-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathwin_service_documentation.txt
2447 lines (2180 loc) · 118 KB
/
win_service_documentation.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Name : AJRouter
DisplayName : AllJoyn Router Service
Description : Routes AllJoyn messages for the local AllJoyn clients. If this service is stopped the AllJoyn clients that do not have their own bundled routers will be unable to run.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode : Manual
Notes : AllJoyn is an open source software framework that allows devices to communicate with other devices around them.
IoT Guidance: OK to disable
Tags : #iot #networking
Name : ALG
DisplayName : Application Layer Gateway Service
Description : Provides support for 3rd party protocol plug-ins for Internet Connection Sharing
PathName : C:\Windows\System32\alg.exe
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #networking
Name : BcastDVRUserService_*
DisplayName : GameDVR and Broadcast User Service_*
Description : This user service is used for Game Recordings and Live Broadcasts
PathName : C:\WINDOWS\system32\svchost.exe -k BcastDVRUserService
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #gaming
Name : BDESVC
DisplayName : BitLocker Drive Encryption Service
Description : BDESVC hosts the BitLocker Drive Encryption service. BitLocker Drive Encryption provides secure startup for the operating system, as well as full volume encryption for OS, fixed or removable
volumes. This service allows BitLocker to prompt users for various actions related to their volumes when mounted, and unlocks volumes automatically without user interaction. Additionally, it
stores recovery information to Active Directory, if available, and, if necessary, ensures the most recent recovery certificates are used. Stopping or disabling the service would prevent users
from leveraging this functionality.
PathName : C:\WINDOWS\System32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : IoT Guidance: Do not disable
Tags : #system
Name : BFE
DisplayName : Base Filtering Engine
Description : The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will
significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications.
PathName : C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
StartMode : Auto
Notes : do not disable
Tags : #networking
Name : BluetoothUserService_*
DisplayName : Bluetooth User Support Service_*
Description : The Bluetooth user service supports proper functionality of Bluetooth features relevant to each user session.
PathName : C:\Windows\system32\svchost.exe -k BthAppGroup -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #networking, #bluetooth
Name : BthAvctpSvc
DisplayName : AVCTP service
Description : This is Audio Video Control Transport Protocol service
PathName : C:\Windows\system32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #networking, #bluetooth
Name : BTAGService
DisplayName : Bluetooth Audio Gateway Service
Description : Service supporting the audio gateway role of the Bluetooth Handsfree Profile.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #networking, #bluetooth
Name : bthserv
DisplayName : Bluetooth Support Service
Description : The Bluetooth service supports discovery and association of remote Bluetooth devices. Stopping or disabling this service may cause already installed Bluetooth devices to fail to operate properly
and prevent new devices from being discovered or associated.
PathName : C:\Windows\system32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #networking, #bluetooth
Name : BrokerInfrastructure
DisplayName : Background Tasks Infrastructure Service
Description : Windows infrastructure service that controls which background tasks can run on the system.
PathName : C:\Windows\system32\svchost.exe -k DcomLaunch -p
StartMode : Auto
Notes : cannot be disabled
IoT Guidance: Do not disable
Tags : #system
Name : CaptureService_*
DisplayName : CaptureService_*
Description : Enables optional screen capture functionality for applications that call the Windows.Graphics.Capture API.
PathName : C:\Windows\system32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags :
Name : cbdhsvc_*
DisplayName : Clipboard User Service_*
Description : This user service is used for Clipboard scenarios
PathName : C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
StartMode : Auto
Notes : IoT Guidance: OK to disable
Issues : Calculator App will crash when trying to copy results if this is not running
Tags :
Name : diagnosticshub.standardcollector.service
DisplayName : Microsoft (R) Diagnostics Hub Standard Collector Service
Description : Diagnostics Hub Standard Collector Service. When running, this service collects real time ETW events and processes them.
PathName : C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
StartMode : Manual
Notes : Event Tracing for Windows (ETW)
https://learn.microsoft.com/en-us/dotnet/framework/wcf/samples/etw-tracing
IoT Guidance: Do not disable
Tags : #system
Name : DiagTrack
DisplayName : Connected User Experiences and Telemetry
Description : The Connected User Experiences and Telemetry service enables features that support in-application and connected user experiences. Additionally, this service manages the event driven collection
and transmission of diagnostic and usage information (used to improve the experience and quality of the Windows Platform) when the diagnostics and usage privacy option settings are enabled
under Feedback and Diagnostics.
