Configuration Information

· Automatic: A service in this state will start at boot time. Some services will stop automatically if not needed. Can
· Automatic (Delayed Start): Service start will happen after boot time.
· Manual (Trigger Start): Allows Windows to start a service when specifically called.
· Manual: Allows Windows to start a service when needed. If you find you need a service, place it in Automatic.
· Disabled: Stops a service from starting, even if needed. Errors in the Event Viewer will show up.
· “Started”: A service that either set to Manual or Automatic that is running by default at or shortly after boot time
· “Not Started”: A service set into Automatic that is not running by default at or shortly after boot time.
· “Not Available”: A service that does not apply to the particular version of Windows 10.
· “Uninstalled”: The ability to uninstall a service that I recommend to be removed by using Add/Remove Windows

Service Default Registry Entries

· Entries are exported directly from the registry of a default Windows 10 installation.
· Entries are in the .reg file format.

An * (asterisk) indicates changes from the default.

Two ** (asterisks) indicates you can add or remove this service by:

1. Click on the Search the web and Windows box

2. Type Control Panel (or enough letters so it appears in the results)
3. Select Control Panel (under Results)
4. Select Programs
5. Select Programs and Features
6. Select Turn Windows Features on or off
Or

1. Head to Start (Windows Key)

2. Select All Apps (bottom left)
3. Select Control Panel (under Windows System)
4. Select Programs
5. Select Programs and Features
6. Select Turn Windows features on or off

Display Name Service Name (Registry)

ActiveX Installer (AxInstSV) AxInstSV

AllJoyn Router Service AJRouter

App Readiness AppReadiness

Application Host Helper Service** AppHostSvc

Application Identity AppIDSvc

Application Information Appinfo

Application Layer Gateway Service ALG

Application Management AppMgmt

AppX Deployment Service (AppXSVC)AppXSVC

ASP.NET State Service ** aspnet_state

Background Intelligent Transfer Service

BITS

Background Tasks Infrastructure Service

BrokerInfrastructure

Base Filtering Engine BFE

BitLocker Drive Encryption Service BDESVC

Block Level Backup Engine Service wbengine

Bluetooth Handsfree Service BthHFSrv

Bluetooth Support Service bthserv

BranchCache PeerDistSvc

CDPSvc CDPSvc
Certificate Propagation CertPropSvc

Claims to Windows Token Service c2wts

Client for NFS NfsClnt

Client License Service (ClipSVC) ClipSVC
CNG Key Isolation KeyIso

COM+ Event System EventSystem

COM+ System Application COMSysApp

Computer Browser Browser

CoreMessaging CoreUIRegistrar
Credential Manager VaultSvc

Cryptographic Services CryptSvc

Data Sharing Service DsSvc

DataCollectionPublishingService DcpSvc
DCOM Server Process Launcher DcomLaunch

Delivery Optimization DoSvc

Device Association Service DeviceAssociationService

Device Install Service DeviceInstall

Device Management Enrollment Service DmEnrollmentSvc

Device Setup Manager DsmSVC

DevQuery Background Discovery DevQueryBroker

Broker
DHCP Client Dhcp

Diagnostic Policy Service DPS

Diagnostic Service Host WdiServiceHost

Diagnostic System Host WdiSystemHost

Diagnostics Tracking Service DiagTrack

Distributed Link Tracking Client TrkWks

Distributed Transaction Coordinator MSDTC

dmwappushsvc dmwappushsvc

DNS Client Dnscache

Downloaded Maps Manager MapsBroker

DS Role Server ** DsRoleSvc

embeddedmode embeddedmode
Encrypting File System (EFS) EFS

Enterprise App Management Service EntAppSvc

Extensible Authentication Protocol Service

EapHost

Fax ** Fax

File History Service fhsvc

Function Discovery Provider Host fdPHost

Function Discovery Resource Publication

FDResPub

Geolocation Service fsvc

Group Policy Client gpsvc

Health Key and Certificate Management

hkmsvc

HomeGroup Listener HomeGroupListener

HomeGroup Provider HomeGroupProvider

Human Interface Device Service hidserv

Hyper-V Data Exchange Service vmickvpexchange

Hyper-V Guest Service Interface vmicguestinterface

Hyper-V Guest Shutdown Service vmicshutdown
Hyper-V Heartbeat Service vmicheartbeat

Hyper-V Remote Desktop Virtualization Service

vmicrdv

Hyper-V Time Synchronization Service

vmictimesync

Hyper-V VM Session Service vmicvmsession

Hyper-V Volume Shadow Copy Requestor
vmicvss

IIS Admin Service ** IISADMIN

IKE and AuthIP IPsec Keying ModulesIKEEXT

Intel(R) Content Protection HECI cphs

Service
Intel(R) HD Graphics Control Panel ?
Service
Interactive Services Detection UI0Detect

Internet Connection Sharing (ICS) SharedAccess

Internet Explorer ETW Collector Service IEEtwCollectorService

IP Helper iphlpsvc
IPsec Policy Agent PolicyAgent

KtmRm for Distributed Transaction Coordinator

KtmRm

Link-Layer Topology Discovery Mapper

lltdsvc

Local Session Manager LSM

LPD Service ** LPDSVC

Message Queuing ** MSMQ

Message Queuing Triggers ** MSMQTriggers

Microsoft (R) Diagnostics Hub Standard diagnosticshub.standardcollector.servic

Collector Service e
Microsoft Account Sign-in Assistant wlidsvc

Microsoft FTP Service ** ftpsvc

Microsoft iSCSI Initiator Service MSiSCSI

Microsoft Office ClickToRun Service ?

Microsoft Passport NgcSvc
Microsoft Passport Container NgcCtnrSvc
Microsoft Software Shadow Copy Provider
swprv
Microsoft Storage Spaces SMP smphost
Microsoft Windows SMS Router Service SmsRouter

Net.Msmq Listener Adapter ** NetMsmqActivator

Net.Pipe Listener Adapter ** NetPipeActivator

Net.Tcp Listener Adapter ** NetTcpActivator

Net.Tcp Port Sharing Service ** NetTcpPortSharing

Netlogon Netlogon

Network Connected Devices Auto-Setup

NcdAutoSetup

Network Connection Broker NcbService

Network Connections Netman

Network Connectivity Assistant NcaSVC

Network List Service netprofm

Network Location Awareness NlaSvc

Network Setup Service NetSetupSvc

Network Store Interface Service nsi

Office Source Engine ?

Offline Files CscService

Optimize Drives defragsvc

Peer Name Resolution Protocol PNRPsvc

Peer Networking Grouping p2psvc

Peer Networking Identity Manager p2pimsvc

Performance Logs & Alerts pla

Plug and Play PlugPlay

PNRP Machine Name Publication Service
PNRPAutoReg

Portable Device Enumerator Service WPDBusEnum

Power Power
Print Spooler Spooler
Printer Extensions and Notifications PrintNotify

Problem Reports and Solutions Control Panel Support

wercplsupport

Program Compatibility Assistant Service

PcaSvc

Quality Windows Audio Video Experience

QWAVE

Remote Access Auto Connection Manager

RasAuto

Remote Access Connection ManagerRasMan

Remote Desktop Configuration SessionEnv

Remote Desktop Services TermService

Remote Desktop Services UserModeUmRdpService

Port Redirector

Remote Procedure Call (RPC) RpcSs

Remote Procedure Call (RPC) LocatorRpcLocator

Remote Registry RemoteRegistry

Retail Demo Service RetailDemo

RIP Listener ** iprip

Routing and Remote Access RemoteAccess

RPC Endpoint Mapper RpcEptMapper

Secondary Logon seclogon

Secure Socket Tunneling Protocol Service

SstpSvc

Security Accounts Manager SamSs

Security Center wscsvc

Sensor Data Service SensorDataService

Sensor Monitoring Service SensrSvc

Sensor Service SensorService

Server LanmanServer

Shell Hardware Detection ShellHWDetection

Simple TCP/IP Services ** simptcp

Smart Card SCardSvr

Smart Card Device Enumeration ScDeviceEnum

Service
Smart Card Removal Policy SCPolicySvc

SNMP Service ** SNMP

SNMP Trap SNMPTRAP

Software Protection sppsvc

Spot Verifier svsvc

SSDP Discovery SSDPSRV

State Repository Service StateRepository

Still Image Acquisition Events WiaRpc

Storage Service StorSvc

Superfetch SysMain
System Event Notification SENS

System Events Broker SystemEventsBroker

Task Scheduler Schedule

TCP/IP NetBIOS Helper lmhosts

Telephony TapiSrv

Themes Themes
Tile Data model server tiledatamodelsvc
Time Broker TimeBroker

Touch Keyboard and Handwriting Panel Service

TabletInputService

Update Orchestrator Service UsoSvc

UPnP Device Host upnphost

User Manager UserManager

User Profile Service ProfSvc

Virtual Disk vds

Volume Shadow Copy VSS

W3C Logging Service W3LOGSVC

WalletService WalletService
Web Management Service ** WMSVC

WebClient WebClient

Windows Audio AudioSrv

Windows Audio Endpoint Builder AudioEndpointBuilder

Windows Backup SDRSVC

Windows Biometric Service WbioSrvc

Windows Color System WcsPlugInService

Windows Connect Now - Config Registrar

wcncsvc

Windows Connection Manager Wcmsvc

Windows Defender Network Inspection WdNisSvc

Service
Windows Defender Service WinDefend

Windows Driver Foundation - User-mode Driver Framework

wudfsvc

Windows Encryption Provider Host WEPHOSTSVC

Service
Windows Error Reporting Service WerSvc

Windows Event Collector Wecsvc

Windows Event Log EventLog

Windows Firewall MpsSvc

Windows Font Cache Service FontCache

Windows Image Acquisition (WIA) StiSvc

Windows Installer msiserver

Windows License Manager Service LicenseManager

Windows Management Instrumentation
Winmgmt

Windows Media Player Network Sharing Service **

WMPNetworkSvc

Windows Mobile Hotspot Service icssvc

Windows Modules Installer TrustedInstaller

Windows MultiPoint Server Host Service Wms

Windows MultiPoint Server Repair WmsRepair

Service
Windows Presentation Foundation Font Cache 3.0.0.0**
FontCache3.0.0.0
Windows Process Activation Service WAS
**

Windows Push Notifications Service WpnService

Windows Remote Management (WS-Management)

WinRM

Windows Search WSearch

Windows Store Service(WSService) WSService

Windows Time W32Time

Windows Update wuauserv

WinHTTP Web Proxy Auto-DiscoveryWinHttpAutoProxySvc

Service

Wired AutoConfig dot3svc

WLAN AutoConfig WlanSvc

WMI Performance Adapter wmiApSrv

Work Folders workfolderssvc

Workstation LanmanWorkstation

World Wide Web Publishing Service **

W3SVC

WWAN AutoConfig WwanSvc

Xbox Live Auth Manager XblAuthManager

Xbox Live Game Save XblGameSave
XboxNetApiSvc XboxNetApiSvc
 W
ot time. Some services will stop automatically if not needed. Can place a service that is not needed in Manual or Disabled.
ppen after boot time.
a service when specifically called.
n needed. If you find you need a service, place it in Automatic.
eeded. Errors in the Event Viewer will show up.
Automatic that is running by default at or shortly after boot time.
t is not running by default at or shortly after boot time.
o the particular version of Windows 10.
hat I recommend to be removed by using Add/Remove Windows Features.

f a default Windows 10 installation.

DEFAULT Windows 10 DEFAULT Windows 10

Description
Home Surface 3
Provides User Account Control validation for the installation of ActiveX Manual Manual
controls from the Internet and enables management of ActiveX control
installation based on Group Policy settings. This service is started on
demand and if disabled the installation of ActiveX controls will behave
according to default browser settings.

Routes AllJoyn messages for the local AllJoyn clients. If this service is Manual (Trigger Start) Manual (Trigger Start)
stopped the AllJoyn clients that do not have their own bundled routers will
be unable to run.
Gets apps ready for use the first time a user signs in to this PC and when Manual Manual
adding new apps.
Provides administrative services for IIS, for example configuration history Not Installed (Automatic, Not Installed (Automatic,
and Application Pool account mapping. If this service is stopped, Started) Started)
configuration history and locking down files or directories with Application
Pool specific Access Control Entries will not work.

Determines and verifies the identity of an application. Disabling this Manual (Trigger Start) Manual (Trigger Start)
service will prevent AppLocker from being enforced.
Facilitates the running of interactive applications with additional Manual (Trigger Start, Manual (Trigger Start,
administrative privileges. If this service is stopped, users will be unable to Started) Started)
launch applications with the additional administrative privileges they may
require to perform desired user tasks.

Provides support for 3rd party protocol plug-ins for Internet Connection Manual Manual
Sharing

Processes installation, removal, and enumeration requests for software Manual Manual
deployed through Group Policy. If the service is disabled, users will be
unable to install, remove, or enumerate software deployed through Group
Policy. If this service is disabled, any services that explicitly depend on it
will fail to start.

Provides infrastructure support for deploying Store applications. This Manual Manual
service is started on demand and if disabled Store applications will not be
deployed to the system, and may not function properly.

Provides support for out-of-process session states for ASP.NET. If this Not Installed (Manual) Not Installed (Manual)
service is stopped, out-of-process requests will not be processed. If this
service is disabled, any services that explicitly depend on it will fail to start.

Transfers files in the background using idle network bandwidth. If the Manual or Automatic Manual or Automatic
service is disabled, then any applications that depend on BITS, such as (Delayed Start, Started) (Delayed Start, Started)
Windows Update or MSN Explorer, will be unable to automatically depending on other depending on other
download programs and other information. services services

Coordinates execution of background work for WinRT applications. Automatic (Started) Automatic (Started)

The Base Filtering Engine (BFE) is a service that manages firewall and Automatic (Started) Automatic (Started)
Internet Protocol security (IPsec) policies and implements user mode
filtering. Stopping or disabling the BFE service will significantly reduce the
security of the system. It will also result in unpredictable behavior in IPsec
management and firewall applications.

