This document provides a list of standard Windows XP services along with their default status, description, and notes. It includes services related to networking, system events, file sharing, security, backups, updates, and more. The list gives the name, process, description, and notes on the default status of each service to help understand its purpose and whether it can be safely disabled.

1. Windows XP Services
A list of all the standard services [update: SP 2 defaults are shown in Green]
Default
ServiceNa Service
Process Description Status &
me (Key)
notes
Alerter Alerter Services.exe Distribute Manual.
administrative May be
[HKLMSYSTEM alerts to specific disabled if
CurrentControlSet users or machines. the alerts
ServicesAlerterPara are not
meters] e.g. Performance needed.
Monitor thresholds
[HKLMSYSTEM are distributed as
CurrentControlSet alerts.
ServicesSysmonLog
Log Requires the
Queries<alertname>] Messenger and
Workstation
services to be
started.
Application ALG alg.exe Support for Internet Manual
Layer Connection
Gateway Sharing and the
Service Internet
Connection
Firewall
Application appmgt Services.exe or Installation Manual
Manageme svchost.exe services
nt (Add/Remove
Programs) -
Assign, Publish,
and Remove.
Automatic wuaUserv svchost.exe -k Enable the Automatic.
Updates wugroup download and If the
installation of service is
critical Windows stopped,
updates. the
operating
system can
be

2. manually
updated at
the
Windows
Update
Web site.
Background BITS svchost.exe -k Transfer files using Automatic
Intelligent BITSgroup idle network switch to
Transfer bandwidth, manual if
Service maintain file you have
transfers through problems -
network Q314862
disconnections and
computer restarts.
Clipbook Clipsrv Clipsrv.exe Provides support Disabled
Server for the Clipbook
Viewer, which
allows the
clipboard of the
source machine to
be accessed
remotely.
COM+ Event svchost.exe -k netsvcs Automatic Manual
Event System distribution of
System events to
subscribing COM
components.
Computer Browser Services.exe Collects the names Automatic.
Browser of NetBIOS
resources on the If the
network, creating a machine is
list so that it can not
participate as a connected
master browser or to a LAN
basic browser (one (stand-
that takes part in alone), or
browser elections). will not
participate
This maintained list as a
of resources master
(computers) is browser or
displayed in take part in
Network elections,

3. Neighborhood and then feel
Server Manager. If free to
disabled you can change the
still map drives, but status to
can't browse the manual (or
whole network. disabled)
This does
not equate
to disabling
TCP/IP so
internet
browsing is
still
possible.
Cryptograp CryptSvc svchost.exe Management of Automatic
hic Services Certification
Authority
certificates. Driver
Catalog Database,
Protected Root and
Key certificate
Services.
DCOM DcomLaunc svchost.exe Launch DCOM Automatic
Server h services
Process
Launcher
DHCP Dhcp Services.exe or Manage network Automatic
Client svchost.exe configuration by On a
registering and stand-
updating IP alone
addresses and machine:
DNS names. Disable
Distributed TrkWks Services.exe or Send notification of Automatic
Link svchost.exe files moving Can be set
Tracking between NTFS to manual
Client volumes in a if you dont
network domain. need this
function.
Distributed msdtc MSDTC.exe Coordinate Manual
Transaction transactions that Can be set
Coordinator are distributed to Disabled

4. across two or more if you dont
databases, need this
message queues, function.
file systems, or
other transaction
protected resource
managers.
DNS Client Dnscache Services.exe Resolves and Automatic
caches Domain
Name System
(DNS) names.
Directory Replicator Lmrepl.exe Replicate specified Automatic
Replicator files & folders
(Server between Domain
only) computers. Controllers
The host is the need this
export server, and to replicate
the target the
machines are Netlogon
called import share.
computers.
Replication is
configured under
Server in the
Control Panel.
Error Ersvc svchost.exe Report errors back Automatic
Reporting to Microsoft in If you
Service Redmond. never want
to report
system
crash info.
to
Microsoft
set this to
disabled.
EventLog EventLog Services.exe Record System, Automatic
Security, and
Application Events.
Viewed with the
MMC Event Viewer
(eventvwr.exe in
NT).

