Dependencies IPSEC Driver
(RPC)
Real World Primarily a host authentication device used with data transfer
Description and encryption operations on a domain.
Logical Disk Manager Service
Service Name dmserver Process Name svchost.exe

Default Settings XP Home : Manual XP Pro : Automatic
Detects and monitors new hard disk drives and sends disk
volume information to Logical Disk Manager Administrative
Microsoft Service Service for configuration. If this service is stopped, dynamic
Description disk status and configuration information may become out of
date. If this service is disabled, any services that explicitly
Dependencies Plug and Play
(RPC)
Essential to managing and updating the hard drives. Works in
Real World
conjunction with Disk Management plug-in in Microsoft
Description
Management Console.
Logical Disk Manager Administrative Service
dmadmin.exe
Service Name dmadmin Process Name
/com
Microsoft Service Configures hard disk drives and volumes. The service only runs
Description for configuration processes and then stops.
Dependencies Plug and Play Logical Disk Manager
Dependencies
(RPC)
Real World Works in concert with Logical Disk Manager, but can be set to
Description Manual and it will be started and stopped as stated above.
Machine Debug Manager Service
Service Name MDM Process Name mdm.exe

Microsoft Service Manages local and remote debugging for Visual Studio
Description debuggers
Dependencies
(RPC)
Messenger Service
Service Name Messenger Process Name svchost.exe -k netsvcs


Microsoft Service Transmits net send and Alerter service messages between
Description clients and servers. This service is not related to Windows
Messenger. If this service is stopped, Alerter messages will not
be transmitted. If this service is disabled, any services that
Dependencies NetBIOS Interface Plug and Play
(RPC)
MS Software Shadow Copy Provider Service
Service Name SwPrv Process Name dllhost.exe

Manages software-based volume shadow copies taken by the
Volume Shadow Copy service. If this service is stopped,
Microsoft Service
software-based volume shadow copies cannot be managed. If
Description
Dependencies
(RPC)
Real World Related to using the Microsoft Backup Utility. If you use it, you
Description might want to set this to Manual.
Net Logon Service
Service Name Netlogon Process Name lsass.exe

Microsoft Service Supports pass-through authentication of account logon events
Description for computers in a domain.
Domain Authentication, used when you log into the Domain.
Real World
No domain? No Net Logon needed in spite of the way the name
Description
sounds.
NetMeeting Remote Desktop Sharing Service

Service Name mnmsrvc Process Name mnmsrvc.exe
Enables an authorized user to access this computer remotely
by using NetMeeting over a corporate intranet. If this service is
Microsoft Service
stopped, remote desktop sharing will be unavailable. If this
Description
service is disabled, any services that explicitly depend on it will
fail to start.
Dependencies
Real World Makes it possible for a remote user with NetMeeting to access
Description your computer.
Network Connections Service
Service Name Netman Process Name svchost.exe -k netsvcs

Manages objects in the Network and Dial-Up Connections
Microsoft Service
folder, in which you can view both local area network and
Description
remote connections.
Dependencies
(RPC)
Real World Basically, it controls the network and your ability to connect to
Description the internet via Dial-Up.
Network DDE Service
Service Name NetDDE Process Name netdde.exe

Provides network transport and security for Dynamic Data
Exchange (DDE) for programs running on the same computer
Microsoft Service or on different computers. If this service is stopped, DDE
Description transport and security will be unavailable. If this service is
start.
Dependencies Network DDE DSDM
Network Location Awareness (NLA) Service
Service Name Nla Process Name svchost.exe -k netsvcs

Collects and stores network configuration and location
Microsoft Service
information, and notifies applications when this information
Description
changes.
Environment
Real World A part of the Internet Connection Sharing (ICS) component. It is
Description also related with firewall.
Network Provisioning Service
Service Name xmlprov Process Name svchost.exe -k netsvcs

Microsoft Service Manages XML (XML (Extensible Markup Language) configuration

Description files on a domain basis for automatic network provisioning.
Dependencies Remote Procedure Call (RPC)
NT LM Security Support Provider Service
Service Name NtLmSsp Process Name lsass.exe

Microsoft Service Provides security to remote procedure call (RPC) programs that
Description use transports other than named pipes.
Dependencies
Real World
Provides support for Telnet and Message Queuing
Description
Performance Logs and Alerts Service
Service Name SysmonLog Process Name smlogsvc.exe