BDESVC hosts the BitLocker Drive Encryption service. BitLocker Drive Manual (Trigger Start) Manual (Trigger Start)
Encryption provides secure startup for the operating system, as well as full
volume encryption for OS, fixed or removable volumes. This service allows
BitLocker to prompt users for various actions related to their volumes
when mounted, and unlocks volumes automatically without user
interaction. Additionally, it stores recovery information to Active Directory,
if available, and, if necessary, ensures the most recent recovery
certificates are used. Stopping or disabling the service would prevent
users from leveraging this functionality.

The WBENGINE service is used by Windows Backup to perform backup Manual Manual
and recovery operations. If this service is stopped by a user, it may cause
the currently running backup or recovery operation to fail. Disabling this
service may disable backup and recovery operations using Windows
Backup on this computer.

Manual Manual (Trigger Start)

You may not desire new Bluetooth devices to be discovered and Manual (Trigger Start) Manual (Trigger Start)
connected. This could be an issue if in an internet cafe or other location
where many portable devices are around and you are using a laptop or net
book. This service is safe to disable if you have no desire or use for
external Bluetooth equipment such as mice, keyboards and phone or PDA
devices.

This service is new for Windows 7 and is intended for a remote corporate Not Available Not Available
user and not a home user. This service can safely be disabled.

Manual Manual
Copies user certificates and root certificates from smart cards into the Manual Manual
current user’s certificate store, detects when a smart card is inserted into a
smart card reader, and, if needed, installs the smart card Plug and Play
minidriver.

Service to convert claims based identities to windows identities Manual Manual

Enables this computer to access files on NFS shares Not Available Not Available
Manual (Trigger Start) Manual (Trigger Start)
The CNG key isolation service is hosted in the LSA process. The service Manual (Trigger Start, Manual (Trigger Start,
provides key process isolation to private keys and associated Started) Started)
cryptographic operations as required by the Common Criteria. The service
stores and uses long-lived keys in a secure process complying with
Common Criteria requirements.

Supports System Event Notification Service (SENS), which provides Automatic (Started) Automatic (Started)
automatic distribution of events to subscribing Component Object Model
(COM) components. If the service is stopped, SENS will close and will not
be able to provide logon and logoff notifications. If this service is disabled,
any services that explicitly depend on it will fail to start.

Manages the configuration and tracking of Component Object Model Manual Manual
(COM)+-based components. If the service is stopped, most COM+-based
components will not function properly. If this service is disabled, any
services that explicitly depend on it will fail to start.

Maintains an updated list of computers on the network and supplies this Manual (Trigger Start) Manual (Trigger Start)
list to computers designated as browsers. If this service is stopped, this list
will not be updated or maintained. If this service is disabled, any services
that explicitly depend on it will fail to start.

Automatic (Started) Automatic (Started)

Provides secure storage and retrieval of credentials to users, applications Manual (Started) Manual (Started)
and security service packages.
Provides three management services: Catalog Database Service, which Automatic (Started) Automatic (Started)
confirms the signatures of Windows files and allows new programs to be
installed; Protected Root Service, which adds and removes Trusted Root
Certification Authority certificates from this computer; and Automatic Root
Certificate Update Service, which retrieves root certificates from Windows
Update and enable scenarios such as SSL. If this service is stopped,
these management services will not function properly. If this service is
disabled, any services that explicitly depend on it will fail to start.

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)
The DCOMLAUNCH service launches COM and DCOM servers in Automatic (Started) Automatic (Started)
response to object activation requests. If this service is stopped or
disabled, programs using COM or DCOM will not function properly. It is
strongly recommended that you have the DCOMLAUNCH service running.

Automatic (Delayed Automatic (Delayed

Start) Start)
Enables pairing between the system and wired or wireless devices. Manual (Trigger Start, Automatic (Trigger Start,
Started) Started)
Enables a computer to recognize and adapt to hardware changes with little Manual (Trigger Start) Manual (Trigger Start)
or no user input. Stopping or disabling this service will result in system
instability.
Manual Manual

Enables the detection, download and installation of device-related Manual (Trigger Start) Manual (Trigger Start)
software. If this service is disabled, devices may be configured with
outdated software, and may not work correctly.
Manual (Trigger Start) Manual (Trigger Start)

Registers and updates IP addresses and DNS records for this computer. If Automatic (Started) Automatic (Started)
this service is stopped, this computer will not receive dynamic IP
addresses and DNS updates. If this service is disabled, any services that
explicitly depend on it will fail to start.

The Diagnostic Policy Service enables problem detection, troubleshooting Automatic (Started) Automatic (Started)
and resolution for Windows components. If this service is stopped,
diagnostics will no longer function.
The Diagnostic Service Host is used by the Diagnostic Policy Service to Manual (Started) Manual (Started)
host diagnostics that need to run in a Local Service context. If this service
is stopped, any diagnostics that depend on it will no longer function.

The Diagnostic System Host is used by the Diagnostic Policy Service to Manual Manual
host diagnostics that need to run in a Local System context. If this service
is stopped, any diagnostics that depend on it will no longer function.

Automatic (Started) Automatic (Started)

Maintains links between NTFS files within a computer or across computers Automatic (Started) Automatic (Started)
in a network.
Coordinates transactions that span multiple resource managers, such as Manual Manual
databases, message queues, and file systems. If this service is stopped,
these transactions will fail. If this service is disabled, any services that
explicitly depend on it will fail to start.

Automatic (Delayed Automatic (Delayed

Start, Trigger Start) Start, Trigger Start)
The DNS Client service (dnscache) caches Domain Name System (DNS) Automatic (Trigger Start, Automatic (Trigger Start,
names and registers the full computer name for this computer. If the Started) Started)
service is stopped, DNS names will continue to be resolved. However, the
results of DNS name queries will not be cached and the computer’s name
will not be registered. If the service is disabled, any services that explicitly
depend on it will fail to start.

Automatic (Delayed Automatic (Delayed

Start) Start)
This service hosts the DS Role Server. Not Available Not Available
Manual (Trigger Start) Manual (Trigger Start)
Provides the core file encryption technology used to store encrypted files Manual (Trigger Start) Manual (Trigger Start)
on NTFS file system volumes. If this service is stopped or disabled,
applications will be unable to access encrypted files.

Manual Manual

Provides windows clients Extensible Authentication Protocol Service. Manual Manual

Enables you to send and receive faxes, utilizing fax resources available on Manual Manual
this computer or on the network.
Protects user files from accidental loss by copying them to a backup Manual (Trigger Start) Manual (Trigger Start)
location.
The FDPHOST service hosts the Function Discovery (FD) network Manual (Started) Manual (Started)
discovery providers. These FD providers supply network discovery
services for the Simple Services Discovery Protocol (SSDP) and Web
Services – Discovery (WS-D) protocol. Stopping or disabling the
FDPHOST service will disable network discovery for these protocols when
using FD. When this service is unavailable, network services using FD and
relying on these discovery protocols will be unable to find network devices
or resources.

Publishes this computer and resources attached to this computer so they Manual (Started) Manual (Started)
can be discovered over the network. If this service is stopped, network
resources will no longer be published and they will not be discovered by
other computers on the network.

Manual (Trigger Start, Manual (Trigger Start,

Started) Started)
The service is responsible for applying settings configured by Automatic (Trigger Start) Automatic (Trigger Start)
administrators for the computer and users through the Group Policy
component. If the service is stopped or disabled, the settings will not be
applied and applications and components will not be manageable through
Group Policy. Any components or applications that depend on the Group
Policy component might not be functional if the service is stopped or
disabled.

Provides X.509 certificate and key management services for the Network Not Available Not Available
Access Protection Agent (NAPAgent). Enforcement technologies that use
X.509 certificates may not function properly without this service.

Makes local computer changes associated with configuration and Manual Manual
maintenance of the homegroup-joined computer. If this service is stopped
or disabled, your computer will not work properly in a homegroup and your
homegroup might not work properly. It is recommended that you keep this
service running.

Performs networking tasks associated with configuration and maintenance Manual (Trigger Start, Manual (Trigger Start,
of homegroups. If this service is stopped or disabled, your computer will be Started) Started)
unable to detect other homegroups and your homegroup might not work
properly. It is recommended that you keep this service running.

Manual (Trigger Start) Manual (Trigger Start)

Provides a mechanism to exchange data between the virtual machine and Manual (Trigger Start) Manual (Trigger Start)
the operating system running on the physical computer.

Manual (Trigger Start) Manual (Trigger Start)

Provides a mechanism to shut down the operating system of this virtual Manual (Trigger Start) Manual (Trigger Start)
machine from the management interfaces on the physical computer.
Monitors the state of this virtual machine by reporting a heartbeat at Manual (Trigger Start) Manual (Trigger Start)
regular intervals. This service helps you identify running virtual machines
that have stopped responding.
Provides a platform for communication between the virtual machine and Manual (Trigger Start) Manual (Trigger Start)
the operating system running on the physical computer.

Synchronizes the system time of this virtual machine with the system time Manual (Trigger Start) Manual (Trigger Start)
of the physical computer.

Manual (Trigger Start) Manual (Trigger Start)

Coordinates the communications that are required to use Volume Shadow Manual (Trigger Start) Manual (Trigger Start)
Copy Service to back up applications and data on this virtual machine from
the operating system on the physical computer.

Enables this server to administer the IIS metabase. The IIS metabase Not Installed (Automatic, Not Installed (Automatic,
stores configuration for the SMTP and FTP services. If this service is Started) Started)
stopped, the server will be unable to configure SMTP or FTP. If this
service is disabled, any services that explicitly depend on it will fail to start.

The IKEEXT service hosts the Internet Key Exchange (IKE) and Manual (Trigger Start) Manual (Trigger Start)
Authenticated Internet Protocol (AuthIP) keying modules. These keying
modules are used for authentication and key exchange in Internet Protocol
security (IPsec). Stopping or disabling the IKEEXT service will disable IKE
and AuthIP key exchange with peer computers. IPsec is typically
configured to use IKE or AuthIP; therefore, stopping or disabling the
IKEEXT service might result in an IPsec failure and might compromise the
security of the system. It is strongly recommended that you have the
IKEEXT service running.

Not Available Manual (Started)

Not Available Not Available

Enables user notification of user input for interactive services, which Manual Manual
enables access to dialogs created by interactive services when they
appear. If this service is stopped, notifications of new interactive service
dialogs will no longer function and there might not be access to interactive
service dialogs. If this service is disabled, both notifications of and access
to new interactive service dialogs will no longer function.

Provides network address translation, addressing, name resolution and/or Manual Manual
intrusion prevention services for a home or small office network.

Manual Manual

Provides tunnel connectivity using IPv6 transition technologies (6to4, Automatic (Started) Automatic (Started)
ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is
stopped, the computer will not have the enhanced connectivity benefits
that these technologies offer.
Internet Protocol security (IPsec) supports network-level peer Manual (Trigger Start) Manual (Trigger Start)
authentication, data origin authentication, data integrity, data confidentiality
(encryption), and replay protection. This service enforces IPsec policies
created through the IP Security Policies snap-in or the command-line tool
“netsh ipsec”. If you stop this service, you may experience network
connectivity issues if your policy requires that connections use IPsec.
Also,remote management of Windows Firewall is not available when this
service is stopped.

Coordinates transactions between the Distributed Transaction Coordinator Manual (Trigger Start) Manual (Trigger Start)
(MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it
is recommended that this service remain stopped. If it is needed, both
MSDTC and KTM will start this service automatically. If this service is
disabled, any MSDTC transaction interacting with a Kernel Resource
Manager will fail and any services that explicitly depend on it will fail to
start.

Creates a Network Map, consisting of PC and device topology Manual Manual

(connectivity) information, and metadata describing each PC and device. If
this service is disabled, the Network Map will not function properly.

Core Windows Service that manages local user sessions. Stopping or Automatic (Started) Automatic (Started)
disabling this service will result in system instability.
Enables client computers to print to the Line Printer Daemon (LPD) service Not Installed (Automatic, Not Installed (Automatic,
on this server using TCP/IP and the Line Printer Remote (LPR) protocol. Started) Started)

Provides a messaging infrastructure and development tool for creating Not Installed (Automatic, Not Installed (Automatic,
distributed messaging applications for Windows-based networks and Started) Started)
programs. If this service is stopped, distributed messages will be
unavailable. If this service is disabled, any services that explicitly depend
on it will fail to start.

Provides rule-based monitoring of messages arriving in a Message Not Installed (Automatic, Not Installed (Automatic,
Queuing queue and, when the conditions of a rule are satisfied, invokes a Started) Started)
COM component or a stand-alone executable program to process the
message.

Manual Manual

Enables user sign-in through Microsoft account identity services. If this Manual (Trigger Start) Manual (Trigger Start)
service is stopped, users will not be able to logon to the computer with
their Microsoft account.
Enables this server to be a File Transfer Protocol (FTP) server. If this Not Installed (Automatic, Not Installed (Automatic,
service is stopped, the server cannot function as an FTP server. If this Started) Started)
service is disabled, any services that explicitly depend on it will fail to start.

Manages Internet SCSI (iSCSI) sessions from this computer to remote Manual Manual
iSCSI target devices. If this service is stopped, this computer will not be
able to login or access iSCSI targets. If this service is disabled, any
services that explicitly depend on it will fail to start.

