Windows Services: NT, 2000 and XP

A list of all the 'standard' services

Name Service (Key) Process Description Status
Alerter Alerter Services.exe

[HKLM\SYSTEM\
CurrentControlSet\
Services\Alerter\Parameters]

[HKLM\SYSTEM\
CurrentControlSet
\Services\SysmonLog\Log Queries\<alertname>]
Distribute administrative alerts to specific users or machines.

e.g. Performance Monitor thresholds are distributed as alerts.

Requires the Messenger and Workstation services to be started.
Manual. May be disabled if the alerts are not needed.
Alerts and Performance Logs (Win 2K) sysmonLog smlogsvc.exe Configure performance logs and alerts. Manual. May be disabled if the alerts are not needed.
Application Layer Gateway Service (XP) ALG alg.exe Support for Internet Connection Sharing and the Internet Connection Firewall Automatic
Application Management
(Win 2K/XP)
appmgt Services.exe or svchost.exe Installation services (Add/Remove Programs) - Assign, Publish, and Remove. Manual
Automatic Updates
(Win 2K/XP)
wuaUserv svchost.exe -k wugroup Enable the download and installation of critical Windows updates. Automatic.
If the service is disabled, the operating system can be manually updated at the Windows Update Web site.
Background Intelligent Transfer Service (Win 2K) BITS svchost.exe -k BITSgroup Transfer files in the background using idle network bandwidth. Automatic.
If the service is stopped, features such as Windows Update, and MSN Explorer will be unable to automatically download programs and other information.
COM+ Event System Event System svchost.exe -k netsvcs Automatic distribution of events to subscribing COM components. Manual
Clipbook Server Clipsrv Clipsrv.exe Provides support for the Clipbook Viewer, which allows the clipboard of the source machine to be accessed remotely. Manual or disable.
Computer Browser Browser Services.exe Actively collect the names of NetBIOS resources on the network, creating a list so that it can participate as a master browser or basic browser (one that takes part in browser elections).

This maintained list of resources (computers) is displayed in Network Neighborhood and Server Manager.
Automatic.

If the machine is not connected to a LAN (stand-alone), or will not participate as a master browser or take part in elections, then feel free to change the status to disabled or manual.

This does not equate to disabling TCP/IP so internet browsing is still possible.
Cryptographic Services (XP) CryptSvc svchost.exe Management of Certification Authority certificates. Automatic
DHCP Client Dhcp Services.exe or svchost.exe Manage network configuration by registering and updating IP addresses and DNS names. Automatic
Distributed Link Tracking Client (Win 2K/XP) TrkWks Services.exe or svchost.exe Send notification of files moving between NTFS volumes in a network domain. Automatic or manual.
Distributed Transaction Coordinator
(Win 2K/XP)
msdtc MSDTC.exe Coordinate transactions that are distributed across two or more databases, message queues, file systems, or other transaction protected resource managers. Manual
DNS Client
(Win 2K/XP)
Dnscache Services.exe Resolves and caches Domain Name System (DNS) names. Automatic
Directory Replicator Replicator Lmrepl.exe Replicate specified files & folders between computers.
The host is the export server, and the target machines are called import computers.
Replication is configured under Server in the Control Panel.
Automatic

Domain Controllers need this to replicate the Netlogon share.
Error Reporting Service Ersvc svchost.exe Report errors back to Microsoft in Redmond. Automatic or disabled.
EventLog EventLog Services.exe Record System, Security, and Application Events.