Collects performance data from local or remote computers
based on preconfigured schedule parameters, then writes the
Microsoft Service data to a log or triggers an alert. If this service is stopped,
Description performance information will not be collected. If this service is
start.
Dependencies
Another way to monitor system performance. If the box and
Real World
network stats interest you, set this to Manual. If ignorance is
Description
bliss, Disabled is the way to go.
Plug and Play Service
Service Name PlugPlay Process Name services.exe

Enables a computer to recognize and adapt to hardware
Microsoft Service
changes with little or no user input. Stopping or disabling this
Description
service will result in system instability.
Dependencies
Real World This is the automatic discovery of devices attached to your
Description computer.
Portable Media Serial Number Service
Service Name WmdmPmSp Process Name svchost.exe

Retrieves the serial number of any portable media player connected to this
Microsoft Service
computer. If this service is stopped, protected content might not be down
Description
loaded to the device.
Dependencies
Real World Retrieves a serial number embedded into portable music
Description players.
Print Spooler Service
Service Name Spooler Process Name spoolsv.exe

XP Pro w/SP2 : Automatic
Microsoft Service
Loads files to memory for later printing.
Description
Dependencies
(RPC)
Real World
We used to call this the print que, but spooler works also.
Description
Protected Storage Service
Service Name ProtectedStorage Process Name lsass.exe

Provides protected storage for sensitive data, such as private
Microsoft Service
keys, to prevent access by unauthorized services, processes,
Description
or users.
By 'sensitive data' they mean passwords, encryption data, etc.
Closely tied into other 'features' like AutoComplete. The
Protected Storage service certainly needs to be active if you
Real World
are using Outlook Express, otherwise you have to type the
Description
password every time you want to check your emails. So it
doesn't just have to do with autocomplete or password storage
for Internet Explorer.
QoS RSVP Service
Service Name RSVP Process Name rsvp.exe

Microsoft Service Provides network signaling and local traffic control setup
Description functionality for QoS-aware programs and control applets.
Dependencies AFD Networking Support Environment
(RPC)
Real World Supposedly provides a form of load balancing that shifts
Description bandwidth between applications where it's most needed.
Remote Access Auto Connection Manager Service
Service Name RasAuto Process Name svchost.exe -k netsvcs

XP Pro :
Default Settings XP Home : Manual
Manual
Microsoft Service Creates a connection to a remote network whenever a program
Description references a remote DNS or NetBIOS name or address.
Dependencies Remote Access Connection Manager Telephony
Allows you to click an embedded link and automatically access
Real World
the network. Can also play a role in DUN and DSL/Cable
Description
connections.
Remote Access Connection Manager Service
Service Name RasMan Process Name svchost.exe -k netsvcs

Microsoft Service
Creates a network connection.
Description
Dependencies Telephony
Real World
Exactly what it says above.
Description
Remote Desktop Help Session Manager Service
Service Name RDSessMgr Process Name sessmgr.exe

Manages and controls Remote Assistance. If this service is
Microsoft Service stopped, Remote Assistance will be unavailable. Before
Description stopping this service, see the Dependencies tab of the
Properties dialog box.
Dependencies
(RPC)
Real World
If you're a Remote Desktop user, keep this enabled.
Description
Remote Procedure Call (RPC) Service
Service Name RpcSs Process Name svchost -k rpcss

Microsoft Service Provides the endpoint mapper and other miscellaneous RPC
Description services.
Dependencies
Real World Its A Very Important Service And Required By Some Core
Description Operation To Run By System.
Remote Procedure Call (RPC) Locator Service
Service Name RpcLocator Process Name locator.exe

Microsoft Service
Manages the RPC name service database.
Description
Remote Registry Service
svchost.exe -k
Service Name RemoteRegistry Process Name
LocalService
Default Settings XP Home : Not Available XP Pro : Automatic
Enables remote users to modify registry settings on this
computer. If this service is stopped, the registry can be
Microsoft Service
modified only by users on this computer. If this service is
Description
start.
Removable Storage Service
Service Name NtmsSvc Process Name svchost.exe -k netsvcs

Microsoft Service
No Description Given
Description
Dependencies
(RPC)
Real World
Used for things like Zip Drives, Tape Drives, Graphics Pens.
Description
outing and Remote Access Service
Service Name RemoteAccess Process Name svchost.exe -k netsvcs

Default Settings XP Home : Disabled XP Pro : Manual
Microsoft Service Offers routing services to businesses in local area and wide
Description area network environments.
Dependencies NetBIOSGroup
(RPC)
Real World
Allows LAN and WAN dial in access to the computer.
Description
ScriptBlocking Service
Service Name Process Name