Not Available Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start)
Manages software-based volume shadow copies taken by the Volume Manual (Started at boot, Manual (Started at boot,
Shadow Copy service. If this service is stopped, software-based volume then stops) then stops)
shadow copies cannot be managed. If this service is disabled, any
services that explicitly depend on it will fail to start.
 Manual Manual
Manual (Trigger Start) Manual (Trigger Start)

Receives activation requests over the net.msmq and msmq.formatname Not Installed (Automatic, Not Installed (Automatic,
protocols and passes them to the Windows Process Activation Service. Started) Started)

Receives activation requests over the net.pipe protocol and passes them Not Installed (Automatic, Not Installed (Automatic,
to the Windows Process Activation Service. Started) Started)
Receives activation requests over the net.tcp protocol and passes them to Not Installed (Automatic, Not Installed (Automatic,
the Windows Process Activation Service. Started) Started)
Provides ability to share TCP ports over the net.tcp protocol. Disabled (Changed to Disabled (Changed to
Manual and Started if Manual and Started if
the previous 3 Services the previous 3 Services

Maintains a secure channel between this computer and the domain Manual Manual
controller for authenticating users and services. If this service is stopped,
the computer may not authenticate users and services and the domain
controller cannot register DNS records. If this service is disabled, any
services that explicitly depend on it will fail to start.

Network Connected Devices Auto-Setup service monitors and installs Manual (Trigger Start, Manual (Trigger Start,
qualified devices that connect to a qualified network. Stopping or disabling Started) Started)
this service will prevent Windows from discovering and installing qualified
network connected devices automatically. Users can still manually add
network connected devices to a PC through the user interface.

Manual (Trigger Start, Manual (Trigger Start,

Started) Started)
Manages objects in the Network and Dial-Up Connections folder, in which Manual Manual
you can view both local area network and remote connections.

Provides DirectAccess status notification for UI components. Manual (Trigger Start) Manual (Trigger Start)
Identifies the networks to which the computer has connected, collects and Manual (Started) Manual (Started)
stores properties for these networks, and notifies applications when these
properties change.
Collects and stores configuration information for the network and notifies Automatic (Started) Automatic (Started)
programs when this information is modified. If this service is stopped,
configuration information might be unavailable. If this service is disabled,
any services that explicitly depend on it will fail to start.

Manual (Trigger Start) Manual (Trigger Start)

This service delivers network notifications (e.g. interface addition/deleting Automatic (Started) Automatic (Started)
etc) to user mode clients. Stopping this service will cause loss of network
connectivity. If this service is disabled, any other services that explicitly
depend on this service will fail to start.

Not Available Manual

The Offline Files service performs maintenance activities on the Offline Not Available Not Available
Files cache, responds to user logon and logoff events, implements the
internals of the public API, and dispatches interesting events to those
interested in Offline Files activities and changes in cache state.

Provides Drive Optimization Capabilities. Manual Manual

Enables serverless peer name resolution over the Internet using the Peer Manual Manual
Name Resolution Protocol (PNRP). If disabled, some peer-to-peer and
collaborative applications, such as Remote Assistance, may not function.

Enables multi-party communication using Peer-to-Peer Grouping. If Manual Manual

disabled, some applications, such as HomeGroup, may not function.

Provides identity services for the Peer Name Resolution Protocol (PNRP) Manual Manual
and Peer-to-Peer Grouping services. If disabled, the Peer Name
Resolution Protocol (PNRP) and Peer-to-Peer Grouping services may not
function, and some applications, such as HomeGroup and Remote
Assistance, may not function correctly.

Performance Logs and Alerts Collects performance data from local or Manual Manual
remote computers based on preconfigured schedule parameters, then
writes the data to a log or triggers an alert. If this service is stopped,
performance information will not be collected. If this service is disabled,
any services that explicitly depend on it will fail to start.

Legacy Plug and Play Service. Manual (Started) Manual (Started)

This service publishes a machine name using the Peer Name Resolution Manual Manual
Protocol. Configuration is managed via the netsh context ‘p2p pnrp peer’

Enforces group policy for removable mass-storage devices. Enables Manual (Trigger Start) Manual (Trigger Start)
applications such as Windows Media Player and Image Import Wizard to
transfer and synchronize content using removable mass-storage devices.

Manages power policy and power policy notification delivery. Automatic (Started) Automatic (Started)
Loads files to memory for later printing. Automatic (Started) Automatic (Started)
This service opens custom printer dialog boxes and handles notifications Manual Manual
from a remote print server or a printer. If you turn off this service, you won’t
be able to see printer extensions or notifications.

This service provides support for viewing, sending and deletion of system- Manual Manual
level problem reports for the Problem Reports and Solutions control panel.

This service provides support for the Program Compatibility Assistant Manual Manual
(PCA). PCA monitors programs installed and run by the user and detects
known compatibility problems. If this service is stopped, PCA will not
function properly.

Quality Windows Audio Video Experience (qWave) is a networking Manual Manual

platform for Audio Video (AV) streaming applications on IP home
networks. qWave enhances AV streaming performance and reliability by
ensuring network quality-of-service (QoS) for AV applications. It provides
mechanisms for admission control, run time monitoring and enforcement,
application feedback, and traffic prioritization.

Creates a connection to a remote network whenever a program references Manual Manual

a remote DNS or NetBIOS name or address.

Manages dial-up and virtual private network (VPN) connections from this Manual Manual
computer to the Internet or other remote networks. If this service is
disabled, any services that explicitly depend on it will fail to start.
Remote Desktop Configuration service (RDCS) is responsible for all Manual (Maybe Started Manual (Maybe Started
Remote Desktop Services and Remote Desktop related configuration and when using Remote when using Remote
session maintenance activities that require SYSTEM context. These Desktop) Desktop)
include per-session temporary folders, RD themes, and RD certificates.

Allows users to connect interactively to a remote computer. Remote Manual (Maybe Started Manual (Maybe Started
Desktop and Remote Desktop Session Host Server depend on this when using Remote when using Remote
service. To prevent remote use of this computer, clear the checkboxes on Desktop) Desktop)
the Remote tab of the System properties control panel item.

Allows the redirection of Printers/Drives/Ports for RDP connections. Manual (Maybe Started Manual (Maybe Started
when using Remote when using Remote
Desktop) Desktop)
The RPCSS service is the Service Control Manager for COM and DCOM Automatic (Started) Automatic (Started)
servers. It performs object activations requests, object exporter resolutions
and distributed garbage collection for COM and DCOM servers. If this
service is stopped or disabled, programs using COM or DCOM will not
function properly. It is strongly recommended that you have the RPCSS
service running.

In Windows 2003 and earlier versions of Windows, the Remote Procedure Manual Manual
Call (RPC) Locator service manages the RPC name service database. In
Windows Vista and later versions of Windows, this service does not
provide any functionality and is present for application compatibility.

Enables remote users to modify registry settings on this computer. If this Disabled Disabled
service is stopped, the registry can be modified only by users on this
computer. If this service is disabled, any services that explicitly depend on
it will fail to start.

Manual Manual
Listens for route updates sent by routers that use the Routing Information Not Installed (Automatic, Not Installed (Automatic,
Protocol version 1 (RIPv1). Started) Started)
Offers routing services to businesses in local area and wide area network Disabled Disabled
environments.
Resolves RPC interfaces identifiers to transport endpoints. If this service is Automatic (Started) Automatic (Started)
stopped or disabled, programs using Remote Procedure Call (RPC)
services will not function properly.
Enables starting processes under alternate credentials. If this service is Manual Manual
stopped, this type of logon access will be unavailable. If this service is
disabled, any services that explicitly depend on it will fail to start.

Provides support for the Secure Socket Tunneling Protocol (SSTP) to Manual Manual
connect to remote computers using VPN. If this service is disabled, users
will not be able to use SSTP to access remote servers.

The startup of this service signals other services that the Security Automatic (Started) Automatic (Started)
Accounts Manager (SAM) is ready to accept requests. Disabling this
service will prevent other services in the system from being notified when
the SAM is ready, which may in turn cause those services to fail to start
correctly. This service should not be disabled.
The WSCSVC (Windows Security Center) service monitors and reports Automatic (Delayed Automatic (Delayed
security health settings on the computer. The health settings include Start, Started) Start, Started)
firewall (on/off), antivirus (on/off/out of date), antispyware (on/off/out of
date), Windows Update (automatically/manually download and install
updates), User Account Control (on/off), and Internet settings
(recommended/not recommended). The service provides COM APIs for
independent software vendors to register and record the state of their
products to the Security Center service. The Action Center (AC) UI uses
the service to provide systray alerts and a graphical view of the security
health states in the AC control panel. Network Access Protection (NAP)
uses the service to report the security health states of clients to the NAP
Network Policy Server to make network quarantine decisions. The service
also has a public API that allows external consumers to programmatically
retrieve the aggregated security health state of the system.

Manual (Trigger Start) Manual (Trigger Start)

Monitors various sensors in order to expose data and adapt to system and Manual (Trigger Start) Manual (Trigger Start,
user state. If this service is stopped or disabled, the display brightness will Started)
not adapt to lighting conditions. Stopping this service may affect other
system functionality and features as well.

Manual (Trigger Start) Manual (Trigger Start,

Started)
Supports file, print, and named-pipe sharing over the network for this Automatic (Started) Automatic (Started)
computer. If this service is stopped, these functions will be unavailable. If
this service is disabled, any services that explicitly depend on it will fail to
start.

Provides notifications for AutoPlay hardware events. Automatic (Started) Automatic (Started)
Supports the following TCP/IP services: Character Generator, Daytime, Not Installed (Automatic, Not Installed (Automatic,
Discard, Echo, and Quote of the Day. Started) Started)
Manages access to smart cards read by this computer. If this service is Disabled Disabled
stopped, this computer will be unable to read smart cards. If this service is
disabled, any services that explicitly depend on it will fail to start.

Manual (Trigger Start) Manual (Trigger Start)

Allows the system to be configured to lock the user desktop upon smart Manual Manual
card removal.
Enables Simple Network Management Protocol (SNMP) requests to be Not Installed (Automatic, Not Installed (Automatic,
processed by this computer. If this service is stopped, the computer will be Started) Started)
unable to process SNMP requests. If this service is disabled, any services
that explicitly depend on it will fail to start.

Receives trap messages generated by local or remote Simple Network Manual Manual
Management Protocol (SNMP) agents and forwards the messages to
SNMP management programs running on this computer. If this service is
stopped, SNMP-based programs on this computer will not receive SNMP
trap messages. If this service is disabled, any services that explicitly
depend on it will fail to start.

Enables the download, installation and enforcement of digital licenses for Automatic (Delayed Automatic (Delayed
Windows and Windows applications. If the service is disabled, the Start,Trigger Start) Start,Trigger Start)
operating system and licensed applications may run in a notification mode.
It is strongly recommended that you not disable the Software Protection
service.

Provides Disk Corruption Spot Verification Capabilities. Manual (Trigger Start) Manual (Trigger Start)
Discovers networked devices and services that use the SSDP discovery Manual (Started) Manual (Started)
protocol, such as UPnP devices. Also announces SSDP devices and
services running on the local computer. If this service is stopped, SSDP-
based devices will not be discovered. If this service is disabled, any
services that explicitly depend on it will fail to start.

Manual (Started) Manual (Started)

Launches applications associated with still image acquisition events. Manual Manual

Enforces group policy for storage devices Manual (Trigger Start) Manual (Trigger Start)
Maintains and improves system performance over time. Automatic (Started) Automatic (Started)
Tracks system events such as Windows logon, network, and power Automatic (Started) Automatic (Started)
events. Notifies COM+ Event System subscribers of these events.

Coordinates execution of background work for WinRT application. If this Automatic (Trigger Start, Automatic (Trigger Start,
service is stopped or disabled, then background work might not be Started) Started)
triggered.
Enables a user to configure and schedule automated tasks on this Automatic (Started) Automatic (Started)
computer. The service also hosts multiple Windows system-critical tasks. If
this service is stopped or disabled, these tasks will not be run at their
scheduled times. If this service is disabled, any services that explicitly
depend on it will fail to start.

Provides support for the NetBIOS over TCP/IP (NetBT) service and Manual (Trigger Start) Manual (Trigger Start)
NetBIOS name resolution for clients on the network, therefore enabling
users to share files, print, and log on to the network. If this service is
stopped, these functions might be unavailable. If this service is disabled,
any services that explicitly depend on it will fail to start.

Provides Telephony API (TAPI) support for programs that control Manual Manual
telephony devices on the local computer and, through the LAN, on servers
that are also running the service.
Provides user experience theme management. Automatic (Started) Automatic (Started)
Automatic (Started) Automatic (Started)
Coordinates execution of background work for WinRT application. If this Manual (Trigger Start, Manual (Trigger Start,
service is stopped or disabled, then background work might not be Started) Started)
triggered.
Enables Touch Keyboard and Handwriting Panel pen and ink functionality. Manual (Trigger Start) Manual (Trigger Start,
Started)

Manual Manual
Allows UPnP devices to be hosted on this computer. If this service is Manual Manual
stopped, any hosted UPnP devices will stop functioning and no additional
hosted devices can be added. If this service is disabled, any services that
explicitly depend on it will fail to start.

Automatic (Trigger Start, Automatic (Trigger Start,

Started) Started)
This service is responsible for loading and unloading user profiles. If this Automatic (Started) Automatic (Started)
service is stopped or disabled, users will no longer be able to successfully
logon or logoff, applications may have problems getting to users’ data, and
components registered to receive profile event notifications will not receive
them.

Provides management services for disks, volumes, file systems, and Manual Manual
storage arrays.
Manages and implements Volume Shadow Copies used for backup and Manual Manual
other purposes. If this service is stopped, shadow copies will be
unavailable for backup and the backup may fail. If this service is disabled,
any services that explicitly depend on it will fail to start.

Not Installed (Manual) Not Installed (Manual)

Manual Manual
The Web Management Service enables remote and delegated Not Installed (Manual) Not Installed (Manual)
management capabilities for administrators to manage for the Web server,
sites and applications present on this machine.
Enables Windows-based programs to create, access, and modify Internet- Manual (Trigger Start) Manual (Trigger Start)
based files. If this service is stopped, these functions will not be available.
If this service is disabled, any services that explicitly depend on it will fail to
start.

Manages audio for Windows-based programs. If this service is stopped, Automatic (Started) Automatic (Started)
audio devices and effects will not function properly. If this service is
disabled, any services that explicitly depend on it will fail to start.