Viewed with the MMC Event Viewer (eventvwr.exe in NT).
Automatic
Fast User Switching Compatibility (XP) FastUserSwitching Compatibility svchost.exe Enable multiple users to login to the same PC simultaneously. Manual
Fax Service
(Win 2K/XP)
Fax faxsvc.exe Send and receive faxes Automatic or Manual or Disable.
Help and Support (XP) helpsvc svchost.exe Help and Support Center Automatic.
Human Interface Device Access (XP) HidServ svchost.exe Support for extra keyboard 'hot buttons' and other multimedia input devices. Disable
IMAPI CD-Burning COM Service (XP) ImapiService imapi.exe CD-Rom Burning Automatic.
Indexing Service (Win 2K/XP) cisvc cisvc.exe Index the contents and properties of files on local and remote computers.
RESOURCE HOG
Disable.
Internet Connection Sharing (Win 2K)

Internet Connection Firewall
(XP)
SharedAccess svchost.exe -k netsvcs Network address translation, addressing, and name resolution services for all computers on your home network through a dial-up connection. Automatic.
unless you have chosen to disable the Application Layer Gateway Service for some reason.
IPSEC Policy Agent
(Win 2K/XP)
PolicyAgent lsass.exe Manage IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. Automatic or Disable.
License Logging Service LicenseService Llssrv.exe License tracking on a server or DC (Domain Controller). If disabled then licensing status alerts will not be generated.
Logical Disk Manager (XP) Dmserver services.exe or svchost.exe Required by the MMC Disk Management plug-in. Automatic.
Logical Disk Manager Administrative Service (XP) Dmadmin dmadmin.exe /com Administrative service for disk management requests Manual
Message Queuing (XP)   mqsvc.exe Message Queuing  
Message Queuing Triggers (XP)   mqtgsvc.exe Message Queuing  
MS Software Shadow Copy Provider Service swprv dllhost.exe Microsoft Backup Utility Manual or Disable
Messenger Messenger Services.exe Process the delivery of pop-up messages sent by the Alerter service, or via NET SEND. The messages appear on the recipient's machines, and must be clicked OK to disappear.

This service is also required to receive any messages sent by the Messenger service from another machine.

This service is not related to Windows Messenger
For stand-alone machines - disable this service.

For machines on a network, you may want to also consider disabling this service to avoid misuse of the 'NET SEND' command.
Network Connections
(Win 2K/XP)
Netman svchost.exe -k netsvcs Manage objects in the Network and Dial-Up Connections folder (LAN and remote connections.) Manual
Net Logon Netlogon Lsass.exe
(Local Security Authority Subsystem)
Network Authentication: maintains a synced domain directory database between the PDC and BDC(s), handles authentication of respective accounts on the DCs, and authenticates domain accounts on networked machines.
Automatic - when connected to a domain.

Manual for stand-alone machines.
NetMeeting Remote Desktop Sharing Nmnsrvc mnmsrvc.exe Allows authorized people to remotely access your Windows desktop using NetMeeting. Manual or Disabled.
Network DDE NetDDE Netdde.exe Support the network transport of DDE (Dynamic Data Exchange) connections. Such connectivity is mostly a relic from the NT 3.x days, and interaction with Windows for Workgroup clients. Some Win32 NetDDE APIs are still used, but such APIs are thunked down to 16-bit.
Requires Network DDE DSDM to be started.
Manual or Disabled.
Network DDE DSDM NetDDEdsdm Netdde.exe Manage shared DDE conversations (from shares like: \\computername\ndde$).
Manual or Disabled.
NLA - Network Location Awareness (XP) nla svchost.exe Part of Internet Connection Sharing (ICS) and the Internet Connection Firewall (ICF) Automatic.
unless you have chosen to disable the Application Layer Gateway Service for some reason.
NT LM Security Support Provider NtLmSsp Services.exe Extends NT security to Remote Procedure Call (RPC) programs using various transports other than named pipes.
RPC activity is quite common, and most RPC apps don't use named pipes.
Manual
Plug and Play PlugPlay Services.exe Plug and Play.
Do not disable this service.
Automatic
Universal Plug and Play UPNPhost svchost.exe Device Host Detect and configure external UPnP devices.
UPnP device = platform independent.
Manual or Disabled.
Protected Storage ProtectedStorage Pstores.exe Encrypt and store secure info: SSL certificates, passwords for Outlook, Outlook Express, Profile Assistant, MS Wallet, and digitally signed S/MIME keys. Automatic.
QoS RSVP
(Win 2K)
rsvp rsvp.exe -s Provide network signaling and local traffic control setup functionality for QoS-aware programs and control applets. Manual or Disabled.
Remote Access Auto Connection Manager
or
Remote Access AutoDial Manager
Rasauto svchost.exe -k netsvcs Activates automatic dial-up when a URL link is clicked.