Default Settings XP Home : XP Pro :
Microsoft Service
None
Description
Dependencies
Real World
Installed by Symantec and relates to malicious script blocking.
Description
Secondary Logon Service
Service Name seclogon Process Name svchost.exe -k netsvcs

Enables starting processes under alternate credentials. If this
Microsoft Service service is stopped, this type of logon access will be
Dependencies
When Microsoft says 'Alternate Credentials' they are talking
Real World about the [Run As...] command which appears on the context
Description menu, allowing a Limited User to run an executable as a higher
level user.
Security Accounts Manager Service

Service Name SamSs Process Name lsass.exe
Microsoft Service
Stores security information for local user accounts.
Description
Dependencies
(RPC)
Real World Related to the Secondary Logon function and another security
Description info warehouse, similar to Protected Storage.
Security Center
Service Name wscsvc Process Name svchost.exe -k netsvcs

Microsoft Service
Monitors system security settings and configurations.
Description
Windows Management
Dependencies Event Log
Instrumentation
Server Service
Service Name lanmanserver Process Name svchost.exe -k netsvcs

Supports file, print, and named-pipe sharing over the network
Microsoft Service for this computer. If this service is stopped, these functions will
Description be unavailable. If this service is disabled, any services that
Dependencies
Real World Provides basic file and print services on the LAN. No LAN? You
Description don't need this.
Shell Hardware Detection Service
Service Name ShellHWDetection Process Name svchost.exe -k netsvcs

Microsoft Service Provides notifications for AutoPlay hardware events.
Description
Dependencies
(RPC)
Real World Testing shows that it's related to AutoPlay functionality such as
Description digital cameras, CD ROM's
Smart Card Service
Service Name SCardSvr Process Name SCardSvr.exe

Manages access to smart cards read by this computer. If this
Microsoft Service service is stopped, this computer will be unable to read smart
Description cards. If this service is disabled, any services that explicitly
Real World Just what the description says. If you have a Smart Card you
Description need this.
Smart Card Helper Service
Service Name SCardDrv Process Name SCardSvr.exe

XP Pro w/SP2 : Eliminated in SP2
Enables support for legacy non-plug and play smart-card
readers used by this computer. If this service is stopped, this
Microsoft Service
computer will not support legacy reader. If this service is
Description
start.
Dependencies
Real World The same as Smart Card except this is for legacy cards that
Description don't support Plug and Play.
System Event Notification Service
Service Name SENS Process Name svchost.exe -k netsvcs

Microsoft Service Tracks system events such as Windows logon, network, and
Description power events. Notifies COM+ Event System subscribers of
these events.
Dependencies COM+ Event System
Whether your system actually has need for this depends on
Real World
what you have installed, but many applications have processes
Description
that are run through System Event Notification.
SSDP Discovery Service
svchost.exe -k
Service Name SSDPSRV Process Name
LocalService
Microsoft Service
Enables discovery of UPnP devices on your home network.
Description
Dependencies HTTP
Remember, a UPnP device is external (not inside the computer
case) and a part of the local network. Universal Plug and Play
(UPnP) is a set of networking protocols promulgated by the UPnP Forum. The
goals of UPnP are to allow devices to connect seamlessly and to simplify the
implementation of networks in the home (data sharing, communications, and
entertainment) and in corporate environments for simplified installation of
computer components. UPnP achieves this by defining and publishing UPnP
device control protocols (DCP) built upon open, Internet-based communication
Real World standards.
Description
The term UPnP is derived from plug-and-play, a technology for dynamically
attaching devices directly to a computer, although UPnP is not directly related
to the earlier plug-and-play technology. UPnP devices are "plug-and-play" in
that when connected to a network they automatically announce their network
address and supported device and services types, enabling clients that
recognize those types to immediately begin using the device.
System Restore Service
Service Name srservice Process Name svchost.exe -k netsvcs

Performs system restore functions. To stop service, turn off
Microsoft Service
System Restore from the System Restore tab in My Computer-
Description
>Properties
Dependencies
(RPC)
Real World Allows you to take a snapshot of your system and then roll it
Description back to that particular point in time.
Task Scheduler Service
Service Name Schedule Process Name svchost.exe -k netsvcs

Enables a user to configure and schedule automated tasks on
Microsoft Service this computer. If this service is stopped, these tasks will not be
Description run at their scheduled times. If this service is disabled, any
Dependencies
(RPC)
TCP/IP NetBIOS Helper Service
svchost.exe -k
Service Name LmHosts Process Name
LocalService
Microsoft Service Enables support for NetBIOS over TCP/IP (NetBT) service and
Description NetBIOS name resolution.
Dependencies Net BT
Environment
Telephony Service
Service Name TapiSrv Process Name svchost.exe -k netsvcs

