Here is a list of the default services
running in Windows Vista with Startup status. You can check your Vista
computer against this listing to reset the services to their proper settings.
Application Experience (svchost.exe) - Automatic
Processes application compatibility cache requests for applications when
they are launched.
Application Information (svchost.exe) - Manual
Helps interactive applications run with additional administrative
privileges. Needed by apps such as Services and RegEdit.
Application Layer Gateway Service (alg.exe) - Manual
Provides support for third-party protocol plug-ins for Internet Connection
Sharing and the Windows Firewall.
Application Management (svchost.exe) - Manual
Provides software installation services such as Assign, Publish, and Remove.
Use for group policy or IntelliMirror for corporate centralized management.
Background Intelligent Transfer Service (svchost.exe) - Manual
Uses idle network bandwidth to transfer data. Use by Windows Update or MSN
Explorer which no longer able to automatically download program or other
information when disabled. However, if youre using Windows Update, the
service will automatically and set as Automatic (Delayed Start).
Base Filtering Engine (svchost.exe) - Automatic
Manages firewall and Internet Protocol security (IPsec) policies and
implements user mode filtering. Stopping or disabling the BFE service will
reduce system security and cause unpredictable behavior in IPsec management
and firewall applications. No necessary if there is other firewall system.
Block Level Backup Engine Service (wbengine.exe) - Manual
Performs block-level backup and recovery of data.
Certificate Propagation (svchost.exe) - Manual
Propagates certificates from smart cards. Not needed if dont use smart
cards.
CNG Key Isolation (lsass.exe) - Manual
Service stores and uses long-lived private keys and associated cryptographic
operations in a secure process.
COM+ Event System (svchost.exe) - Automatic
Supports System Event Notification Service (SENS), which provides automatic
distribution of events to subscribing component object model (COM) components.
If the service is stopped, SENS will close and will not be able to provide
logon and logoff notifications.
COM+ System Application (dllhost.exe) - Manual
Manages the configuration and tracking of components based on COM+. If the
service is stopped, most components based on COM+ will not function properly.
Computer Browser (svchost.exe) - Automatic
Maintains an updated list of computers on the network and supplies this list
to computers designated as browsers. If this service is stopped, this list
will not be updated or maintained. Not needed if there is no other computer in
the network.
Cryptographic Services (svchost.exe) - Automatic
Provides four management services: Catalog Database Service, which confirms
the signatures of Windows files; Protected Root Service, which adds and
removes Trusted Root Certification Authority certificates from this computer;
Automatic Root Certificate Update Service, which retrieves root certificates
from Windows Update; and Key Service, which helps enroll this computer for
certificates. If this service is stopped, these management services will not
function properly. Windows Update will automatically set this service to
Manual even if it has been set to Disabled.
DCOM Server Process Launcher (svchost.exe) - Automatic
Provides launch functionality for distributed component object model (DCOM)
services. DCOM allows COM components to communicate over networks.
Desktop Window Manager Session Manager (dfsr.exe) - Automatic
Provides startup and maintenance services for the Desktop Window Manager,
which is the windowing system that enables Windows Aero.
DFS Replication (dfsr.exe) - Automatic
Replicates files among multiple PCs and keeps them synchronized.
DHCP Client (svchost.exe) - Automatic
Manages network configuration by registering and updating Internet Protocol
(IP) addresses and Domain Name System (DNS) names. Can be disabled if youre
static IP address.
Diagnostic Policy Service (svchost.exe) - Automatic
Enables detection of problems, troubleshooting, and problem resolution for
Windows components. If the service is stopped, diagnostics will no longer
function.
Diagnostic Service Host (svchost.exe) - Manual
Enables detection of problems, troubleshooting, and problem resolution for
Windows components. If the service is stopped, diagnostics will no longer
function.
Diagnostic System Host (svchost.exe) - Manual
Enables detection of problems, troubleshooting, and problem resolution for
Windows components. If the service is stopped, diagnostics will no longer
function.
Distributed Link Tracking Client (svchost.exe) - Automatic
Maintains links between NTFS files within a computer or across computers in
a network domain.
Distributed Transaction Coordinator (msdtc.exe) - Manual
Coordinates transactions that span multiple resource managers, such as
databases, message queues, and filesystems. If this service is stopped, these
transactions will not occur.
DNS Client (svchost.exe) - Automatic
Resolves and caches DNS names for this computer. If this service is stopped,
this computer will not be able to resolve DNS names and locate Active
Directory domain controllers.