5. FastUserSwitching
Fast User Compatibility
svchost.exe Enable multiple Manual
Switching users to login to
Compatibilit the same PC
y simultaneously.
Fax Service Fax faxsvc.exe Send and receive Automatic
faxes or Manual
Help and helpsvc svchost.exe Help and Support Automatic.
Support Center If stopped
the help
system will
stop
working.
Human HidServ svchost.exe Support for extra Disabled
Interface keyboard 'hot
Device buttons' and other
Access multimedia input
devices.
HTTP SSL HTTPFilter svchost.exe Support for HTTPS Manual
(Secure Socket
Layer) websites
such as banking
and e-commerce.
IMAPI CD- ImapiServic imapi.exe CD-Rom Burning Manual
Burning e If you have
COM problems
Service changing
to
Automatic
may help.
Indexing cisvc cisvc.exe Index the contents Manual
Service and properties of For
files on local and improved
remote computers. performanc
[ RESOURCE e Disable
HOG ] or
Uninstall
thru
C.Panel
add/remov
e
IPSEC PolicyAgent lsass.exe Manage IP security Automatic

6. Policy policy and starts May be
Agent the changed to
ISAKMP/Oakley Manual if
(IKE) and the IP IPSec is
security driver. not
needed.
License LicenseServ Llssrv.exe License tracking on If disabled
Logging ice a server or DC then
Service (Domain licensing
(Server) Controller). status
alerts will
not be
generated.
Logical Disk Dmserver services.exe or Required by the Automatic
Manager svchost.exe MMC Disk
Management plug-
in.
Logical Disk Dmadmin dmadmin.exe /com Administrative Manual
Manager service for disk
Administrati management
ve Service requests
Message mqsvc.exe Message Queuing
Queuing
Message mqtgsvc.exe Message Queuing
Queuing
Triggers
MS swprv dllhost.exe Microsoft Backup Manual
Software Utility Disable if
Shadow you never
Copy use
Provider Shadow
Service Copy
features.
Messenger Messenger Services.exe Process the receipt Disabled
or delivery of pop- vulnerabilit
up messages sent y once
via NET SEND. used to
Not related to send pop-
Windows up spam.
Messenger

7. Network Netman svchost.exe -k netsvcs Manage objects in Manual
Connection the Network and
s Dial-Up
Connections folder
(LAN and remote
connections.)
Net Logon Netlogon Lsass.exe Network Automatic
(Local Security Authentication: For stand-
Authority Subsystem) maintains a synced alone
domain directory machines
database between never
the PDC and connected
BDC(s), handles to a
authentication of domain set
respective to Manual.
accounts on the
DCs, and
authenticates
domain accounts
on networked
machines.
NetMeeting Nmnsrvc mnmsrvc.exe Allows authorized Manual.
Remote people to remotely A good
Desktop access your idea to
Sharing Windows desktop Disable
using NetMeeting. unless you
plan to
allow
remote
connection
s.
Network NetDDE Netdde.exe Support the Disabled
DDE network transport
of DDE (Dynamic
Data Exchange)
connections.
Requires Network
DDE DSDM to be
started. See
Clipbook service
Network NetDDEdsd Netdde.exe Manage shared Disabled
DDE DSDM m DDE conversations
(from shares like:

8. computernamend
de$).
See Clipbook
service
NLA - nla svchost.exe Part of Internet Manual
Network Connection
Location Sharing (ICS) and
Awareness the Internet
Connection
Firewall (ICF)
Network xmlprov svchost.exe Manage XML Manual
Provisioning configuration files
Service on a domain basis
NT LM NtLmSsp Services.exe Extends NT Manual
Security security to Remote
Support Procedure Call
Provider (RPC) programs
using various
transports other
than named pipes.
RPC activity is
quite common, and
most RPC apps
don't use named
pipes.
Performanc sysmonLog smlogsvc.exe Configure Manual.
e Logs and performance logs May be
Alerts (XP) and alerts. disabled if
the alerts
Alerts and are not
Performanc needed.
e Logs (Win
2K)
Plug and PlugPlay Services.exe Plug and Play. Automatic
Play Do not disable this
service.
Universal UPNPhost svchost.exe Device Host detect Manual
Plug and and configure
Play Host external UPnP
devices.
UPnP<>PnP

9. Portable WmdmPmS svchost.exe Retrieves the serial Manual
Media N number of any Disable if
Serial portable media you never
Number player connected use DRM
Service to this computer. music
devices.
Print Spooler Spoolsv.exe The NT printing Automatic -
Spooler or (Spoolss.exe in NT4) subsystem. If you print
Spooler documents
.
If no
printing is
ever done
set to
manual (or
disabled)
Restarting
this service
will cancel
all pending
print jobs.
ProtectedStorage
Protected Pstores.exe Encrypt and store Automatic.
Storage secure info: SSL
certificates,
passwords for
Outlook, Outlook
Express, Profile
Assistant, MS
Wallet, and digitally
signed S/MIME
keys.
QoS RSVP rsvp rsvp.exe -s Provide network Manual
signaling and local
traffic control setup
functionality for
QoS-aware
programs and
control applets.
Remote Rasauto svchost.exe -k netsvcs Activates Manual
Access automatic dial-up May be
Auto when a URL link is disabled if

10. Connection clicked. the
Manager machine
or Required for some has no
Remote but not all RAS, internet
Access ADSL or Cable access.
AutoDial connections.
Manager
Remote Rasman svchost.exe -k netsvcs Required for most Manual.
Access but not all RAS, Required
Connection ADSL or Cable for Internet
Manager connections. Connection
Sharing or
accessing
remote
servers via
RAS.
Remote RDSessMgr sessmgr.exe Remote Desktop Manual
Desktop Help Session May be
Help Manager. disabled if
Session RDP is
Manager never
used.
Remote RpcSs svchost -k rpcss This RPC Automatic
Procedure subsystem is
Call (RPC) crucial to the Do not
Service operations of any disable
or RPC activities
Remote taking place on a Many
Procedure system (e.g. essential
Call (RPC) DCOM) services
are
dependent
on RPC.
Remote RpcLocator Locator.exe Maintain the RPC Manual.
Procedure name server
Call (RPC) database, requires
Locator the RPC service
(below) to be
started. Database
of available server
applications.
Remote RemoteRegi regsvc.exe Allow remote Automatic

11. Registry stry registry A good
Service (XP manipulation. idea to
Pro only) disable
this, unless
you have
some
reason to
allow
remote
registry
editing.
Removable Ntmssvc svchost.exe -k netsvcs Manage removable Manual.
Storage media, drives, and
libraries.
RIP Listen for RIP To use the
Listener announcements RIP
(XP - from routers and Listener
option) modify the routing service,
table accordingly. your
adjacent
routers
must
support the
RIP v1
protocol.
You'll find
the RIP
Listener
service
under
Add/Remo
ve
Windows
Componen
ts -
Networking
Services.
Routing and RemoteAcc svchost.exe -k netsvcs Allow incoming Disabled
Remote ess connections via
Access dial in or VPN.
(WAN Routing)
Secondary secLogon services.exe or Enables starting Automatic
Logon (Win svchost.exe processes under You may