Provides Telephony API (TAPI) support for programs that control
Microsoft Service telephony devices and IP based voice connections on the local
Description computer and, through the LAN, on servers that are also
running the service.
(RPC)
Real World Basically controls all dialup activity and in some cases
Description DSL/Cable activity.
Telnet Service
Service Name TlntSvr Process Name tlntsvr.exe
Default Settings XP Home : Not Available XP Pro : Manual
Enables a remote user to log on to this computer and run
programs, and supports various TCP/IP Telnet clients, including
Microsoft Service UNIX-based and Windows-based computers. If this service is
Description stopped, remote user access to programs might be
unavailable. If this service is disabled, any services that
Dependencies NT LM Security Support Provider
(RPC)
Terminal Services Service
svchost -k
Service Name TermService Process Name
DComLaunch
Allows multiple users to be connected interactively to a
machine as well as the display of desktops and applications to
Microsoft Service
remote computers. The underpinning of Remote Desktop
Description
(including RD for Administrators), Fast User Switching, Remote
Assistance, and Terminal Server.
Dependencies
(RPC)
Themes Service
Service Name Themes Process Name svchost.exe -k netsvcs

Default Settings XP Home : Automatic XP Pro : Manual

Microsoft Service
Provides user experience theme management.
Description
Dependencies
If you like the themes in XP, this makes them available. Setting
Real World
this to Automatic allows all users to access themes if they
Description
wish.
Uninterruptible Power Supply Service

Service Name UPS Process Name ups.exe
Microsoft Service Manages an uninterruptible power supply (UPS) connected to
Description the computer.
Dependencies
Just what it says above. How your UPS connects to the
Real World
computer really determines whether this is needed. Many USB
Description
connected UPS's don't need this service.
Universal Plug and Play Device Host Service
svchost.exe -k
Service Name upnphost Process Name
LocalService
Microsoft Service
Provides support to host Universal Plug and Play devices.
Description
Dependencies HTTP SSDP Discovery Service
Upload Manager Service
Service Name uploadmgr Process Name svchost.exe

Manages synchronous and asynchronous file transfers between
clients and servers on the network. If this service is stopped,
Microsoft Service synchronous and asynchronous file transfers between clients
Description and servers on the network will not occur. If this service is
start.
Dependencies
(RPC)
Real World
Description
Volume Shadow Copy Service
Service Name VSS Process Name vssvc.exe

Microsoft Service Manages and implements Volume Shadow Copies used for
Description backup and other purposes. If this service is stopped, shadow
copies will be unavailable for backup and the backup may fail.
If this service is disabled, any services that explicitly depend
on it will fail to start.
Dependencies
(RPC)
WebClient Service
svchost.exe -k
Service Name WebClient Process Name
LocalService
Enables Windows-based programs to create, access, and
Microsoft Service modify Internet-based files. If this service is stopped, these
Description functions will not be available. If this service is disabled, any
Dependencies WebDav Client Redirector
Windows Audio Service
Service Name AudioSrv Process Name svchost.exe -k netsvcs

Manages audio devices for Windows-based programs. If this
Microsoft Service service is stopped, audio devices and effects will not function
Description properly. If this service is disabled, any services that explicitly
(RPC)
Windows Firewall/Internet Connection Sharing (ICS)
Service Name SharedAccess Process Name svchost.exe -k netsvcs

Microsoft Service Provides network address translation, addressing, name resolution and/or
Description intrusion prevention services for a home or small office network.
Dependencies Network Connections
Dependencies Windows Management Event Log / Remote Procedure Call
Instrumentation (RPC)
Windows Image Acquisition (WIA) Service
Service Name stisvc Process Name svchost.exe -k imgsvc

Microsoft Service
Provides image acquisition services for scanners and cameras.
Description
Dependencies
(RPC)
Real World
Controls web cams, cameras, and scanners.
Description
Windows Installer Service
Service Name MSIServer Process Name msiexec.exe /V

Adds, modifies, and removes applications provided as a Windows Installer
Microsoft Service
(*.msi) package. If this service is disabled, any services that explicitly depend
Description
on it will fail to start.
Dependencies
(RPC)
Real World
Used to install applications that use .msi installation files.
Description
Windows Management Instrumentation Service
Service Name Winmgmt Process Name svchost.exe -k netsvcs