Required for some but not all RAS, ADSL or Cable connections.
Manual or disabled.
Remote Access Connection Manager
(Win 2K/XP)
Rasman svchost.exe -k netsvcs Required for most but not all RAS, ADSL or Cable connections. Manual or disabled.
Remote Desktop Help Session Manager
(XP)
RDSessMgr sessmgr.exe Remote Desktop Help Session Manager. Manual or disable if you don't use it.
Remote Procedure Call (RPC) Locator RpcLocator Locator.exe Maintain the RPC name server database, requires the RPC service (below) to be started. Database of available server applications. Manual.
Remote Procedure Call (RPC) Service
or
Remote Procedure Call (RPC)
RpcSs Rpcss.exe or svchost -k rpcss This RPC subsystem is crucial to the operations of any RPC activities taking place on a system (DCOM, Server Manager, User Manager)
Rpcss.exe is also known as dcomss.exe (Distributed Common Object Model).
Automatic
Remote Registry Service
(Win 2K/XP)
RemoteRegistry regsvc.exe Allow remote registry manipulation. Automatic or disabled.
Removable Storage
(Win 2K/XP)
Ntmssvc svchost.exe -k netsvcs Manage removable media, drives, and libraries. Manual.
RIP Listener
(XP - option)
    Listen for RIP announcements from routers and modify the routing table accordingly. To use the RIP Listener service, your adjacent routers must support the RIP v1 protocol. You'll find the RIP Listener service under Add/Remove Windows Components - Networking Services.
Routing and Remote Access (Win 2K/XP) RemoteAccess svchost.exe -k netsvcs Allow incoming connections via dial in or VPN. Disable for security reasons or Manual
RunAs Service (Win 2K)
Secondary Logon (Win XP)
secLogon services.exe or svchost.exe Enables starting processes under alternate credentials. Automatic or Disable.
Schedule
or
Task scheduler
Schedule atsvc.exe or mstask.exe This service is required for the use of the AT command, which allows the scheduling of commands (Jobs) to be run on the machine, at a specific date & time.

Under NT it's a Resource Hog.
Under XP it's used by some auto-tuning operations.
Automatic
Security Accounts Manager (Win 2K) SamSs lsass.exe Stores security information for local user accounts. Automatic
Server LanmanServer Services.exe Support for file sharing, print sharing, and named pipe sharing via SMB services. Automatic.
Disable on an IIS Server or if no resources are shared.
Shell Hardware Detection (XP) ShellHWDetection svchost.exe CD Autoplay Automatic.
Simple TCP/IP Services
(Win 2K)
SimpTcp tcpsvcs.exe Supports the following TCP/IP services: Character Generator, Daytime, Discard, Echo, and Quote of the Day.  
Smart Card
(Win 2K/XP)
ScardSrv SCardSvr.exe Manages and controls access to a smart card inserted into a smart card reader attached to the computer. Manual or Disabled
Smart Card Helper (Win 2K/XP) ScardDrv SCardSvr.exe Provides support for legacy smart card readers attached to the computer. Manual or Disabled
SNMP Service
(Win 2K/XP)
Snmp snmp.exe Agents that monitor the activity in network devices and report to the network console workstation. Automatic (if installed)
SNMP Trap Service (Win 2K) Snmptrap snmptrap.exe Receives trap messages generated by local or remote SNMP agents and forwards the messages to SNMP management programs running on this computer. Automatic (if installed)
SSDP Discovery Service SSDPSRV svchost.exe Simple Service Discovery Protocol.
Enables discovery of UPnP devices on your home network
Manual or Disabled
Spooler
or
Print Spooler
Spooler Spoolss.exe or Spoolsv.exe The NT printing subsystem. Automatic - If you print documents.