12. XP) alternate want to
RunAs (Win credentials. stop this
2K) service if
you never
use RunAs
Security SamSs lsass.exe Stores security Automatic
Accounts information for
Manager local user
(Win 2K) accounts.
Security wscsvc svchost.exe Monitor system Automatic
Center security settings You may
and configurations. want to
disable this
if firewall
and virus
updates
are
controlled
via other
means.
Server LanmanServ Services.exe Support for peer-to Automatic
er peer file sharing, May be
print sharing, and disabled if
named pipe you dont
sharing via SMB host file or
services. print
shares.
(Admin$
shares)
ShellHWDetection
Shell svchost.exe CD Autoplay Automatic.
Hardware
Detection
Smart Card ScardSrv SCardSvr.exe Manages and Manual
controls access to If you
a smart card never use
inserted into a smart
smart card reader cards,
attached to the Disable
computer.
Smart Card ScardDrv SCardSvr.exe legacy smart card Removed
Helper readers in XP SP2

13. SNMP Snmp snmp.exe Agents that Automatic
Service monitor the activity (if installed)
in network devices
and report to the
network console
workstation.
SSDP SSDPSRV svchost.exe Simple Service Manual
Discovery Discovery Protocol. May be
Service Enables discovery disabled if
of UPnP devices on as is likely
your home network you dont
have any
UPnP
devices)
System SENS svchost.exe -k netsvcs Track system Automatic.
Event events such as
Notification Windows logon,
network, and
power events.
Notifiy COM+
Event System
subscribers of
these events.
System srservice svchost.exe Creates system Automatic
Restore snap shots.
Service [ RESOURCE If the
HOG ] machine's
configurati
on has
been
cloned/bac
ked up -
turn off
System
Restore in
Control
Panel,
System.
Task Schedule atsvc.exe or This service is Automatic
Scheduler mstask.exe required to
or Schedule schedule
background tasks
(run at a specific

14. date & time)
Under NT it's a
Resource Hog.
Under XP it's used
by some auto-
tuning operations.
TCP/IP lmHosts Services.exe Support for name Automatic
NetBIOS resolution in a If not
Helper Windows 2000 required
or domain. may be set
TCP/IP (Netbios/Wins) to manual.
NetBIOS An alternative to
Helper DNS lookup.
Service
Telephony TapiSrv Tapisrv.exe Telephony API Manual
(TAPI) support for
programs that
control telephony
devices and IP
based voice
connections. e.g
unimodem
modems.
Telnet TlntSvr tlntsvr.exe Allows a remote Disabled
(Win 2K) user to log on to Very
the system and run insecure,
console programs presents a
using the security
command line. risk when
running.
Terminal TermServic svchost.exe Required for Fast Manual
Services e User Switching, If not
Remote Desktop required
and Remote may be
Assistance Disabled
Themes Themes svchost.exe XP Active Desktop Automatic
Themes, and quick Set to
launch toolbars Manual or
[ RESOURCE Disabled if
HOG ] you dont
like

15. themes.
UPS or UPS Ups.exe Support for an Manual
Uninterrupti Uninteruptable Not every
ble Power Power Supply UPS will
Supply (UPS) physically need or
connected to the use this
machine. service.
Universal UPNPhost svchost.exe Device Host detect Manual
Plug and and configure
Play Host external UPnP
devices.
UPnP<>PnP
Upload uploadmgr svchost.exe Upload Manager. Removed
Manager in XP SP2
Volume VSS vssvc.exe MS Backup - A Manual
Shadow volume shadow If not
Copy copy is a picture of required
the volume at a may be
particular moment disabled
in time. That see MS
means a computer Software
can be backed up Shadow
while files are open Copy
and applications Provider
running. Service
WebClient WebClient svchost.exe Allow access to Automatic
web-resident disk If not
storage from an required
ISP. WebDAV may be
"internet disks" disabled
such as Apple's
iDisk.
Windows AudioSrv svchost.exe Sound Driver Automatic
Audio Note that disabling If no sound
the sound driver card fitted
won't stop sounds then
from playing - you disable.
just won't hear
them.
Windows SharedAcce svchost.exe -k netsvcs Network address Automatic.
Firewall (XP ss translation, For better