PathName : C:\WINDOWS\System32\svchost.exe -k utcsvc -p
StartMode : Auto
Notes : IoT Guidance: OK to disable
Tags : #tracking
Name : dmwappushservice
DisplayName : Device Management Wireless Application Protocol (WAP) Push message Routing Service
Description : Routes Wireless Application Protocol (WAP) Push messages received by the device and synchronizes Device Management sessions
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : related to SMS messages?
Server Guidance: ok to disable
Tags :
Name : DPS
DisplayName : Diagnostic Policy Service
Description : The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function.
PathName : C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p
StartMode : Auto
Notes : IoT Guidance: Do not disable
Tags :
Name : WdiServiceHost
DisplayName : Diagnostic Service Host
Description : The Diagnostic Service Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local Service context. If this service is stopped, any diagnostics that depend on
it will no longer function.
PathName : C:\WINDOWS\System32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : related to DPS
IoT Guidance: Do not disable
Tags :
Name : WdiSystemHost
DisplayName : Diagnostic System Host
Description : The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context. If this service is stopped, any diagnostics that depend on
it will no longer function.
PathName : C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : related to DPS
IoT Guidance: Do not disable
Tags :
Name : diagsvc
DisplayName : Diagnostic Execution Service
Description : Executes diagnostic actions for troubleshooting support
PathName : C:\Windows\System32\svchost.exe -k diagnostics
StartMode : Manual
Notes : IoT Guidance: Do not disable
Tags :
Name : EntAppSvc
DisplayName : Enterprise App Management Service
Description : Enables enterprise application management.
PathName : C:\Windows\system32\svchost.exe -k appmodel -p
StartMode : Manual
Notes : cannot be disabled
IoT Guidance: OK to disable
Tags : #system
Name : Fax
DisplayName : Fax
Description : Enables you to send and receive faxes, utilizing fax resources available on this computer or on the network.
PathName : C:\WINDOWS\system32\fxssvc.exe
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags :
Name : fhsvc
DisplayName : File History Service
Description : Protects user files from accidental loss by copying them to a backup location
PathName : C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : used by Windows Backup
IoT Guidance: Do not disable
Tags :
Name : FontCache
DisplayName : Windows Font Cache Service
Description : Optimizes performance of applications by caching commonly used font data. Applications will start this service if it is not already running. It can be disabled, though doing so will degrade
application performance.
PathName : C:\WINDOWS\system32\svchost.exe -k LocalService -p
StartMode : Auto
Notes : can be disabled
Tags :
Name : FontCache3.0.0.0
DisplayName : Windows Presentation Foundation Font Cache 3.0.0.0
Description : Optimizes performance of Windows Presentation Foundation (WPF) applications by caching commonly used font data. WPF applications will start this service if it is not already running. It can be
disabled, though doing so will degrade the performance of WPF applications.
PathName : C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
StartMode : Manual
Notes : can be disabled
Tags :
Name : FrameServer
DisplayName : Windows Camera Frame Server
Description : Enables multiple clients to access video frames from camera devices.
PathName : C:\WINDOWS\System32\svchost.exe -k Camera
StartMode : Manual
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : FrameServerMonitor
DisplayName : Windows Camera Frame Server Monitor
Description : Monitors the health and state for the Windows Camera Frame Server service.
PathName : C:\Windows\System32\svchost.exe -k CameraMonitor
StartMode : Manual
Notes : related to FrameServer
Tags :
Name : iphlpsvc
DisplayName : IP Helper
Description : Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not
have the enhanced connectivity benefits that these technologies offer.
PathName : C:\Windows\System32\svchost.exe -k NetSvcs -p
StartMode : Auto
Notes : Needed for Xbox Live?
IoT Guidance: OK to disable
Tags : #networking
Name : IpxlatCfgSvc
DisplayName : IP Translation Configuration Service
Description : Configures and enables translation from v4 to v6 and vice versa
PathName : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : related to iphlpsvc?