If no printing is ever done set to manual or disabled.

If you are having trouble with a printer not responding, you can try restarting this service. This cancels all pending print jobs.
System Event Notification
(Win 2K/XP)
SENS svchost.exe -k netsvcs Track system events such as Windows logon, network, and power events.
Notifiy COM+ Event System subscribers of these events.
Automatic.
System Restore Service
(XP)
srservice svchost.exe Creates system snap shots.
[ RESOURCE HOG ]
Automatic or Disabled.

Before stopping this service disable in Control Panel, Performance, system.
TCP/IP NetBIOS Helper
or
TCP/IP NetBIOS Helper Service
lmHosts Services.exe Support for name resolution via a lookup of the LMHosts file. (Netbios/Wins)
This is an alternative to the more standard DNS lookup.
If you use an LMHosts file for name resolution, set to automatic. If you don't then set to manual.
Telephony TapiSrv Tapisrv.exe Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections. e.g unimodem modems. Manual
Telnet
(Win 2K)
TlntSvr tlntsvr.exe Allows a remote user to log on to the system and run console programs using the command line. Manual or Disabled.
Presents a security risk when running.
Terminal Services (XP) TermService svchost.exe Required for Fast User Switching, Remote Desktop and Remote Assistance Disable
Themes
(XP)
Themes svchost.exe XP Active Desktop Themes, and quick launch toolbars
[ RESOURCE HOG ]
Disable.
Upload Manager uploadmgr svchost.exe Upload Manager. Disable
UPS or Uninterruptible Power Supply UPS Ups.exe Support for an Uninteruptable Power Supply (UPS) physically connected to the machine. Not every UPS will need or use this service.
Utility Manager (Win 2K) UtilMan UtilMan.exe Starts and configures accessibility tools from one window  
Volume Shadow Copy
(XP)
VSS vssvc.exe MS Backup - A volume shadow copy is a picture of the volume at a particular moment in time. That means a computer can be backed up while files are open and applications running. Manual or Disable.
see MS Software Shadow Copy Provider Service
WebClient
(XP)
WebClient svchost.exe Allow access to web-resident disk storage from an ISP. WebDAV "internet disks" such as Apple's iDisk. Disable
Windows Audio (XP) AudioSrv svchost.exe Sound Driver Automatic or disable if no sound card.

Note that disabling the sound driver won't stop sounds from playing - you just won't hear them.
Windows Image Acquisition stisvc svchost.exe Required for some but not all scanners. Manual
Windows Installer MSIServer MsiExec.exe /V Install, repair and remove software according to instructions contained in .MSI files. Manual
Windows Management Instrumentation (Win 2K/XP) WinMgmt C:\WINNT\System32
\WBEM\WinMgmt.exe
Provides system management information. Automatic
Windows Management Instrumentation Driver Extensions (Win 2K) Wmi Services.exe Provides systems management information to and from drivers. Manual
Windows Time (Win 2K) W32time services.exe Update the computer clock by reference to an internet time source or a time server. Automatic or disable.
Wireless Zero Configuration WZCSVC svchost.exe Configure wireless network devices. Automatic or disable.
WMI Performance Adapter WmiApSrv wmiapsrv.exe Collect performance library information. Manual
Workstation lanmanworkstation Services.exe Communications and network connections.
Services dependent on this being started: Alerter, Messenger, and Net Logon.
Automatic.
or Manual - for a stand-alone PC with no LAN or internet connection.

The following services are added by Internet Information Server, IIS (inetinfo.exe)
FTP Publishing Service, IIS Admin, Simple Mail Transport Protocol (SMTP), World Wide Web Publishing Service.

Related commands:

SC - Service Control
WinMSD - List running services
Safe mode - Press F8 during bootup to start with mimimal services running.
Recovery - The Recovery Console

Links
Glossary of Windows 2000 services - Microsoft.com




Simon Sheppard
SS64.com