Manages audio devices for the Windows Audio service. If this service is Automatic (Started) Automatic (Started)
stopped, audio devices and effects will not function properly. If this service
is disabled, any services that explicitly depend on it will fail to start

Provides Windows Backup and Restore capabilities. Manual Manual

The Windows biometric service gives client applications the ability to Manual (Trigger Start) Manual (Trigger Start)
capture, compare, manipulate, and store biometric data without gaining
direct access to any biometric hardware or samples. The service is hosted
in a privileged SVCHOST process.

The WcsPlugInService service hosts third-party Windows Color System Manual Manual
color device model and gamut map model plug-in modules. These plug-in
modules are vendor-specific extensions to the Windows Color System
baseline color device and gamut map models. Stopping or disabling the
WcsPlugInService service will disable this extensibility feature, and the
Windows Color System will use its baseline model processing rather than
the vendor’s desired processing. This might result in inaccurate color
rendering.

WCNCSVC hosts the Windows Connect Now Configuration which is Manual Manual
Microsoft’s Implementation of Wi-Fi Protected Setup (WPS) protocol. This
is used to configure Wireless LAN settings for an Access Point (AP) or a
Wi-Fi Device. The service is started programmatically as needed.

Makes automatic connect/disconnect decisions based on the network Automatic (Trigger Start, Automatic (Trigger Start,
connectivity options currently available to the PC and enables Started) Started)
management of network connectivity based on Group Policy settings.

Manual Manual

Helps protect users from malware and other potentially unwanted Automatic (Started) Automatic (Started)
software.
Manages user-mode driver host processes. Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Allows errors to be reported when programs stop working or responding Manual (Trigger Start) Manual (Trigger Start)
and allows existing solutions to be delivered. Also allows logs to be
generated for diagnostic and repair services. If this service is stopped,
error reporting might not work correctly and results of diagnostic services
and repairs might not be displayed.

This service manages persistent subscriptions to events from remote Manual Manual
sources that support WS-Management protocol. This includes Windows
Vista event logs, hardware and IPMI-enabled event sources. The service
stores forwarded events in a local Event Log. If this service is stopped or
disabled event subscriptions cannot be created and forwarded events
cannot be accepted.

This service manages events and event logs. It supports logging events, Automatic (Started) Automatic (Started)
querying events, subscribing to events, archiving event logs, and
managing event metadata. It can display events in both XML and plain text
format. Stopping this service may compromise security and reliability of
the system.

Windows Firewall helps protect your computer by preventing unauthorized Automatic (Started) Automatic (Started)
users from gaining access to your computer through the Internet or a
network.
Optimizes performance of applications by caching commonly used font Automatic (Started) Automatic (Started)
data. Applications will start this service if it is not already running. It can be
disabled, though doing so will degrade application performance.

Provides image acquisition services for scanners and cameras. Manual Manual

Adds, modifies, and removes applications provided as a Windows Installer Manual Manual
(*.msi) package. If this service is disabled, any services that explicitly
depend on it will fail to start.
Manual (Trigger Start) Manual (Trigger Start)
Provides a common interface and object model to access management Automatic (Started) Automatic (Started)
information about operating system, devices, applications and services. If
this service is stopped, most Windows-based software will not function
properly. If this service is disabled, any services that explicitly depend on it
will fail to start.

Shares Windows Media Player libraries to other networked players and Manual Manual
media devices using Universal Plug and Play.

Manual (Trigger Start) Manual (Trigger Start)

Enables installation, modification, and removal of Windows updates and Manual Manual
optional components. If this service is disabled, install or uninstall of
Windows updates might fail for this computer.

Not Available Not Available

Not Available Not Available

Optimizes performance of Windows Presentation Foundation (WPF) Not Installed (Manual) Not Installed (Manual)
applications by caching commonly used font data. WPF applications will
start this service if it is not already running. It can be disabled, though
doing so will degrade the performance of WPF applications.
The Windows Process Activation Service (WAS) provides process Not Installed (Manual, Not Installed (Manual,
activation, resource management and health management services for Started) Started)
message-activated applications.
Manual Manual

Windows Remote Management (WinRM) service implements the WS- Automatic (Started) Automatic (Started)
Management protocol for remote management. WS-Management is a
standard web services protocol used for remote software and hardware
management. The WinRM service listens on the network for WS-
Management requests and processes them. The WinRM Service needs to
be configured with a listener using winrm.cmd command line tool or
through Group Policy in order for it to listen over the network. The WinRM
service provides access to WMI data and enables event collection. Event
collection and subscription to events require that the service is running.
WinRM messages use HTTP and HTTPS as transports. The WinRM
service does not depend on IIS but is preconfigured to share a port with
IIS on the same machine. The WinRM service reserves the /wsman URL
prefix. To prevent conflicts with IIS, administrators should ensure that any
websites hosted on IIS do not use the /wsman URL prefix.

Provides content indexing, property caching, and search results for files, e- Automatic (Delayed Automatic (Delayed
mail, and other content. Start, Started) Start, Started)
Provides infrastructure support for Windows Store.This service is started Manual (Trigger Start) Manual (Trigger Start)
on demand and if disabled applications bought using Windows Store will
not behave correctly.
Maintains date and time synchronization on all clients and servers in the Manual (Trigger Start) Manual (Trigger Start)
network. If this service is stopped, date and time synchronization will be
unavailable. If this service is disabled, any services that explicitly depend
on it will fail to start.

Enables the detection, download, and installation of updates for Windows Manual (Trigger Start) Manual (Trigger Start)
and other programs. If this service is disabled, users of this computer will
not be able to use Windows Update or its automatic updating feature, and
programs will not be able to use the Windows Update Agent (WUA) API.

WinHTTP implements the client HTTP stack and provides developers with Manual (Started) Manual (Started)
a Win32 API and COM Automation component for sending HTTP requests
and receiving responses. In addition, WinHTTP provides support for auto-
discovering a proxy configuration via its implementation of the Web Proxy
Auto-Discovery (WPAD) protocol.

The Wired AutoConfig (DOT3SVC) service is responsible for performing Manual Manual
IEEE 802.1X authentication on Ethernet interfaces. If your current wired
network deployment enforces 802.1X authentication, the DOT3SVC
service should be configured to run for establishing Layer 2 connectivity
and/or providing access to network resources. Wired networks that do not
enforce 802.1X authentication are unaffected by the DOT3SVC service.
The WLANSVC service provides the logic required to configure, discover, Manual (Automatic with Manual (Automatic with
connect to, and disconnect from a wireless local area network (WLAN) as Wireless Card Installed) Wireless Card Installed)
defined by IEEE 802.11 standards. It also contains the logic to turn your
computer into a software access point so that other devices or computers
can connect to your computer wirelessly using a WLAN adapter that can
support this. Stopping or disabling the WLANSVC service will make all
WLAN adapters on your computer inaccessible from the Windows
networking UI. It is strongly recommended that you have the WLANSVC
service running if your computer has a WLAN adapter.

Provides performance library information from Windows Management Manual Manual

Instrumentation (WMI) providers to clients on the network. This service
only runs when Performance Data Helper is activated.

Manual Manual
Creates and maintains client network connections to remote servers using Automatic (Started) Automatic (Started)
the SMB protocol. If this service is stopped, these connections will be
unavailable. If this service is disabled, any services that explicitly depend
on it will fail to start.

Provides Web connectivity and administration through the Internet Not Installed (Automatic, Not Installed (Automatic,
Information Services Manager Started) Started)

This service manages mobile broadband (GSM & CDMA) data Manual Manual
card/embedded module adapters and connections by auto-configuring the
networks. It is strongly recommended that this service be kept running for
best user experience of mobile broadband devices.

Manual Manual
Manual Manual
Manual Manual
 Windows 10 Configurations

DEFAULT Windows 10 DEFAULT Windows 10 DEFAULT Windows 10 DEFAULT Windows 10

Pro Surface 3 Pro Education Enterprise
Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Not Installed (Manual) Not Installed (Manual) Not Installed (Manual) Not Installed (Manual)

Manual or Automatic Manual or Automatic Manual or Automatic Manual or Automatic

(Delayed Start, Started) (Delayed Start, Started) (Delayed Start, Started) (Delayed Start, Started)
depending on other depending on other depending on other depending on other
services services services services

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Not Available Not Available Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Delayed Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start) Start) Start) Start)
Manual (Trigger Start, Automatic (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Automatic (Delayed Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start, Trigger Start) Start, Trigger Start) Start, Trigger Start) Start, Trigger Start)
Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start,
Started) Started) Started) Started)

Automatic (Delayed Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start) Start) Start) Start)
Not Installed (Manual) Not Installed (Manual) Not Installed (Manual) Not Installed (Manual)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)
Automatic (Trigger Start) Automatic (Trigger Start) Automatic (Trigger Start) Automatic (Trigger Start)

Manual Not Available Manual Manual

Manual Manual Manual Manual

Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Not Available Manual (Started) Not Available Not Available

Not Available Automatic (Trigger Start) Not Available Not Available

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Manual Manual Manual Manual

Not Available Automatic (Started) Not Available Not Available

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Started at boot, Manual (Started at boot, Manual (Started at boot, Manual (Started at boot,
then stops) then stops) then stops) then stops)
Manual Manual Manual Manual
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)
Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)
Disabled (Changed to Disabled (Changed to Disabled (Changed to Disabled (Changed to
Manual and Started if Manual and Started if Manual and Started if Manual and Started if
the previous 3 Services the previous 3 Services the previous 3 Services the previous 3 Services

Manual Manual Manual Manual

Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)

Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)
Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Not Available Manual Not Available Not Available

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)
Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual (Maybe Started Manual (Maybe Started Manual (Maybe Started Manual (Maybe Started
when using Remote when using Remote when using Remote when using Remote
Desktop) Desktop) Desktop) Desktop)

Manual (Maybe Started Manual (Maybe Started Manual (Maybe Started Manual (Maybe Started
when using Remote when using Remote when using Remote when using Remote
Desktop) Desktop) Desktop) Desktop)

Manual (Maybe Started Manual (Maybe Started Manual (Maybe Started Manual (Maybe Started
when using Remote when using Remote when using Remote when using Remote
Desktop) Desktop) Desktop) Desktop)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Disabled Disabled Disabled Disabled

Manual Manual Manual Manual

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)
Disabled Disabled Disabled Disabled

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Delayed Automatic (Delayed Automatic (Delayed Automatic (Delayed
Start, Started) Start, Started) Start, Started) Start, Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start, Manual (Trigger Start) Manual (Trigger Start)
Started)

Manual (Trigger Start) Manual (Trigger Start, Manual (Trigger Start) Manual (Trigger Start)
Started)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)
Disabled Disabled Disabled Disabled

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Manual Manual Manual Manual

Automatic (Delayed Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start,Trigger Start) Start,Trigger Start) Start,Trigger Start) Start,Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start,
Started) Started) Started) Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)
Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start, Manual (Trigger Start,
Started) Started) Started) Started)

Manual (Trigger Start) Manual (Trigger Start, Manual (Trigger Start) Manual (Trigger Start)
Started)

Manual Manual Manual Manual

Manual Manual Manual Manual

Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start,
Started) Started) Started) Started)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Manual Manual Manual Manual

Not Installed (Manual) Not Installed (Manual) Not Installed (Manual) Not Installed (Manual)
Manual Manual Manual Manual
Not Installed (Manual) Not Installed (Manual) Not Installed (Manual) Not Installed (Manual)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Manual Manual Manual Manual

Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start, Automatic (Trigger Start,
Started) Started) Started) Started)

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Manual Manual Manual Manual

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)
Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Not Installed (Manual) Not Installed (Manual) Not Installed (Manual) Not Installed (Manual)
Not Installed (Manual, Not Installed (Manual, Not Installed (Manual, Not Installed (Manual,
Started) Started) Started) Started)

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Automatic (Delayed Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start, Started) Start, Started) Start, Started) Start, Started)
Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start) Manual (Trigger Start)

Manual (Started) Manual (Started) Manual (Started) Manual (Started)

Manual Manual Manual Manual

Manual (Automatic with Manual (Automatic with Manual (Automatic with Manual (Automatic with
Wireless Card Installed) Wireless Card Installed) Wireless Card Installed) Wireless Card Installed)

Manual Manual Manual Manual

Manual Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic (Started) Automatic (Started)

Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic, Not Installed (Automatic,
Started) Started) Started) Started)

Manual Manual Manual Manual

Manual Manual Manual Manual

Manual Manual Manual Manual
Manual Manual Manual Manual
"Safe" "Tweaked"
Manual Manual

Manual (Trigger Start) Disabled *

Manual Manual
Not Installed Not Installed

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start, Manual (Trigger Start,

Started) Started)

Manual Disabled *

Manual Manual

Manual Manual

Not Installed Not Installed

Automatic (Delayed Automatic (Delayed

Start, Started) Start, Started)

Automatic Automatic

Automatic Automatic

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Manual Manual
Manual (Trigger Start) Disabled *

Disabled * Disabled *

Manual Manual
Manual Disabled *

Manual Manual

Disabled * Disabled *
Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic

Manual Manual

Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic
Manual (Started) Manual (Started)

Automatic Automatic

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)
Automatic Automatic

Automatic (Delayed Automatic (Delayed

Start) Start)
Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic

Automatic Automatic

Manual Manual

Manual Manual

Automatic Automatic
Automatic (Started) Disabled *

Manual Manual

Disabled * Disabled *

Automatic (Trigger Start) Automatic (Trigger Start)

Automatic (Delayed Disabled *

Start)
Not installed Not installed
Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start)

Disabled * Disabled *

Manual Manual

Uninstalled * Uninstalled *

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Manual Manual

Disabled * Disabled *

Automatic (Trigger Start) Automatic (Trigger Start)

Manual Disabled *

Manual Manual

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Disabled * Disabled *

Disabled * Disabled *
Disabled * Disabled *
Disabled * Disabled *

Disabled * Disabled *

Disabled * Disabled *

Disabled * Disabled *
Disabled * Disabled *

Not Installed Not Installed

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Automatic (Trigger Start) Automatic (Trigger Start)