IoT Guidance: OK to disable
Tags : #networking
Name : lfsvc
DisplayName : Geolocation Service
Description : This service monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service,
applications will be unable to use or receive notifications for geolocation or geofences.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #tracking
Name : LicenseManager
DisplayName : Windows License Manager Service
Description : Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then content acquired through the Microsoft Store will not
function properly.
PathName : C:\Windows\System32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #msstore
Name : ClipSVC
DisplayName : Client License Service (ClipSVC)
Description : Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled applications bought using Windows Store will not behave
correctly.
PathName : C:\Windows\System32\svchost.exe -k wsappx -p
StartMode : Manual
Notes : cannot be disabled
IoT Guidance: OK to disable
Tags : #msstore
Name : InstallService
DisplayName : Microsoft Store Install Service
Description : Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then installations will not function properly.
PathName : C:\Windows\System32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #msstore
Name : PushToInstall
DisplayName : Windows PushToInstall Service
Description : Provides infrastructure support for the Microsoft Store. This service is started automatically and if disabled then remote installations will not function properly.
PathName : C:\Windows\System32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : "Push to Install" is a feature that allows you to remotely install an app on Windows 10 devices where you have an account
IoT Guidance: OK to disable
Tags : #msstore
Name : lmhosts
DisplayName : TCP/IP NetBIOS Helper
Description : Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and
log on to the network. If this service is stopped, these functions might be unavailable. If this service is disabled, any services that explicitly depend on it will fail
to start.
PathName : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #networking
Name : MapsBroker
DisplayName : Downloaded Maps Manager
Description : Windows service for application access to downloaded maps. This service is started on-demand by application accessing downloaded maps. Disabling this service will prevent
apps from accessing maps.
PathName : C:\Windows\System32\svchost.exe -k NetworkService -p
StartMode : Auto
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : MSDTC
DisplayName : Distributed Transaction Coordinator
Description : Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will
fail. If this service is disabled, any services that explicitly depend on it will fail to start.
PathName : C:\Windows\System32\msdtc.exe
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags :
Name : KtmRm
DisplayName : KtmRm for Distributed Transaction Coordinator
Description : Coordinates transactions between the Distributed Transaction Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it is recommended that this
service remain stopped. If it is needed, both MSDTC and KTM will start this service automatically. If this service is disabled, any MSDTC transaction interacting with a
Kernel Resource Manager will fail and any services that explicitly depend on it will fail to start.
PathName : C:\Windows\System32\svchost.exe -k NetworkServiceAndNoImpersonation -p
StartMode : Manual
Notes : related to MSDTC
IoT Guidance: Do not disable
Tags :
Name : NetTcpPortSharing
DisplayName : Net.Tcp Port Sharing Service
Description : Provides ability to share TCP ports over the net.tcp protocol.
PathName : C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
StartMode : Disabled
Notes :
Tags : #networking
Name : PcaSvc
DisplayName : Program Compatibility Assistant Service
Description : This service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems.
If this service is stopped, PCA will not function properly.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Auto
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : PerfHost
DisplayName : Performance Counter DLL Host
Description : Enables remote users and 64-bit processes to query performance counters provided by 32-bit DLLs. If this service is stopped, only local users and 32-bit processes will be
able to query performance counters provided by 32-bit DLLs.
PathName : C:\Windows\SysWow64\perfhost.exe
StartMode : Manual
Notes : IoT Guidance: Do not disable
Tags :
Name : PhoneSvc
DisplayName : Phone Service
Description : Manages the telephony state on the device
PathName : C:\Windows\system32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : Used by modern VoIP apps
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : TapiSrv
DisplayName : Telephony
Description : Provides Telephony API (TAPI) support for programs that control telephony devices on the local computer and, through the LAN, on servers that are also running the service.
PathName : C:\Windows\System32\svchost.exe -k NetworkService -p
StartMode : Manual
Notes : Disabling breaks RRAS
Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags :
Name : PNRPsvc
DisplayName : Peer Name Resolution Protocol
Description : Enables serverless peer name resolution over the Internet using the Peer Name Resolution Protocol (PNRP). If disabled, some peer-to-peer and collaborative applications,
such as Remote Assistance, may not function.