16. SP2) addressing, and protection
name resolution consider
Internet services for all adding a
Connection computers on your third party
Firewall home network firewall.
(XP) through a dial-up
connection.
Internet
Connection
Sharing
(Win 2K)
Windows stisvc svchost.exe Required for some Manual
Image but not all
Acquisition cameras,
scanners, and
digital video
cameras.
Windows MSIServer MsiExec.exe /V Install, repair and Manual
Installer remove software
according to
instructions
contained in .MSI
files.
Windows WinMgmt C:WINNTSystem32 WMI provides Automatic
Manageme WBEMWinMgmt.exe system
nt management
Instrumenta information.
tion
Windows Wmi svchost.exe Provides systems Manual
Manageme management
nt information to and
Instrumenta from drivers.
tion Driver
Extensions
Windows W32time services.exe Update the Automatic
Time computer clock by
reference to an
internet time
source or a time
server.
Wireless WZCSVC svchost.exe Configure wireless Automatic

17. Zero network devices disable if
Configuratio (802.11a/b/g). you don't
n have any
wireless
devices.
WMI WmiApSrv wmiapsrv.exe Collect Manual
Performanc performance library
e Adapter information.
lanmanworkstation
Workstation Services.exe Communications Automatic
and network
connections.
Services
dependent on this
being started:
Alerter,
Messenger, and
Net Logon.
Before changing any of the defaults - use the links above to find what exactly the
service does. The Elder Geek also has some good advice about services.
It is inadvisable to disable a service without being aware of the consequences, always
start by setting the service to manual, reboot and test for any problems.
A service set to manual may be automatically restarted if another service is dependent
on it.
A service set to disabled will not restart even if it's required to boot the machine!
Stopping or disabling a service will generally save a small amount of memory and will
reduce the number of software interrupts (cpu message queue.) The main reason for
tinkering with services is to harden the system against security vulnerabilities. Disable
everything that you don't need or use - then any future problems with those services
cannot affect the machine.
To document all the services currently installed:
SC QUERY state= all |findstr "DISPLAY_NAME STATE"
>my_services.csv
Some XP services communicate and send data directly to Microsoft, this is not
generally something to lose sleep over. Managing the running of these services may be
a consideration if confidentiality/anonymity is highly important to you.
Removing a service completely

18. To delete a service, you may be tempted to hack the registry settings under
(HKLM/SYSTEM/CurrentControlSet/Services) this is not a reliable or recommended
method, far better is to use the SC command:
SC delete NameofServiceTodelete
Enable or Disable Ports
Many services and applications rely on the use of a specific PORT - to determine if a
particular port is enabled for use, review the list of Service names and port numbers
held in the "services" file ('windowssystem32driversetcservices')
Installing a good firewall is the easiest way to manage this.
"The service we render to others is really the rent we pay for our room on this earth. It is
obvious that man is himself a traveler; that the purpose of this world is not 'to have and
to hold' but 'to give and serve.' There can be no other meaning." - Sir Wilfred T. Grenfell
Related:
SC - Service Control
TASKLIST - List running tasks and services
WinMSD - List running services
ServiceStatus.ps1 - List all services (Powershell)
Safe Mode - Press F8 during bootup to start with mimimal services running.
Recovery - The Recovery Console
WMIC SERVICE - WMI access to services
DRIVERQUERY - display device drivers and properties (Resource Kit)
DComCnfg - Disable/configure DCOM
Microsoft.com - WinXP services - default settings
Microsoft.com - Win2003 services - 138 page Word Doc
Microsoft.com - Managing System Services.doc - 2003
The Elder Geek - Services Guide
The Register - Part 1 & 2 - Review of Win XP Services
Sysinternals - how to disable every service
SecurityFocus - Securing Windows Services
Wikipedia - Windows service
Q137890 - SRVANY - create a User-Defined Service
Q288129 - Grant users the right to manage services
Q263201 - Default Processes
Q244905 - How to disable a service at boot
Q314056 - What is SvcHost
Q825826 - Troubleshoot missing network connection icons