Manual Manual

Disabled * Disabled *

Manual Disabled *

Automatic (Started) Disabled *

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Automatic Automatic

Not Installed Not Installed

Not Installed Not Installed

Not Installed Not Installed

Manual Disabled *

Manual (Trigger Start) Manual (Trigger Start)

Not Installed Not Installed

Disabled * Disabled *

Automatic Automatic
Manual (Trigger Start) Manual (Trigger Start)
Manual (Trigger Start) Manual (Trigger Start)
Manual Manual
Manual Manual
Disabled * Disabled *

Not Installed Not Installed

Not Installed Not Installed

Not Installed Not Installed

Uninstalled * Uninstalled *

Manual Disabled *

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Manual Manual
Manual Manual

Automatic Automatic

Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic

Manual Manual
Manual (Trigger Start) Disabled *

Manual Manual
Manual Manual

Manual Manual

Manual Manual

Manual Manual

Manual Manual
Manual Manual

Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic
Automatic Automatic
Manual Manual

Manual Manual

Manual Manual

Manual Manual

Manual Manual

Manual Manual
Manual Manual

Manual Manual

Manual Manual

Automatic Automatic

Disabled * Disabled *

Disabled Disabled

Disabled * Disabled *
Not Installed Not Installed

Disabled Disabled

Automatic Automatic

Manual Manual

Manual Manual

Automatic Automatic
Automatic (Delayed Automatic (Delayed
Start) Start)

Disabled * Disabled *
Disabled * Disabled *

Disabled * Disabled *

Automatic Automatic

Automatic Automatic
Not Installed Not Installed

Disabled Disabled

Disabled * Disabled *

Disabled * Disabled *

Not Installed Not Installed

Disabled * Disabled *

Automatic (Delayed Automatic (Delayed

Start,Trigger Start) Start,Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Manual Manual
Manual Manual

Manual (Trigger Start) Disabled *

Automatic Automatic
Automatic Automatic

Automatic (Trigger Start) Automatic (Trigger Start)

Automatic Automatic

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Automatic Automatic
Automatic Automatic
Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Disabled *

Manual Manual
Manual Manual

Automatic (Trigger Start) Automatic (Trigger Start)

Automatic Automatic

Manual Manual
Manual Manual

Not Installed Not Installed

Manual Manual
Not Installed Not Installed

Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic

Automatic Automatic

Manual Manual
Manual (Trigger Start) Disabled *

Manual Manual

Manual Disabled *

Automatic (Trigger Start) Automatic (Trigger Start)

Manual Manual

Automatic Automatic

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Automatic Automatic

Automatic Automatic

Automatic Automatic

Manual Manual

Manual Manual

Manual (Trigger Start) Manual (Trigger Start)

Automatic Automatic

Disabled * (Uninstalled) Disabled * (Uninstalled)

Disabled * Disabled *
Manual Manual

Automatic Disabled *

Automatic Disabled *

Not Installed Not Installed

Not Installed Not Installed

Manual Manual

Disabled * Disabled *

Automatic (Delayed Automatic (Delayed

Start) Start)
Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual (Trigger Start) Manual (Trigger Start)

Manual Manual

Manual Manual
Manual (Automatic with Manual (Automatic with
Wireless Card Installed) Wireless Card Installed)

Manual Manual

Uninstalled * Uninstalled *
Automatic Automatic

Not Installed Not Installed

Manual Manual

Disabled * Disabled *
Disabled * Disabled *
Disabled * Disabled *
Default Path and Command Line Options Dependencies
C:\Windows\system32\svchost.exe -k AxInstSVGroup Remote Procedure Call: DCOM Server
Process Launcher, RPC Endpoint Mapper

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe -k AppReadiness
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted AppID Driver: Flt Mger, System Attribute
Cache; Cryptographic Services: Remote
Procedure Call: DCOM Server Procces
Launcher, RPC Endpoint Mapper

C:\Windows\system32\svchost.exe -k netsvcs Remote Procedure Call: DCOM Server

Process Launcher, RPC Endpoint Mapper;
User Profile Service: Remote Procedure Call

C:\Windows\System32\alg.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k wsappx Remote Procedure Call: DCOM Server

Process Launcher, RPC Endpoint Mapper
Configuration Information
· Automatic: A service in this state will start at boot time. Some services will stop automatically if not needed. Can
· Automatic (Delayed Start): Service start will happen after boot time.
· Manual (Trigger Start): Allows Windows to start a service when specifically called.
· Manual: Allows Windows to start a service when needed. If you find you need a service, place it in Automatic.
· Disabled: Stops a service from starting, even if needed. Errors in the Event Viewer will show up.
· “Started”: A service that either set to Manual or Automatic that is running by default at or shortly after boot time
· “Not Started”: A service set into Automatic that is not running by default at or shortly after boot time.
· “Not Available”: A service that does not apply to the particular version.
· “Uninstalled”: The ability to uninstall a service that I recommend to be removed by using Add/Remove Windows

Service Default Registry Entries

· Entries are exported directly from the registry of a default Windows 8.1 installation.
· Entries are in the .reg file format.

An * (asterisk) indicates changes from the default.

Two ** (asterisks) indicates you can add or remove this service by:

1. Click on the Search the web and Windows box

2. Type Control Panel (or enough letters so it appears in the results)
3. Select Control Panel (under Results)
4. Select Programs
5. Select Programs and Features
6. Select Turn Windows Features on or off
Or

1. Head to Start (Windows Key)

2. Select All Apps (bottom left)
3. Select Control Panel (under Windows System)
4. Select Programs
5. Select Programs and Features
6. Select Turn Windows features on or off

Display Name Service Name (Registry)

ActiveX Installer (AxInstSV) AxInstSV

App Readiness AppReadiness

Application Experience AeLookupSvc

Application Host Helper Service ** AppHostSvc

Application Identity AppIDSvc

Application Information Appinfo

Application Layer Gateway Service ALG

AppX Development Service AppXSVC

(AppXSVC)
Application Management AppMgmt

ASP.NET State Service ** aspnet_state

Background Intelligent Transfer Service

BITS

Background Tasks Infrastructure Service

BrokerInfrastructure

Base Filtering Engine BFE

BitLocker Drive Encryption Service BDESVC

Block Level Backup Engine Service wbengine

Bluetooth Support Service bthserv

BranchCache PeerDistSvc

Certificate Propagation CertPropSvc

Claims to Windows Token Service **

c2wts

Client for NFS NfsClnt

CNG Key Isolation KeyIso

COM+ Event System EventSystem

COM+ System Application COMSysApp

Computer Browser Browser

Credential Manager VaultSvc

Cryptographic Services CryptSvc

DCOM Server Process Launcher DcomLaunch

Device Association Service DeviceAssociationService

Device Install Service DeviceInstall

Device Setup Manager DsmSVC

DHCP Client Dhcp

Diagnostic Policy Service DPS

Diagnostic Service Host WdiServiceHost

Diagnostic System Host WdiSystemHost

Distributed Link Tracking Client TrkWks

Distributed Transaction CoordinatorMSDTC

DNS Client Dnscache

DS Role Server ** DsRoleSvc

Encrypting File System (EFS) EFS

Extensible Authentication Protocol EapHost

Family Safety WPCSvc

Fax ** Fax

File History Service fhsvc

Function Discovery Provider Host fdPHost

Function Discovery Resource Publication

FDResPub

Group Policy Client gpsvc

Health Key and Certificate Management

hkmsvc

HomeGroup Listener HomeGroupListener

HomeGroup Provider HomeGroupProvider

Human Interface Device Access hidserv

Hyper-V Data Exchange Service vmickvpexchange

Hyper-V Guest Service Interface vmicguestinterface

Hyper-V Guest Shutdown Service vmicshutdown

Hyper-V Heartbeat Service vmicheartbeat

Hyper-V Remote Desktop Virtualization

vmicrdv
Service

Hyper-V Time Synchronization Service

vmictimesync

Hyper-V Volume Shadow Copy Requestor

vmicvss

IIS Admin Service ** IISADMIN

IKE and AuthIP IPsec Keying Modules

IKEEXT

Interactive Services Detection UI0Detect

Internet Connection Sharing (ICS) SharedAccess

Internet Explorer ETW Collector IEEtwCollectorService

Service
IP Helper iphlpsvc

IPsec Policy Agent PolicyAgent

KtmRm for Distributed Transaction KtmRm

Coordinator

Link-Layer Topology Discovery Mapper

lltdsvc

Local Session Manager LSM

LPD Service ** LPDSVC

Message Queuing Triggers ** MSMQTriggers

Message Queuing ** MSMQ

Microsoft Account Sign-in Assistantwlidsvc

Microsoft FTP Service ** ftpsvc

Microsoft iSCSI Initiator Service MSiSCSI

Microsoft Software Shadow Copy Provider

swprv

Multimedia Class Scheduler MMCSS

Net.Msmq Listener Adapter ** NetMsmqActivator

Net.Pipe Listener Adapter ** NetPipeActivator

Net.Tcp Listener Adapter ** NetTcpActivator

Net.Tcp Port Sharing Service** NetTcpPortSharing

Netlogon Netlogon

Network Access Protection Agent napagent

Network Connected Devices Auto-Setup

NcdAutoSetup

Network Connection Broker NcbService

Network Connections Netman

Network Connectivity Assistant NcaSVC

Network List Service netprofm

Network Location Awareness NlaSvc

Network Store Interface Service nsi

Offline Files CscService

Optimize Drives defragsvc

Peer Name Resolution Protocol PNRPsvc

Peer Networking Grouping p2psvc

Peer Networking Identity Manager p2pimsvc

Performance Logs & Alerts pla

Plug and Play PlugPlay

PNRP Machine Name Publication Service
PNRPAutoReg

Portable Device Enumerator ServiceWPDBusEnum

Power Power

Print Spooler Spooler

Printer Extensions and NotificationsPrintNotify

Problem Reports and Solutions Control

wercplsupport
Panel Support
Program Compatibility Assistant Service
PcaSvc

Quality Windows Audio Video Experience

QWAVE

Remote Access Auto Connection Manager

RasAuto

Remote Access Connection Manager

RasMan

Remote Desktop Configuration SessionEnv

Remote Desktop Services UserModeUmRdpService

Port Redirector

Remote Desktop Services TermService

Remote Procedure Call (RPC) RpcSs

Remote Procedure Call (RPC) Locator

RpcLocator
Remote Registry RemoteRegistry

RIP Listener ** iprip

Routing and Remote Access RemoteAccess

RPC Endpoint Mapper RpcEptMapper

Secondary Logon seclogon

Secure Socket Tunneling Protocol Service

SstpSvc

Security Accounts Manager SamSs

Security Center wscsvc

Sensor Monitoring Service SensrSvc

Server LanmanServer

Shell Hardware Detection ShellHWDetection

Simple TCP/IP Services ** simptcp

Smart Card SCardSvr

Smart Card Device Enumeration ScDeviceEnum

Service
Smart Card Removal Policy SCPolicySvc

SNMP Service ** SNMP

SNMP Trap SNMPTRAP

Software Protection sppsvc

Spot Verifier svsvc

SSDP Discovery SSDPSRV

Still Image Acquisition Events WiaRpc

Storage Service StorSvc

Superfetch SysMain

System Event Notification Service SENS

System Events Broker SystemEventsBroker

Task Scheduler Schedule

TCP/IP NetBIOS Helper lmhosts

Telephony TapiSrv

Telnet ** TlntSvr

Themes Themes

Thread Ordering Server THREADORDER

Time Broker TimeBroker

Touch Keyboard and Handwriting Panel

TabletInputService
Service

UPnP Device Host upnphost

User Profile Service ProfSvc

Virtual Disk vds

Volume Shadow Copy VSS

Web Management Service ** WMSVC

WebClient WebClient

Windows Audio AudioSrv

Windows Audio Endpoint Builder AudioEndpointBuilder

Windows Biometric Service WbioSrvc

Windows Color System WcsPlugInService

Windows Connect Now - Config Registrar

wcncsvc

Windows Connection Manager Wcmsvc

Windows Defender Network WdNisSvc

Inspection Service
Windows Defender Service WinDefend

Windows Driver Foundation - User-mode

wudfsvc
Driver Framework

Windows Encryption Provider WEPHOSTSVC

Host Service
Windows Error Reporting Service WerSvc

Windows Event Collector Wecsvc

Windows Event Log EventLog

Windows Firewall MpsSvc

Windows Font Cache Service FontCache

Windows Image Acquisition (WIA) StiSvc

Windows Installer msiserver

Windows Location Framework lfsvc

Service
Windows Management Instrumentation
Winmgmt

Windows Media Player Network Sharing

WMPNetworkSvc
Service **

Windows Modules Installer TrustedInstaller

Windows Presentation Foundation Font

FontCache3.0.0.0
Cache 3.0.0.0 **

Windows Process Activation ServiceWAS

**
Windows Remote Management (WS-Management)
WinRM

Windows Search ** WSearch

Windows Store Service (WSService)WSService

Windows Time W32Time

Windows Update wuauserv

WinHTTP Web Proxy Auto-Discovery

WinHttpAutoProxySvc
Service
Wired AutoConfig dot3svc

WLAN AutoConfig WlanSvc

WMI Performance Adapter wmiApSrv

Work Folders workfolderssvc

Workstation LanmanWorkstation

World Wide Web Publishing ServiceW3SVC

**

WWAN AutoConfig WwanSvc

 Windows 8.1
boot time. Some services will stop automatically if not needed. Can place a service that is not needed in Manual or Disabled.
happen after boot time.
art a service when specifically called.
hen needed. If you find you need a service, place it in Automatic.
f needed. Errors in the Event Viewer will show up.
or Automatic that is running by default at or shortly after boot time.
hat is not running by default at or shortly after boot time.
y to the particular version.
e that I recommend to be removed by using Add/Remove Windows Features.

of a default Windows 8.1 installation.