PathName : C:\Windows\System32\svchost.exe -k LocalServicePeerNet
StartMode : Manual
Notes : Configuration via 'netsh p2p pnrp'
IoT Guidance: OK to disable
Tags : #networking
Name : p2pimsvc
DisplayName : Peer Networking Identity Manager
Description : Provides identity services for the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services. If disabled, the Peer Name Resolution Protocol (PNRP) and
Peer-to-Peer Grouping services may not function, and some applications, such as HomeGroup and Remote Assistance, may not function correctly.
PathName : C:\Windows\System32\svchost.exe -k LocalServicePeerNet
StartMode : Manual
Notes : related to PNRPsvc
IoT Guidance: OK to disable
Tags :
Name : PNRPAutoReg
DisplayName : PNRP Machine Name Publication Service
Description : This service publishes a machine name using the Peer Name Resolution Protocol. Configuration is managed via the netsh context 'p2p pnrp peer'
PathName : C:\Windows\System32\svchost.exe -k LocalServicePeerNet
StartMode : Manual
Notes : related to PNRPsvc
IoT Guidance: OK to disable
Tags :
Name : p2psvc
DisplayName : Peer Networking Grouping
Description : Enables multi-party communication using Peer-to-Peer Grouping. If disabled, some applications, such as HomeGroup, may not function.
PathName : C:\Windows\System32\svchost.exe -k LocalServicePeerNet
StartMode : Manual
Notes : related to PNRPsvc?
IoT Guidance: OK to disable
Tags :
Name : PrintNotify
DisplayName : Printer Extensions and Notifications
Description : This service opens custom printer dialog boxes and handles notifications from a remote print server or a printer. If you turn off this service, you won’t be able to see
printer extensions or notifications.
PathName : C:\Windows\system32\svchost.exe -k print
StartMode : Manual
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #printing
Name : PrintWorkflowUserSvc_*
DisplayName : PrintWorkflow_*
Description : Provides support for Print Workflow applications. If you turn off this service, you may not be able to print successfully.
PathName : C:\Windows\system32\svchost.exe -k PrintWorkflow
StartMode : Manual
Notes :
Tags : #printing
Name : Spooler
DisplayName : Print Spooler
Description : This service spools print jobs and handles interaction with the printer. If you turn off this service, you won’t be able to print or see your printers.
PathName : C:\Windows\System32\spoolsv.exe
StartMode : Auto
Notes : Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #printing
Name : QWAVE
DisplayName : Quality Windows Audio Video Experience
Description : Quality Windows Audio Video Experience (qWave) is a networking platform for Audio Video (AV) streaming applications on IP home networks. qWave enhances AV streaming
performance and reliability by ensuring network quality-of-service (QoS) for AV applications. It provides mechanisms for admission control, run time monitoring and
enforcement, application feedback, and traffic prioritization.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
StartMode : Manual
Notes : Client-side QoS service
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #networking
Name : RemoteAccess
DisplayName : Routing and Remote Access
Description : Offers routing services to businesses in local area and wide area network environments.
PathName : C:\Windows\System32\svchost.exe -k netsvcs
StartMode : Disabled
Notes :
Tags : #networking
Name : RemoteRegistry
DisplayName : Remote Registry
Description : Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service
is disabled, any services that explicitly depend on it will fail to start.
PathName : C:\Windows\system32\svchost.exe -k localService -p
StartMode : Disabled
Notes : Server Guidance: Do not disable
IoT Guidance: Do not disable
Tags : #networking
Name : RetailDemo
DisplayName : Retail Demo Service
Description : The Retail Demo service controls device activity while the device is in retail demo mode.
PathName : C:\Windows\System32\svchost.exe -k rdxgroup
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags :
Name : SCardSvr
DisplayName : Smart Card
Description : Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any
services that explicitly depend on it will fail to start.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
StartMode : Manual
Notes : https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference
this is also used with YubiKey OpenPGP/PIV interfaces
IoT Guidance: OK to disable
Tags : #smartcards
Name : ScDeviceEnum
DisplayName : Smart Card Device Enumeration Service
Description : Creates software device nodes for all smart card readers accessible to a given session. If this service is disabled, WinRT APIs will not be able to enumerate smart card
readers.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
StartMode : Manual
Notes : related to SCardSvr
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #smartcards
Name : SCPolicySvc
DisplayName : Smart Card Removal Policy
Description : Allows the system to be configured to lock the user desktop upon smart card removal.