Provides a common interface and object model to access
management information about operating system, devices,
Microsoft Service applications and services. If this service is stopped, most
Description Windows-based software will not function properly. If this
service is disabled, any services that explicitly depend on it will
fail to start.
Dependencies Event Log Remote procedure Call (RPC)
Windows Management Instrumentation Driver Extensions

Service Name Wmi Process Name svchost.exe -k netsvcs
Default Settings XP Home : Not Available XP Pro : Manual
Microsoft Service Provides systems management information to and from
Description drivers.
Dependencies
Windows Time Service
Service Name W32Time Process Name svchost.exe -k netsvcs

Maintains date and time synchronization on all clients and
Microsoft Service servers in the network. If this service is stopped, date and time
Description synchronization will be unavailable. If this service is disabled,
Dependencies
Wireless Zero Configuration Service
Service Name WZCSVC Process Name svchost.exe -k netsvcs

Microsoft Service
Provides automatic configuration for the 802.11 adapters
Description
NDIS Usermode I/O Remote Procedure Call
Dependencies
Protocol (RPC)
Real World
Auto configuration for wireless network devices.
Description
WMI Performance Adapter Service
Service Name WmiApSrv Process Name wmiapsrv.exe

Microsoft Service Provides performance library information from WMI HiPerf
Description providers.
Dependencies Remote Procedure Call
(RPC)
Workstation Service
lanmanworkstatio
Service Name Process Name svchost.exe -k netsvcs
n
Creates and maintains client network connections to remote
Microsoft Service servers. If this service is stopped, these connections will be

Windows Services

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Windows Services

Uploaded by

Copyright:

Available Formats

Windows Services

Application Layer Gateway Service

Service Name ALG Process Name alg.exe

Application Management Service

Service Name AppMgmt Process Name svchost.exe -k netsvcs

Automatic Updates Service

Service Name Wuauserv Process Name svchost.exe -k netsvcs

Background Intelligent Transfer Service

Service Name BITS Process Name svchost.exe -k netsvcs

Service Name ClipSrv Process Name clipsrv.exe

XP Pro w/ SP2 : Disabled

COM+ Event System Service

Service Name EventSystem Process Name svchost.exe

COM+ System Application Service

Service Name COMSysApp Process Name dllhost.exe

Computer Browser Service

Service Name Browser Process Name svchost.exe -k netsvcs

Cryptographic Services Service

Service Name CryptSvc Process Name svchost.exe -k netsvcs

DCOM Server Process Launcher

Service Name DcomLaunch Process Name svchost -k DcomLaunch

XP Home w/SP2: Automatic XP Pro w/SP2 : Automatic

DHCP Client Service

Service Name Dhcp Process Name svchost.exe -k netsvcs

Distributed Link Tracking Client Service

Service Name TrkWks Process Name svchost.exe -k netsvcs

Distributed Transaction Coordinator Service

Service Name MSDTC Process Name msdtc.exe

DNS Client Service

Error Reporting Service

Service Name ERSvc Process Name svchost.exe -k netsvcs

Event Log Service

Service Name Eventlog Process Name services.exe

Fast User Switching Compatibility Service

Service Name FastUser Process Name svchost.exe -k netsvcs

Help and Support Service

Service Name helpsvc Process Name svchost.exe

Human Interface Device Access [SP2 Terminology]

Service Name HidServ Process Name svchost.exe -k netsvcs

IMAPI CD-Burning COM Service

Service Name ImapiService Process Name imapi.exe

Service Name cisvc Process Name cisvc.exe

Internet Connection - Firewall (ICF) / Sharing (ICS) Service

Service Name SharedAccess Process Name svchost.exe

IPSEC Services Service

Service Name PolicyAgent Process Name lsass.exe

Logical Disk Manager Service

Service Name dmserver Process Name svchost.exe

Logical Disk Manager Administrative Service

Machine Debug Manager Service

Service Name MDM Process Name mdm.exe

Service Name Messenger Process Name svchost.exe -k netsvcs

XP Pro w/SP2 : Disabled

MS Software Shadow Copy Provider Service

Service Name SwPrv Process Name dllhost.exe

Net Logon Service

Service Name Netlogon Process Name lsass.exe

NetMeeting Remote Desktop Sharing Service

Network Connections Service

Service Name Netman Process Name svchost.exe -k netsvcs

Network DDE Service

Service Name NetDDE Process Name netdde.exe

Network Location Awareness (NLA) Service

Service Name Nla Process Name svchost.exe -k netsvcs