DEFAULT Windows
Description
8.1
Provides User Account Control validation for the installation of Manual
ActiveX controls from the Internet and enables management of
ActiveX control installation based on Group Policy settings. This
service is started on demand and if disabled the installation of
ActiveX controls will behave according to default browser settings.

Gets apps ready for use the first time a user signs in to this PC and Manual
when adding new apps.
Processes application compatibility cache requests for applications Manual (Trigger
as they are launched. Start)
Provides administrative services for IIS, for example configuration Not Installed
history and Application Pool account mapping. If this service is (Automatic, Started)
stopped, configuration history and locking down files or directories
with Application Pool specific Access Control Entries will not work.

Determines and verifies the identity of an application. Disabling this Manual (Trigger
service will prevent AppLocker from being enforced. Start)

Facilitates the running of interactive applications with additional Manual (Trigger Start,
administrative privileges. If this service is stopped, users will be Started)
unable to launch applications with the additional administrative
privileges they may require to perform desired user tasks.

Provides support for 3rd party protocol plug-ins for Internet Manual
Connection Sharing
Manual

Processes installation, removal, and enumeration requests for Not Available

software deployed through Group Policy. If the service is disabled,
users will be unable to install, remove, or enumerate software
deployed through Group Policy. If this service is disabled, any
services that explicitly depend on it will fail to start.

Provides support for out-of-process session states for ASP.NET. If this Not Installed
service is stopped, out-of-process requests will not be processed. If (Manual)
this service is disabled, any services that explicitly depend on it will
fail to start.

Transfers files in the background using idle network bandwidth. If Automatic (Delayed
the service is disabled, then any applications that depend on BITS, Start, Started)
such as Windows Update or MSN Explorer, will be unable to
automatically download programs and other information.

Coordinates execution of background work for WinRT applications. Automatic (Started)

The Base Filtering Engine (BFE) is a service that manages firewall and Automatic (Started)
Internet Protocol security (IPsec) policies and implements user mode
filtering. Stopping or disabling the BFE service will significantly
reduce the security of the system. It will also result in unpredictable
behavior in IPsec management and firewall applications.
BDESVC hosts the BitLocker Drive Encryption service. BitLocker Drive Manual (Trigger
Encryption provides secure startup for the operating system, as well Start)
as full volume encryption for OS, fixed or removable volumes. This
service allows BitLocker to prompt users for various actions related
to their volumes when mounted, and unlocks volumes automatically
without user interaction. Additionally, it stores recovery information
to Active Directory, if available, and, if necessary, ensures the most
recent recovery certificates are used. Stopping or disabling the
service would prevent users from leveraging this functionality.

The WBENGINE service is used by Windows Backup to perform Manual

backup and recovery operations. If this service is stopped by a user,
it may cause the currently running backup or recovery operation to
fail. Disabling this service may disable backup and recovery
operations using Windows Backup on this computer.

The Bluetooth service supports discovery and association of remote Manual (Trigger
Bluetooth devices. Stopping or disabling this service may cause Start)
already installed Bluetooth devices to fail to operate properly and
prevent new devices from being discovered or associated.

This service caches network content from peers on the local subnet. Not Available

Copies user certificates and root certificates from smart cards into Manual
the current user’s certificate store, detects when a smart card is
inserted into a smart card reader, and, if needed, installs the smart
card Plug and Play minidriver.

Service to convert claims based identities to windows identities Not Installed

(Manual)
Enables this computer to access files on NFS shares Not Available
The CNG key isolation service is hosted in the LSA process. The Manual (Trigger Start,
service provides key process isolation to private keys and associated Started)
cryptographic operations as required by the Common Criteria. The
service stores and uses long-lived keys in a secure process complying
with Common Criteria requirements.

Supports System Event Notification Service (SENS), which provides Automatic (Started)
automatic distribution of events to subscribing Component Object
Model (COM) components. If the service is stopped, SENS will close
and will not be able to provide logon and logoff notifications. If this
service is disabled, any services that explicitly depend on it will fail to
start.
Manages the configuration and tracking of Component Object Model Manual (Started)
(COM)+-based components. If the service is stopped, most COM+-
based components will not function properly. If this service is
disabled, any services that explicitly depend on it will fail to start.

Maintains an updated list of computers on the network and supplies Manual (Trigger Start,
this list to computers designated as browsers. If this service is Started)
stopped, this list will not be updated or maintained. If this service is
disabled, any services that explicitly depend on it will fail to start.

Provides secure storage and retrieval of credentials to users, Manual

applications and security service packages.
Provides three management services: Catalog Database Service, Automatic (Started)
which confirms the signatures of Windows files and allows new
programs to be installed; Protected Root Service, which adds and
removes Trusted Root Certification Authority certificates from this
computer; and Automatic Root Certificate Update Service, which
retrieves root certificates from Windows Update and enable
scenarios such as SSL. If this service is stopped, these management
services will not function properly. If this service is disabled, any
services that explicitly depend on it will fail to start.

The DCOMLAUNCH service launches COM and DCOM servers in Automatic (Started)
response to object activation requests. If this service is stopped or
disabled, programs using COM or DCOM will not function properly. It
is strongly recommended that you have the DCOMLAUNCH service
running.

Enables pairing between the system and wired or wireless devices. Automatic (Trigger
Start, Started)
Enables a computer to recognize and adapt to hardware changes Manual (Trigger
with little or no user input. Stopping or disabling this service will Start)
result in system instability.

Enables the detection, download and installation of device-related Manual (Trigger

software. If this service is disabled, devices may be configured with Start)
outdated software, and may not work correctly.

Registers and updates IP addresses and DNS records for this Automatic (Started)
computer. If this service is stopped, this computer will not receive
dynamic IP addresses and DNS updates. If this service is disabled, any
services that explicitly depend on it will fail to start.

The Diagnostic Policy Service enables problem detection, Automatic (Started)

troubleshooting and resolution for Windows components. If this
service is stopped, diagnostics will no longer function.
The Diagnostic Service Host is used by the Diagnostic Policy Service Manual (Started)
to host diagnostics that need to run in a Local Service context. If this
service is stopped, any diagnostics that depend on it will no longer
function.

The Diagnostic System Host is used by the Diagnostic Policy Service Manual
to host diagnostics that need to run in a Local System context. If this
service is stopped, any diagnostics that depend on it will no longer
function.

Maintains links between NTFS files within a computer or across Automatic (Started)
computers in a network.
Coordinates transactions that span multiple resource managers, such Manual
as databases, message queues, and file systems. If this service is
stopped, these transactions will fail. If this service is disabled, any
services that explicitly depend on it will fail to start.

The DNS Client service (dnscache) caches Domain Name System Automatic (Trigger
(DNS) names and registers the full computer name for this computer. Start, Started)
If the service is stopped, DNS names will continue to be resolved.
However, the results of DNS name queries will not be cached and
the computer’s name will not be registered. If the service is disabled,
any services that explicitly depend on it will fail to start.

This service hosts the DS Role Server. Not Available

Provides the core file encryption technology used to store encrypted Manual (Trigger
files on NTFS file system volumes. If this service is stopped or Start)
disabled, applications will be unable to access encrypted files.

The Extensible Authentication Protocol (EAP) service provides Manual

network authentication in such scenarios as 802.1x wired and
wireless, VPN, and Network Access Protection (NAP). EAP also
provides application programming interfaces (APIs) that are used by
network access clients, including wireless and VPN clients, during the
authentication process. If you disable this service, this computer is
prevented from accessing networks that require EAP authentication.

This service is a stub for Windows Parental Control functionality that Manual
existed in Vista. It is provided for backward compatibility only.

Enables you to send and receive faxes, utilizing fax resources Manual
available on this computer or on the network.
Protects user files from accidental loss by copying them to a backup Manual (Trigger
location. Start)
The FDPHOST service hosts the Function Discovery (FD) network Manual (Started)
discovery providers. These FD providers supply network discovery
services for the Simple Services Discovery Protocol (SSDP) and Web
Services – Discovery (WS-D) protocol. Stopping or disabling the
FDPHOST service will disable network discovery for these protocols
when using FD. When this service is unavailable, network services
using FD and relying on these discovery protocols will be unable to
find network devices or resources.

Publishes this computer and resources attached to this computer so Manual (Started)
they can be discovered over the network. If this service is stopped,
network resources will no longer be published and they will not be
discovered by other computers on the network.

The service is responsible for applying settings configured by Automatic (Trigger

administrators for the computer and users through the Group Policy Start, Started)
component. If the service is stopped or disabled, the settings will not
be applied and applications and components will not be manageable
through Group Policy. Any components or applications that depend
on the Group Policy component might not be functional if the service
is stopped or disabled.

Provides X.509 certificate and key management services for the Manual
Network Access Protection Agent (NAPAgent). Enforcement
technologies that use X.509 certificates may not function properly
without this service.

Makes local computer changes associated with configuration and Manual

maintenance of the homegroup-joined computer. If this service is
stopped or disabled, your computer will not work properly in a
homegroup and your homegroup might not work properly. It is
recommended that you keep this service running.

Performs networking tasks associated with configuration and Manual (Trigger Start,
maintenance of homegroups. If this service is stopped or disabled, Started)
your computer will be unable to detect other homegroups and your
homegroup might not work properly. It is recommended that you
keep this service running.

Enables generic input access to Human Interface Devices (HID), Manual (Trigger
which activates and maintains the use of predefined hot buttons on Start)
keyboards, remote controls, and other multimedia devices. If this
service is stopped, hot buttons controlled by this service will no
longer function. If this service is disabled, any services that explicitly
depend on it will fail to start.
Provides a mechanism to exchange data between the virtual Manual (Trigger
machine and the operating system running on the physical Start)
computer.

Manual (Trigger
Start)
Provides a mechanism to shut down the operating system of this Manual (Trigger
virtual machine from the management interfaces on the physical Start)
computer.

Monitors the state of this virtual machine by reporting a heartbeat at Manual (Trigger
regular intervals. This service helps you identify running virtual Start)
machines that have stopped responding.

Provides a platform for communication between the virtual machine Manual (Trigger
and the operating system running on the physical computer. Start)

Synchronizes the system time of this virtual machine with the system Manual (Trigger
time of the physical computer. Start)
Coordinates the communications that are required to use Volume Manual (Trigger
Shadow Copy Service to back up applications and data on this virtual Start)
machine from the operating system on the physical computer.

Enables this server to administer the IIS metabase. The IIS metabase Not Installed
stores configuration for the SMTP and FTP services. If this service is (Automatic, Started)
stopped, the server will be unable to configure SMTP or FTP. If this
service is disabled, any services that explicitly depend on it will fail to
start.

The IKEEXT service hosts the Internet Key Exchange (IKE) and Manual (Trigger
Authenticated Internet Protocol (AuthIP) keying modules. These Start)
keying modules are used for authentication and key exchange in
Internet Protocol security (IPsec). Stopping or disabling the IKEEXT
service will disable IKE and AuthIP key exchange with peer
computers. IPsec is typically configured to use IKE or AuthIP;
therefore, stopping or disabling the IKEEXT service might result in an
IPsec failure and might compromise the security of the system. It is
strongly recommended that you have the IKEEXT service running.

Enables user notification of user input for interactive services, which Manual
enables access to dialogs created by interactive services when they
appear. If this service is stopped, notifications of new interactive
service dialogs will no longer function and there might not be access
to interactive service dialogs. If this service is disabled, both
notifications of and access to new interactive service dialogs will no
longer function.
Provides network address translation, addressing, name resolution Disabled
and/or intrusion prevention services for a home or small office
network.

Manual

Provides tunnel connectivity using IPv6 transition technologies (6to4, Automatic (Started)
ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is
stopped, the computer will not have the enhanced connectivity
benefits that these technologies offer.

Internet Protocol security (IPsec) supports network-level peer Manual (Trigger

authentication, data origin authentication, data integrity, data Start)
confidentiality (encryption), and replay protection. This service
enforces IPsec policies created through the IP Security Policies snap-
in or the command-line tool “netsh ipsec”. If you stop this service,
you may experience network connectivity issues if your policy
requires that connections use IPsec. Also,remote management of
Windows Firewall is not available when this service is stopped.

Coordinates transactions between the Distributed Transaction Manual (Trigger

Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If Start)
it is not needed, it is recommended that this service remain stopped.
If it is needed, both MSDTC and KTM will start this service
automatically. If this service is disabled, any MSDTC transaction
interacting with a Kernel Resource Manager will fail and any services
that explicitly depend on it will fail to start.

Creates a Network Map, consisting of PC and device topology Manual

(connectivity) information, and metadata describing each PC and
device. If this service is disabled, the Network Map will not function
properly.

Core Windows Service that manages local user sessions. Stopping or Automatic (Started)
disabling this service will result in system instability.

Enables client computers to print to the Line Printer Daemon (LPD) Not Installed
service on this server using TCP/IP and the Line Printer Remote (LPR) (Automatic, Started)
protocol.

Provides rule-based monitoring of messages arriving in a Message Not Installed

Queuing queue and, when the conditions of a rule are satisfied, (Automatic, Started)
invokes a COM component or a stand-alone executable program to
process the message.
Provides a messaging infrastructure and development tool for Not Installed
creating distributed messaging applications for Windows-based (Automatic, Started)
networks and programs. If this service is stopped, distributed
messages will be unavailable. If this service is disabled, any services
that explicitly depend on it will fail to start.

Enables user sign-in through Microsoft account identity services. If Manual (Trigger
this service is stopped, users will not be able to logon to the Start)
computer with their Microsoft account.

Enables this server to be a File Transfer Protocol (FTP) server. If this Not Installed
service is stopped, the server cannot function as an FTP server. If this (Automatic, Started)
service is disabled, any services that explicitly depend on it will fail to
start.

Manages Internet SCSI (iSCSI) sessions from this computer to remote Manual
iSCSI target devices. If this service is stopped, this computer will not
be able to login or access iSCSI targets. If this service is disabled, any
services that explicitly depend on it will fail to start.