PathName : C:\Windows\system32\svchost.exe -k netsvcs
StartMode : Manual
Notes : related to SCardSvr
IoT Guidance: OK to disable
Tags : #smartcards
Name : CertPropSvc
DisplayName : Certificate Propagation
Description : Copies user certificates and root certificates from smart cards into the current user's certificate store, detects when a smart card is inserted into a smart card reader,
and, if needed, installs the smart card Plug and Play minidriver.
PathName : C:\Windows\system32\svchost.exe -k netsvcs
StartMode : Manual
Notes : related to SCardSvr
Tags : #smartcards
Name : NgcCtnrSvc
DisplayName : Microsoft Passport Container
Description : Manages local user identity keys used to authenticate user to identity providers as well as TPM virtual smart cards. If this service is disabled, local user identity keys
and TPM virtual smart cards will not be accessible. It is recommended that you do not reconfigure this service.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode : Manual
Notes : related to SCardSvr, NgcSvc
cannot be disabled
Tags : #smartcards
Name : NgcSvc
DisplayName : Microsoft Passport
Description : Provides process isolation for cryptographic keys used to authenticate to a user’s associated identity providers. If this service is disabled, all uses and management of
these keys will not be available, which includes machine logon and single-sign on for apps and websites. This service starts and stops automatically. It is recommended
that you do not reconfigure this service.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Needed for PIN/Hello logons
cannot be disabled
Server Guidance: ok to disable
Tags :
Name : seclogon
DisplayName : Secondary Logon
Description : Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any
services that explicitly depend on it will fail to start.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : Disables other credentials only password will work?
IoT Guidance: Do not disable
Tags :
Name : SEMgrSvc
DisplayName : Payments and NFC/SE Manager
Description : Manages payments and Near Field Communication (NFC) based secure elements.
PathName : C:\Windows\system32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #networking
Name : SharedAccess
DisplayName : Internet Connection Sharing (ICS)
Description : Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.
PathName : C:\Windows\System32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : Required for clients used as WiFi hotspots, and also on both ends of Miracast projection.
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags : #networking
Name : StiSvc
DisplayName : Windows Image Acquisition (WIA)
Description : Provides image acquisition services for scanners and cameras
PathName : C:\Windows\system32\svchost.exe -k imgsvc
StartMode : Manual
Notes : needed for scanners and cameras
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : WiaRpc
DisplayName : Still Image Acquisition Events
Description : Launches applications associated with still image acquisition events.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : related to StiSvc
needed for scanners and cameras
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : StorSvc
DisplayName : Storage Service
Description : Provides enabling services for storage settings and external storage expansion
PathName : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Auto
Notes : Adds 'System Volume Information' folder to external USB memory devices. Required for Microsoft Store.
external USB HDD will not work if disabled
Issues : Microsoft Store might return error 0x800706D9 when trying to install new apps.
Tags : #msstore
Name : SysMain
DisplayName : SysMain
Description : Maintains and improves system performance over time.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Auto
Notes : IoT Guidance: Do not disable
SuperFetch
Tags :
Name : TrkWks
DisplayName : Distributed Link Tracking Client
Description : Maintains links between NTFS files within a computer or across computers in a network.
PathName : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Auto
Notes : tracks the creation and movement of linked files across NTFS-formatted volumes and servers
Distributed Link Tracking tracks links in scenarios where the link is made to a file on an NTFS volume, such as shell shortcuts and OLE links.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/backup-and-storage/distributed-link-tracking-on-domain-controller
IoT Guidance: OK to disable
Tags : #networking
Name : WbioSrvc
DisplayName : Windows Biometric Service
Description : The Windows biometric service gives client applications the ability to capture, compare, manipulate, and store biometric data without gaining direct access to any
biometric hardware or samples. The service is hosted in a privileged SVCHOST process.
PathName : C:\Windows\system32\svchost.exe -k WbioSvcGroup
StartMode : Manual/Auto
Notes : Windwos Hello fingerprint reader and facial recognition
IoT Guidance: OK to disable
Tags :
Name : WerSvc
DisplayName : Windows Error Reporting Service
Description : Allows errors to be reported when programs stop working or responding and allows existing solutions to be delivered. Also allows logs to be generated for diagnostic and
repair services. If this service is stopped, error reporting might not work correctly and results of diagnostic services and repairs might not be displayed.
PathName : C:\Windows\System32\svchost.exe -k WerSvcGroup
StartMode : Manual
Notes : Collects and sends crash/hang data used by both MS and third party ISVs/IHVs. The data is used to diagnose crash-inducing bugs, which may include security bugs. Also needed for Corporate Error Reporting
Server Guidance: Do not disable
Tags : #tracking
Name : wisvc
DisplayName : Windows Insider Service
Description : Provides infrastructure support for the Windows Insider Program. This service must remain enabled for the Windows Insider Program to work.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : required for windows insider program to work
Server Guidance: ok to disable
IoT Guidance: OK to disable
Tags :
Name : WlanSvc
DisplayName : WLAN AutoConfig
Description : The WLANSVC service provides the logic required to configure, discover, connect to, and disconnect from a wireless local area network (WLAN) as defined by IEEE 802.11
standards. It also contains the logic to turn your computer into a software access point so that other devices or computers can connect to your computer wirelessly using a
WLAN adapter that can support this. Stopping or disabling the WLANSVC service will make all WLAN adapters on your computer inaccessible from the Windows networking UI. It
is strongly recommended that you have the WLANSVC service running if your computer has a WLAN adapter.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : required for Wifi to work
Tags : #networking
Name : WMPNetworkSvc
DisplayName : Windows Media Player Network Sharing Service
Description : Shares Windows Media Player libraries to other networked players and media devices using Universal Plug and Play
PathName : "C:\Program Files\Windows Media Player\wmpnetwk.exe"
StartMode : Manual
Notes :
Tags : #networking
Name : WpcMonSvc
DisplayName : Parental Controls
Description : Enforces parental controls for child accounts in Windows. If this service is stopped or disabled, parental controls may not be enforced.
PathName : C:\Windows\system32\svchost.exe -k LocalService
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags :
Name : WPDBusEnum
DisplayName : Portable Device Enumerator Service
Description : Enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and Image Import Wizard to transfer and synchronize content
using removable mass-storage devices.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags :
Name : WpnService
DisplayName : Windows Push Notifications System Service
Description : This service runs in session 0 and hosts the notification platform and connection provider which handles the connection between the device and WNS server.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Auto
Notes : Windows Push Notification Services (WNS) enable third-party developers to send toast, tile, badge, and raw updates from their own cloud service.
https://learn.microsoft.com/en-us/windows/apps/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview
Server Guidance: ok to disable
Issues :
Tags :
Name : WpnUserService_*
DisplayName : Windows Push Notifications User Service_*
Description : This service hosts Windows notification platform which provides support for local and push notifications. Supported notifications are tile, toast and raw.
PathName : C:\Windows\system32\svchost.exe -k UnistackSvcGroup
StartMode : Auto
Notes : related to WpnService
Server Guidance: ok to disable
Issues : Notification panel will not function; navigating to Settings App -> Network & Internet will results in a crash; Clock app will not function properly if this is not running
Tags :
Name : wscsvc
DisplayName : Security Center
Description : The WSCSVC (Windows Security Center) service monitors and reports security health settings on the computer. The health settings include firewall (on/off), antivirus
(on/off/out of date), antispyware (on/off/out of date), Windows Update (automatically/manually download and install updates), User Account Control (on/off), and Internet
settings (recommended/not recommended). The service provides COM APIs for independent software vendors to register and record the state of their products to the Security
Center service. The Security and Maintenance UI uses the service to provide systray alerts and a graphical view of the security health states in the Security and
Maintenance control panel. Network Access Protection (NAP) uses the service to report the security health states of clients to the NAP Network Policy Server to make
network quarantine decisions. The service also has a public API that allows external consumers to programmatically retrieve the aggregated security health state of the
system.