Manages software-based volume shadow copies taken by the Manual (Started at

Volume Shadow Copy service. If this service is stopped, software- boot, then stops)
based volume shadow copies cannot be managed. If this service is
disabled, any services that explicitly depend on it will fail to start.

Enables relative prioritization of work based on system-wide task Automatic (Started)

priorities. This is intended mainly for multimedia applications. If this
service is stopped, individual tasks resort to their default priority.

Receives activation requests over the net.msmq and Not Installed

msmq.formatname protocols and passes them to the Windows (Automatic, Started)
Process Activation Service.

Receives activation requests over the net.pipe protocol and passes Not Installed
them to the Windows Process Activation Service. (Automatic, Started)

Receives activation requests over the net.tcp protocol and passes Not Installed
them to the Windows Process Activation Service. (Automatic, Started)

Provides ability to share TCP ports over the net.tcp protocol. Disabled (Changed to
Manual and Started if
the previous 3
Services are installed)
Maintains a secure channel between this computer and the domain Manual
controller for authenticating users and services. If this service is
stopped, the computer may not authenticate users and services and
the domain controller cannot register DNS records. If this service is
disabled, any services that explicitly depend on it will fail to start.

The Network Access Protection (NAP) agent service collects and Manual
manages health information for client computers on a network.
Information collected by NAP agent is used to make sure that the
client computer has the required software and settings. If a client
computer is not compliant with health policy, it can be provided with
restricted network access until its configuration is updated.
Depending on the configuration of health policy, client computers
might be automatically updated so that users quickly regain full
network access without having to manually update their computer.

Network Connected Devices Auto-Setup service monitors and installs Manual (Trigger Start,
qualified devices that connect to a qualified network. Stopping or Started)
disabling this service will prevent Windows from discovering and
installing qualified network connected devices automatically. Users
can still manually add network connected devices to a PC through
the user interface.

Manual (Trigger Start,

Started)
Manages objects in the Network and Dial-Up Connections folder, in Manual
which you can view both local area network and remote
connections.

Provides DirectAccess status notification for UI components. Manual (Trigger

Start)
Identifies the networks to which the computer has connected, Manual (Started)
collects and stores properties for these networks, and notifies
applications when these properties change.

Collects and stores configuration information for the network and Automatic (Started)
notifies programs when this information is modified. If this service is
stopped, configuration information might be unavailable. If this
service is disabled, any services that explicitly depend on it will fail to
start.

This service delivers network notifications (e.g. interface Automatic (Started)

addition/deleting etc) to user mode clients. Stopping this service will
cause loss of network connectivity. If this service is disabled, any
other services that explicitly depend on this service will fail to start.
The Offline Files service performs maintenance activities on the Not Available
Offline Files cache, responds to user logon and logoff events,
implements the internals of the public API, and dispatches
interesting events to those interested in Offline Files activities and
changes in cache state.

Provides Drive Optimization Capabilities. Manual

Enables serverless peer name resolution over the Internet using the Manual (Started)
Peer Name Resolution Protocol (PNRP). If disabled, some peer-to-
peer and collaborative applications, such as Remote Assistance, may
not function.

Enables multi-party communication using Peer-to-Peer Grouping. If Manual (Started)

disabled, some applications, such as HomeGroup, may not function.

Provides identity services for the Peer Name Resolution Protocol Manual (Started)
(PNRP) and Peer-to-Peer Grouping services. If disabled, the Peer
Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping
services may not function, and some applications, such as
HomeGroup and Remote Assistance, may not function correctly.

Performance Logs and Alerts Collects performance data from local or Manual
remote computers based on preconfigured schedule parameters,
then writes the data to a log or triggers an alert. If this service is
stopped, performance information will not be collected. If this
service is disabled, any services that explicitly depend on it will fail to
start.

Legacy Plug and Play Service. Manual (Started)

This service publishes a machine name using the Peer Name Manual
Resolution Protocol. Configuration is managed via the netsh context
‘p2p pnrp peer’

Enforces group policy for removable mass-storage devices. Enables Manual (Trigger
applications such as Windows Media Player and Image Import Start)
Wizard to transfer and synchronize content using removable mass-
storage devices.

Manages power policy and power policy notification delivery. Automatic (Started)

Loads files to memory for later printing. Automatic (Started)

This service opens custom printer dialog boxes and handles Manual
notifications from a remote print server or a printer. If you turn off
this service, you won’t be able to see printer extensions or
notifications.

This service provides support for viewing, sending and deletion of Manual
system-level problem reports for the Problem Reports and Solutions
control panel.
This service provides support for the Program Compatibility Assistant Automatic
(PCA). PCA monitors programs installed and run by the user and
detects known compatibility problems. If this service is stopped, PCA
will not function properly.

Quality Windows Audio Video Experience (qWave) is a networking Manual

platform for Audio Video (AV) streaming applications on IP home
networks. qWave enhances AV streaming performance and
reliability by ensuring network quality-of-service (QoS) for AV
applications. It provides mechanisms for admission control, run time
monitoring and enforcement, application feedback, and traffic
prioritization.

Creates a connection to a remote network whenever a program Manual

references a remote DNS or NetBIOS name or address.

Manages dial-up and virtual private network (VPN) connections from Manual
this computer to the Internet or other remote networks. If this
service is disabled, any services that explicitly depend on it will fail to
start.

Remote Desktop Configuration service (RDCS) is responsible for all Manual (Maybe
Remote Desktop Services and Remote Desktop related configuration Started when using
and session maintenance activities that require SYSTEM context. Remote Desktop)
These include per-session temporary folders, RD themes, and RD
certificates.

Allows the redirection of Printers/Drives/Ports for RDP connections. Manual (Maybe

Started when using
Remote Desktop)

Allows users to connect interactively to a remote computer. Remote Manual (Maybe

Desktop and Remote Desktop Session Host Server depend on this Started when using
service. To prevent remote use of this computer, clear the Remote Desktop)
checkboxes on the Remote tab of the System properties control
panel item.

The RPCSS service is the Service Control Manager for COM and Automatic (Started)
DCOM servers. It performs object activations requests, object
exporter resolutions and distributed garbage collection for COM and
DCOM servers. If this service is stopped or disabled, programs using
COM or DCOM will not function properly. It is strongly
recommended that you have the RPCSS service running.

In Windows 2003 and earlier versions of Windows, the Remote Manual

Procedure Call (RPC) Locator service manages the RPC name service
database. In Windows Vista and later versions of Windows, this
service does not provide any functionality and is present for
application compatibility.
Enables remote users to modify registry settings on this computer. If Disabled
this service is stopped, the registry can be modified only by users on
this computer. If this service is disabled, any services that explicitly
depend on it will fail to start.

Listens for route updates sent by routers that use the Routing Not Installed
Information Protocol version 1 (RIPv1). (Automatic, Started)

Offers routing services to businesses in local area and wide area Disabled
network environments.
Resolves RPC interfaces identifiers to transport endpoints. If this Automatic (Started)
service is stopped or disabled, programs using Remote Procedure
Call (RPC) services will not function properly.

Enables starting processes under alternate credentials. If this service Manual

is stopped, this type of logon access will be unavailable. If this service
is disabled, any services that explicitly depend on it will fail to start.

Provides support for the Secure Socket Tunneling Protocol (SSTP) to Manual
connect to remote computers using VPN. If this service is disabled,
users will not be able to use SSTP to access remote servers.

The startup of this service signals other services that the Security Automatic (Started)
Accounts Manager (SAM) is ready to accept requests. Disabling this
service will prevent other services in the system from being notified
when the SAM is ready, which may in turn cause those services to
fail to start correctly. This service should not be disabled.

The WSCSVC (Windows Security Center) service monitors and Automatic (Delayed
reports security health settings on the computer. The health settings Start, Started)
include firewall (on/off), antivirus (on/off/out of date), antispyware
(on/off/out of date), Windows Update (automatically/manually
download and install updates), User Account Control (on/off), and
Internet settings (recommended/not recommended). The service
provides COM APIs for independent software vendors to register and
record the state of their products to the Security Center service. The
Action Center (AC) UI uses the service to provide systray alerts and a
graphical view of the security health states in the AC control panel.
Network Access Protection (NAP) uses the service to report the
security health states of clients to the NAP Network Policy Server to
make network quarantine decisions. The service also has a public API
that allows external consumers to programmatically retrieve the
aggregated security health state of the system.
Monitors various sensors in order to expose data and adapt to Manual (Trigger
system and user state. If this service is stopped or disabled, the Start)
display brightness will not adapt to lighting conditions. Stopping this
service may affect other system functionality and features as well.

Supports file, print, and named-pipe sharing over the network for Automatic (Started)
this computer. If this service is stopped, these functions will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.

Provides notifications for AutoPlay hardware events. Automatic (Started)

Supports the following TCP/IP services: Character Generator, Not Installed

Daytime, Discard, Echo, and Quote of the Day. (Automatic, Started)

Manages access to smart cards read by this computer. If this service Disabled
is stopped, this computer will be unable to read smart cards. If this
service is disabled, any services that explicitly depend on it will fail to
start.

Manual (Trigger
Start)
Allows the system to be configured to lock the user desktop upon Manual
smart card removal.
Enables Simple Network Management Protocol (SNMP) requests to Not Installed
be processed by this computer. If this service is stopped, the (Automatic, Started)
computer will be unable to process SNMP requests. If this service is
disabled, any services that explicitly depend on it will fail to start.

Receives trap messages generated by local or remote Simple Manual

Network Management Protocol (SNMP) agents and forwards the
messages to SNMP management programs running on this
computer. If this service is stopped, SNMP-based programs on this
computer will not receive SNMP trap messages. If this service is
disabled, any services that explicitly depend on it will fail to start.

Enables the download, installation and enforcement of digital Automatic (Delayed

licenses for Windows and Windows applications. If the service is Start, Started)
disabled, the operating system and licensed applications may run in
a notification mode. It is strongly recommended that you not disable
the Software Protection service.

Provides Disk Corruption Spot Verification Capabilities. Manual (Trigger

Start)
Discovers networked devices and services that use the SSDP Manual (Started)
discovery protocol, such as UPnP devices. Also announces SSDP
devices and services running on the local computer. If this service is
stopped, SSDP-based devices will not be discovered. If this service is
disabled, any services that explicitly depend on it will fail to start.

Launches applications associated with still image acquisition events. Manual

Enforces group policy for storage devices Manual (Trigger

Start)
Maintains and improves system performance over time. Automatic (Started)

Monitors system events and notifies subscribers to COM+ Event Automatic (Started)
System of these events.
Coordinates execution of background work for WinRT application. If Automatic (Trigger
this service is stopped or disabled, then background work might not Start, Started)
be triggered.

Enables a user to configure and schedule automated tasks on this Automatic (Started)
computer. The service also hosts multiple Windows system-critical
tasks. If this service is stopped or disabled, these tasks will not be run
at their scheduled times. If this service is disabled, any services that
explicitly depend on it will fail to start.

Provides support for the NetBIOS over TCP/IP (NetBT) service and Automatic (Trigger
NetBIOS name resolution for clients on the network, therefore Start, Started)
enabling users to share files, print, and log on to the network. If this
service is stopped, these functions might be unavailable. If this
service is disabled, any services that explicitly depend on it will fail to
start.

Provides Telephony API (TAPI) support for programs that control Manual
telephony devices on the local computer and, through the LAN, on
servers that are also running the service.

Enables a remote user to log on to this computer and run programs, Not Installed
and supports various TCP/IP Telnet clients, including UNIX-based and (Disabled)
Windows-based computers. If this service is stopped, remote user
access to programs might be unavailable. If this service is disabled,
any services that explicitly depend on it will fail to start.

Provides user experience theme management. Automatic (Started)

Provides ordered execution for a group of threads within a specific Manual

period of time.
Coordinates execution of background work for WinRT application. If Manual (Trigger Start,
this service is stopped or disabled, then background work might not Started)
be triggered.

Enables Touch Keyboard and Handwriting Panel pen and ink Manual (Trigger
functionality. Start)
Allows UPnP devices to be hosted on this computer. If this service is Manual
stopped, any hosted UPnP devices will stop functioning and no
additional hosted devices can be added. If this service is disabled,
any services that explicitly depend on it will fail to start.

This service is responsible for loading and unloading user profiles. If Automatic (Started)
this service is stopped or disabled, users will no longer be able to
successfully logon or logoff, applications may have problems getting
to users’ data, and components registered to receive profile event
notifications will not receive them.

Provides management services for disks, volumes, file systems, and Manual
storage arrays.
Manages and implements Volume Shadow Copies used for backup Manual
and other purposes. If this service is stopped, shadow copies will be
unavailable for backup and the backup may fail. If this service is
disabled, any services that explicitly depend on it will fail to start.

The Web Management Service enables remote and delegated Not Installed
management capabilities for administrators to manage for the Web (Manual)
server, sites and applications present on this machine.

Enables Windows-based programs to create, access, and modify Manual (Trigger

Internet-based files. If this service is stopped, these functions will not Start)
be available. If this service is disabled, any services that explicitly
depend on it will fail to start.

Manages audio for Windows-based programs. If this service is Automatic (Started)

stopped, audio devices and effects will not function properly. If this
service is disabled, any services that explicitly depend on it will fail to
start.

Manages audio devices for the Windows Audio service. If this service Automatic (Started)
is stopped, audio devices and effects will not function properly. If
this service is disabled, any services that explicitly depend on it will
fail to start

The Windows biometric service gives client applications the ability to Manual
capture, compare, manipulate, and store biometric data without
gaining direct access to any biometric hardware or samples. The
service is hosted in a privileged SVCHOST process.
The WcsPlugInService service hosts third-party Windows Color Manual
System color device model and gamut map model plug-in modules.
These plug-in modules are vendor-specific extensions to the
Windows Color System baseline color device and gamut map
models. Stopping or disabling the WcsPlugInService service will
disable this extensibility feature, and the Windows Color System will
use its baseline model processing rather than the vendor’s desired
processing. This might result in inaccurate color rendering.