PathName : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode : Auto
Notes : IoT Guidance: Do not disable
Tags : #system #security
Name : EventLog
DisplayName : Windows Event Log
Description : This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can
display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system.
PathName : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode : Auto
Notes :
Tags : #system #security
Name : WSearch
DisplayName : Windows Search
Description : Provides content indexing, property caching, and search results for files, e-mail, and other content.
PathName : C:\Windows\system32\SearchIndexer.exe /Embedding
StartMode : Auto
Notes : IoT Guidance: OK to disable
Tags :
Name : XblAuthManager
DisplayName : Xbox Live Auth Manager
Description : Provides authentication and authorization services for interacting with Xbox Live. If this service is stopped, some applications may not operate correctly.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes :
Tags : #xbox
Name : XblGameSave
DisplayName : Xbox Live Game Save
Description : This service syncs save data for Xbox Live save enabled games. If this service is stopped, game save data will not upload to or download from Xbox Live.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes :
Tags : #xbox
Name : XboxGipSvc
DisplayName : Xbox Accessory Management Service
Description : This service manages connected Xbox Accessories.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes :
Tags : #xbox
Name : XboxNetApiSvc
DisplayName : Xbox Live Networking Service
Description : This service supports the Windows.Networking.XboxLive application programming interface.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes :
Tags : #xbox
Name : HvHost
DisplayName : HV Host Service
Description : Provides an interface for the Hyper-V hypervisor to provide per-partition performance counters to the host operating system.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Performance enhancers for guest VMs. Not used today except for explicitly populated VMs, but will be used in Application Guard
Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmicguestinterface
DisplayName : Hyper-V Guest Service Interface
Description : Provides an interface for the Hyper-V host to interact with specific services running inside the virtual machine.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmicheartbeat
DisplayName : Hyper-V Heartbeat Service
Description : Monitors the state of this virtual machine by reporting a heartbeat at regular intervals. This service helps you identify running virtual machines that have stopped
responding.
PathName : C:\Windows\system32\svchost.exe -k ICService -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmickvpexchange
DisplayName : Hyper-V Data Exchange Service
Description : Provides a mechanism to exchange data between the virtual machine and the operating system running on the physical computer.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmicrdv
DisplayName : Hyper-V Remote Desktop Virtualization Service
Description : Provides a platform for communication between the virtual machine and the operating system running on the physical computer.
PathName : C:\Windows\system32\svchost.exe -k ICService -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmicshutdown
DisplayName : Hyper-V Guest Shutdown Service
Description : Provides a mechanism to shut down the operating system of this virtual machine from the management interfaces on the physical computer.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmictimesync
DisplayName : Hyper-V Time Synchronization Service
Description : Synchronizes the system time of this virtual machine with the system time of the physical computer.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmicvmsession
DisplayName : Hyper-V PowerShell Direct Service
Description : Provides a mechanism to manage virtual machine with PowerShell via VM session without a virtual network.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmicvss
DisplayName : Hyper-V Volume Shadow Copy Requestor
Description : Coordinates the communications that are required to use Volume Shadow Copy Service to back up applications and data on this virtual machine from the operating system on
the physical computer.
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Manual
Notes : Server Guidance: Do not disable
IoT Guidance: OK to disable
Tags : #hyperv
Name : vmcompute
DisplayName : Hyper-V Host Compute Service
Description : Provides support for running Windows Containers and Virtual Machines.
PathName : C:\WINDOWS\system32\vmcompute.exe
Notes :
Tags : #hyperv
Name : gcs
DisplayName : Hyper-V Guest Compute Service
Description : Guest Compute Service for Hyper-V Virtual Machines. This services manages containers in a utility VM.
PathName : C:\WINDOWS\system32\vmcomputeagent.exe
Notes :
Tags : #hyperv
Name : SstpSvc
DisplayName : Secure Socket Tunneling Protocol Service
Description : Provides support for the Secure Socket Tunneling Protocol (SSTP) to connect to remote computers using VPN. If this service is disabled, users will not be able to use SSTP
to access remote servers.
PathName : C:\Windows\system32\svchost.exe -k LocalService -p
StartMode : Manual
Notes : SSTP VPN
Disabling breaks RRAS
https://www.proofpoint.com/us/threat-reference/sstp
Server Guidance: Do not disable
IoT Guidance: Do not disable
Tags : #networking
Name : wuauserv
DisplayName : Windows Update
Description : Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use
Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #winupdate
Name : TrustedInstaller
DisplayName : Windows Modules Installer
Description : Enables installation, modification, and removal of Windows updates and optional components. If this service is disabled, install or uninstall of Windows updates might fail
for this computer.
PathName : C:\Windows\servicing\TrustedInstaller.exe
StartMode : Auto
Notes :
Tags : #winupdate
Name : BITS
DisplayName : Background Intelligent Transfer Service
Description : Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN
Explorer, will be unable to automatically download programs and other information.
PathName : C:\Windows\System32\svchost.exe -k netsvcs -p
StartMode : Manual
Notes : IoT Guidance: OK to disable
Tags : #winupdate
Name : UsoSvc
DisplayName : Update Orchestrator Service
Description : Manages Windows Updates. If stopped, your devices will not be able to download and install the latest updates.
PathName : C:\Windows\system32\svchost.exe -k netsvcs -p
StartMode : Auto
Notes : Windows Update (incl. WSUS) depends on this service.
Server Guidance: Do not disable
Tags : #winupdate
Name : RpcSs
DisplayName : Remote Procedure Call (RPC)
Description : The RPCSS service is the Service Control Manager for COM and DCOM servers. It performs object activations requests, object exporter resolutions and distributed garbage
collection for COM and DCOM servers. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you
have the RPCSS service running.
PathName : C:\Windows\system32\svchost.exe -k rpcss -p
StartMode : Auto
Notes : cannot be disabled
IoT Guidance: Do not disable
Tags : #system
Name : RpcEptMapper
DisplayName : RPC Endpoint Mapper
Description : Resolves RPC interfaces identifiers to transport endpoints. If this service is stopped or disabled, programs using Remote Procedure Call (RPC) services will not function
properly.
PathName : C:\Windows\system32\svchost.exe -k RPCSS -p
StartMode : Auto
Notes : related to RpcSs; cannot be disabled
IoT Guidance: Do not disable
Tags : #system
Name : WdNisSvc
DisplayName : Microsoft Defender Antivirus Network Inspection Service
Description : Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols
PathName : "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\NisSrv.exe"
StartMode : Manual
Notes : cannot be disabled
IoT Guidance: Do not disable
Tags : #security
Name : mpssvc
DisplayName : Windows Defender Firewall
Description : Windows Defender Firewall helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network.
PathName : C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
StartMode : Auto
Notes : cannot be disabled
Tags : #security
Name : WinDefend
DisplayName : Microsoft Defender Antivirus Service
Description : Helps protect users from malware and other potentially unwanted software
PathName : "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2301.6-0\MsMpEng.exe"
StartMode : Auto
Notes : cannot be disabled
IoT Guidance: Do not disable
Tags : #security
Name : Sense
DisplayName : Windows Defender Advanced Threat Protection Service
Description : Windows Defender Advanced Threat Protection service helps protect against advanced threats by monitoring and reporting security events that happen on the computer.
PathName : "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"
StartMode : Manual
Notes : enterprise level paid feature; part of Microsoft 365 Defender
Tags : #security
Name : webthreatdefsvc
DisplayName : Web Threat Defense Service
Description : Web Threat Defense Endpoint Service helps protect your computer by identifying unauthorized entities attempting to gain access to user credentials
PathName : C:\Windows\system32\svchost.exe -k WebThreatDefense -p
StartMode : Manual
Notes : part of Microsoft Defender
Tags : #security
Name : webthreatdefusersvc_*
DisplayName : Web Threat Defense User Service_*
Description : Web Threat Defense User Service helps protect your computer by warning the user when unauthorized entities attempt to gain access to their credentials
PathName : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
StartMode : Auto
Notes : part of Microsoft Defender
Tags : #security
Name : SensorDataService
DisplayName : Sensor Data Service
Description : Delivers data from a variety of sensors
PathName : C:\Windows\System32\SensorDataService.exe
StartMode : Manual