WCNCSVC hosts the Windows Connect Now Configuration which is Manual

Microsoft’s Implementation of Wi-Fi Protected Setup (WPS) protocol.
This is used to configure Wireless LAN settings for an Access Point
(AP) or a Wi-Fi Device. The service is started programmatically as
needed.

Makes automatic connect/disconnect decisions based on the Automatic (Trigger

network connectivity options currently available to the PC and Start, Started)
enables management of network connectivity based on Group Policy
settings.

Manual

Helps protect users from malware and other potentially unwanted Automatic (Started)
software.
Manages user-mode driver host processes. Manual (Trigger
Start)
Manual (Trigger
Start)
Allows errors to be reported when programs stop working or Manual (Trigger
responding and allows existing solutions to be delivered. Also allows Start)
logs to be generated for diagnostic and repair services. If this service
is stopped, error reporting might not work correctly and results of
diagnostic services and repairs might not be displayed.

This service manages persistent subscriptions to events from remote Manual

sources that support WS-Management protocol. This includes
Windows Vista event logs, hardware and IPMI-enabled event
sources. The service stores forwarded events in a local Event Log. If
this service is stopped or disabled event subscriptions cannot be
created and forwarded events cannot be accepted.

This service manages events and event logs. It supports logging Automatic (Started)
events, querying events, subscribing to events, archiving event logs,
and managing event metadata. It can display events in both XML and
plain text format. Stopping this service may compromise security and
reliability of the system.
Windows Firewall helps protect your computer by preventing Automatic (Started)
unauthorized users from gaining access to your computer through
the Internet or a network.

Optimizes performance of applications by caching commonly used Automatic (Started)

font data. Applications will start this service if it is not already
running. It can be disabled, though doing so will degrade application
performance.

Provides image acquisition services for scanners and cameras. Manual

Adds, modifies, and removes applications provided as a Windows Manual

Installer (*.msi) package. If this service is disabled, any services that
explicitly depend on it will fail to start.

Manual (Trigger
Start)
Provides a common interface and object model to access Automatic (Started)
management information about operating system, devices,
applications and services. If this service is stopped, most Windows-
based software will not function properly. If this service is disabled,
any services that explicitly depend on it will fail to start.

Shares Windows Media Player libraries to other networked players Manual

and media devices using Universal Plug and Play.
Enables installation, modification, and removal of Windows updates Manual
and optional components. If this service is disabled, install or
uninstall of Windows updates might fail for this computer.

Optimizes performance of Windows Presentation Foundation (WPF) Not Installed

applications by caching commonly used font data. WPF applications (Manual)
will start this service if it is not already running. It can be disabled,
though doing so will degrade the performance of WPF applications.

The Windows Process Activation Service (WAS) provides process Not Installed
activation, resource management and health management services (Manual, Started)
for message-activated applications.
Windows Remote Management (WinRM) service implements the Manual
WS-Management protocol for remote management. WS-
Management is a standard web services protocol used for remote
software and hardware management. The WinRM service listens on
the network for WS-Management requests and processes them. The
WinRM Service needs to be configured with a listener using
winrm.cmd command line tool or through Group Policy in order for it
to listen over the network. The WinRM service provides access to
WMI data and enables event collection. Event collection and
subscription to events require that the service is running. WinRM
messages use HTTP and HTTPS as transports. The WinRM service
does not depend on IIS but is preconfigured to share a port with IIS
on the same machine. The WinRM service reserves the /wsman URL
prefix. To prevent conflicts with IIS, administrators should ensure
that any websites hosted on IIS do not use the /wsman URL prefix.

Provides content indexing, property caching, and search results for Automatic (Delayed
files, e-mail, and other content. Start, Started)

Provides infrastructure support for Windows Store.This service is Manual (Trigger

started on demand and if disabled applications bought using Start)
Windows Store will not behave correctly.

Maintains date and time synchronization on all clients and servers in Manual (Trigger
the network. If this service is stopped, date and time synchronization Start)
will be unavailable. If this service is disabled, any services that
explicitly depend on it will fail to start.

Enables the detection, download, and installation of updates for Manual (Trigger
Windows and other programs. If this service is disabled, users of this Start)
computer will not be able to use Windows Update or its automatic
updating feature, and programs will not be able to use the Windows
Update Agent (WUA) API.

WinHTTP implements the client HTTP stack and provides developers Manual (Started)
with a Win32 API and COM Automation component for sending
HTTP requests and receiving responses. In addition, WinHTTP
provides support for auto-discovering a proxy configuration via its
implementation of the Web Proxy Auto-Discovery (WPAD) protocol.
The Wired AutoConfig (DOT3SVC) service is responsible for Manual
performing IEEE 802.1X authentication on Ethernet interfaces. If
your current wired network deployment enforces 802.1X
authentication, the DOT3SVC service should be configured to run for
establishing Layer 2 connectivity and/or providing access to network
resources. Wired networks that do not enforce 802.1X
authentication are unaffected by the DOT3SVC service.

The WLANSVC service provides the logic required to configure, Manual (Automatic
discover, connect to, and disconnect from a wireless local area with Wireless Card
network (WLAN) as defined by IEEE 802.11 standards. It also Installed)
contains the logic to turn your computer into a software access point
so that other devices or computers can connect to your computer
wirelessly using a WLAN adapter that can support this. Stopping or
disabling the WLANSVC service will make all WLAN adapters on your
computer inaccessible from the Windows networking UI. It is
strongly recommended that you have the WLANSVC service running
if your computer has a WLAN adapter.

Provides performance library information from Windows Manual

Management Instrumentation (WMI) providers to clients on the
network. This service only runs when Performance Data Helper is
activated.

Manual
Creates and maintains client network connections to remote servers Automatic (Started)
using the SMB protocol. If this service is stopped, these connections
will be unavailable. If this service is disabled, any services that
explicitly depend on it will fail to start.

Provides Web connectivity and administration through the Internet Not Installed
Information Services Manager (Automatic, Started)

This service manages mobile broadband (GSM & CDMA) data Manual
card/embedded module adapters and connections by auto-
configuring the networks. It is strongly recommended that this
service be kept running for best user experience of mobile
broadband devices.
 Windows 8.1 Configurations
t needed in Manual or Disabled.

DEFAULT Windows DEFAULT Windows

"Safe"
8.1 Pro 8.1 Enterprise
Manual Manual Manual

Manual Manual Manual

Manual (Trigger Manual (Trigger Manual
Start) Start)
Not Installed Not Installed Not Installed
(Automatic, Started) (Automatic, Started)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual (Trigger Start, Manual (Trigger Start, Manual

Started) Started)

Manual Manual Manual

Manual Manual Manual

Manual Manual Disabled *

Not Installed Not Installed Not Installed

(Manual) (Manual)

Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start, Started) Start, Started) Start)

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Manual (Trigger Manual (Trigger Manual
Start) Start)

Manual Manual Manual

Manual (Trigger Manual (Trigger Disabled *

Start) Start)

Manual Manual Disabled *

Manual Manual Disabled *

Not Installed Not Installed Not Installed

(Manual) (Manual)
Not Available Not Available Disabled *
Manual (Trigger Start, Manual (Trigger Start, Manual
Started) Started)

Automatic (Started) Automatic (Started) Automatic

Manual (Started) Manual (Started) Manual

Manual (Trigger Start, Manual (Trigger Start, Manual

Started) Started)

Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Automatic (Trigger Automatic (Trigger Automatic

Start, Started) Start, Started)
Manual (Trigger Manual (Trigger Manual
Start) Start)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Manual (Started) Manual (Started) Manual

Manual Manual Manual

Automatic (Started) Automatic (Started) Disabled *

Manual Manual Manual

Automatic (Trigger Automatic (Trigger Automatic

Start, Started) Start, Started)

Not Available Not Available Not installed

Manual (Trigger Manual (Trigger Manual
Start) Start)

Manual Manual Manual

Manual Manual Disabled *

Manual Manual Manual

Manual (Trigger Manual (Trigger Manual

Start) Start)
Manual (Started) Manual (Started) Manual

Manual (Started) Manual (Started) Manual

Automatic (Trigger Automatic (Trigger Automatic

Start, Started) Start, Started)

Manual Manual Manual

Manual Manual Manual

Manual (Trigger Start, Manual (Trigger Start, Manual

Started) Started)

Manual (Trigger Manual (Trigger Manual

Start) Start)
Manual (Trigger Manual (Trigger Disabled *
Start) Start)

Manual (Trigger Manual (Trigger Disabled *

Start) Start)
Manual (Trigger Manual (Trigger Disabled *
Start) Start)

Manual (Trigger Manual (Trigger Disabled *

Start) Start)

Manual (Trigger Manual (Trigger Disabled *

Start) Start)

Manual (Trigger Manual (Trigger Disabled *

Start) Start)
Manual (Trigger Manual (Trigger Disabled *
Start) Start)

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual Manual Manual

Disabled Disabled Disabled

Manual Manual Disabled *

Automatic (Started) Automatic (Started) Disabled *

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)
Not Installed Not Installed Not Installed
(Automatic, Started) (Automatic, Started)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Manual Manual Disabled *

Manual (Started at Manual (Started at Manual

boot, then stops) boot, then stops)

Automatic (Started) Automatic (Started) Automatic

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Disabled (Changed to Disabled (Changed to Uninstalled *

Manual and Started if Manual and Started if
the previous 3 the previous 3
Services are installed) Services are installed)
Manual Manual Disabled *

Manual Manual Disabled *

Manual (Trigger Start, Manual (Trigger Start, Manual

Started) Started)

Manual (Trigger Start, Manual (Trigger Start, Manual

Started) Started)
Manual Manual Manual

Manual (Trigger Manual (Trigger Manual

Start) Start)
Manual (Started) Manual (Started) Manual

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Automatic (Trigger Automatic (Trigger Disabled *
Start, Started) Start, Started)

Manual Manual Manual

Manual (Started) Manual (Started) Manual

Manual (Started) Manual (Started) Manual

Manual (Started) Manual (Started) Manual

Manual Manual Manual

Manual (Started) Manual (Started) Manual

Manual Manual Manual

Manual (Trigger Manual (Trigger Manual

Start) Start)

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Manual Manual Manual

Manual Manual Manual

Automatic Automatic Automatic

Manual Manual Manual

Manual Manual Manual

Manual Manual Manual

Manual (Maybe Manual (Maybe Manual

Started when using Started when using
Remote Desktop) Remote Desktop)

Manual (Maybe Manual (Maybe Manual

Started when using Started when using
Remote Desktop) Remote Desktop)

Manual (Maybe Manual (Maybe Manual

Started when using Started when using
Remote Desktop) Remote Desktop)

Automatic (Started) Automatic (Started) Automatic

Manual Manual Disabled *

Disabled Disabled Disabled

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Disabled Disabled Disabled

Automatic (Started) Automatic (Started) Automatic

Manual Manual Manual

Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start, Started) Start, Started) Start)
Manual (Trigger Manual (Trigger Disabled *
Start) Start)

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Disabled Disabled Disabled

Manual (Trigger Manual (Trigger Disabled *

Start) Start)
Manual Manual Disabled *

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Manual Manual Disabled *

Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start, Started) Start, Started) Start)

Manual (Trigger Manual (Trigger Manual

Start) Start)
Manual (Started) Manual (Started) Manual

Manual Manual Manual

Manual (Trigger Manual (Trigger Disabled *

Start) Start)
Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Automatic (Trigger Automatic (Trigger Automatic

Start, Started) Start, Started)

Automatic (Started) Automatic (Started) Automatic

Automatic (Trigger Automatic (Trigger Automatic

Start, Started) Start, Started)

Manual Manual Manual

Not Installed Not Installed Not Installed

(Disabled) (Disabled)

Automatic (Started) Automatic (Started) Automatic

Manual Manual Manual

Manual (Trigger Start, Manual (Trigger Start, Manual
Started) Started)

Manual (Trigger Manual (Trigger Manual

Start) Start)
Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Manual Manual Manual

Manual Manual Manual

Not Installed Not Installed Not Installed

(Manual) (Manual)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Manual Manual Disabled *

Manual Manual Manual

Manual Manual Disabled *

Automatic (Trigger Automatic (Trigger Automatic

Start, Started) Start, Started)

Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Manual (Trigger Manual (Trigger Manual

Start) Start)
Manual (Trigger Manual (Trigger Manual
Start) Start)
Manual (Trigger Manual (Trigger Manual
Start) Start)

Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Automatic (Started) Automatic (Started) Automatic

Manual Manual Manual

Manual Manual Manual

Manual (Trigger Manual (Trigger Disabled *

Start) Start)
Automatic (Started) Automatic (Started) Automatic

Manual Manual Disabled *

(Uninstalled)
Manual Manual Manual

Not Installed Not Installed Not Installed

(Manual) (Manual)

Not Installed Not Installed Not Installed

(Manual, Started) (Manual, Started)
Manual Manual Manual

Automatic (Delayed Automatic (Delayed Automatic (Delayed

Start, Started) Start, Started) Start)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual (Trigger Manual (Trigger Manual

Start) Start)

Manual (Started) Manual (Started) Manual

Manual Manual Manual

Manual (Automatic Manual (Automatic Manual

with Wireless Card with Wireless Card
Installed) Installed)

Manual Manual Manual

Manual Manual Manual

Automatic (Started) Automatic (Started) Automatic

Not Installed Not Installed Not Installed

(Automatic, Started) (Automatic, Started)

Manual Manual Manual

Default Path and Command Line Options
C:\Windows\system32\svchost.exe -k AxInstSVGroup

C:\Windows\System32\svchost.exe -k AppReadiness
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Dependecies
Remote Procedure Call: DCOM Server
Process Launcher, RPC Endpoint Mapper
AppId Driver: Flt Mgr, System Attribute
Cache; Cryptographic Services: Remote
Procedure Call: DCOM Server Process
Launcher, RPC Endpoint Mapper; Remote
Procedure Call