Extensible Authentication Protocol (svchost.exe) - Manual
The Extensible Authentication Protocol (EAP) service provides network
authentication for 802.1x wired and wireless, Virtual Private Network (VPN),
and Network Access Protection (NAP). It also provides APIs used by network
access clients, including wireless and VPN clients, during the authentication
process. If you disable the service, the PC cannot access networks that
require EAP authentication.
Fax (fxssvc.exe) - Manual
Enables you to send and receive faxes, utilizing fax resources available on
this computer or on the network.
Function Discovery Provider Host (svchost.exe) - Manual
The Host process for Function Discovery providers, which allows resources to
be discovered over the network.
Function Discovery Resource Publication (svchost.exe) - Automatic
Make information available to the computer and its attached resources so
that they can be discovered over the network. If the service is stopped,
network resources will no longer be published and they will not be discovered
by other computers on the network.
Group Policy Client (svchost.exe) - Automatic
Applies settings configured by administrators for the computer and users
through Group Policy. If the service is stopped or disabled, applications and
components will not be manageable through Group Policy. Any components or
applications that depend on the Group Policy component might not work if the
service is stopped or disabled.
Health Key and Certificate Management (svchost.exe) - Manual
Provides X.509 certificate and key management services for the Network
Access Protection Agent. Enforcement technologies that use X.509 certificates
may not function properly without the service.
Human Interface Device Access (svchost.exe) - Manual
Enables generic input access to Human Interface Devices (HIDs), which
activates and maintains the use of predefined hot buttons on keyboards, remote
controls, and other multimedia devices. If this service is stopped, hot
buttons controlled by this service will no longer function. Avoid disabling
this service if youre using high-tech mouse or keyboard.
Idwlog Service - Automatic
Use in internet Windows build.
IKE and AuthIP IPsec Keying Module (svchost.exe) - Automatic
Modules used for authentication and key exchange in Internet Protocol
security (IPsec). Stopping or disabling the service will disable IKE and
AuthIP key exchange with peer computers. Disable this will decrease RAM
utilization and improve network performance, but reduce network security.
Interactive Services Detection (UI0Detect.exe) - Manual
Enables notification of user input for interactive services. This enables
access to dialogs created by interactive services when they appear. If the
service is stopped, notifications of new interactive service dialogs will no
longer function. If the service is disabled, both notifications of and access
to new interactive service dialogs will no longer function.
Internet Connection Sharing (ICS) (svchost.exe) - Disabled
Provides Network Address Translation (NAT), addressing, name resolution,
and/or intrusion prevention services for a home or small-office network. In
other words, allow multiple PCs to access Internet by attaching to one
computer with ICS enabled.
IP Helper (svchost.exe) - Automatic
Provides automatic IPv6 connectivity over an IPv4 network. If the service is
stopped, the PC will only have IPv6 connectivity if it is connected to a
native IPv6 network. Less common currently as low popularity of IPv6. Disable
will improve network performance and decrease RAM usage.
IPsec Policy Agent (svchost.exe) - Automatic
Enforces IPsec policies created through the IP Security Policies Snap-in or
the command-line tool netsh ipsec. If you stop the service, you may experience
network connectivity issues if your policy requires that connections use IPsec.
Remote management of the Windows Firewall will not be available if the service
is stopped. Disable will improve network performance and decrease RAM usage,
but affect negatively network performance.
KtmRm for Distributed Transaction Coordinator (svchost.exe) - Automatic
Coordinates transactions between MSDTC and the Kernel Transaction Manager (KTM).
Disable if both MSDTC and KTM is not used.
Link-Layer Topology Discovery (Mapper svchost.exe) - Manual
Creates the Network Map in the Network and Sharing Center. If this service
is disabled, the Network Map will not function properly.
Messenger Sharing Folders USN Journal Reader
Installed if Windows Live Messenger is installed. Disable if dont use
Messenger Lives sharing folders.
Microsoft .NET Framework NGEN (mscorsvw.exe) - Manual
Microsoft .NET Framework native image generator (NGEN).
Microsoft iSCSI Initiator Service (svchost.exe) - Manual
Manages Internet SCSI (iSCSI) sessions from the computer to remote iSCSI
target devices. If the service is stopped, this computer will not be able to
log in or access iSCSI targets.
Microsoft Software Shadow Copy Provider (dllhost.exe) - Manual
Manages software-based volume shadow copies taken by the Volume Shadow Copy
service. If this service is stopped, software-based volume shadow copies
cannot be managed, and will have a negative impact on system redundancy.
Multimedia Class Scheduler (svchost.exe) - Automatic
Used mainly by multimedia applications, this service enables relative
prioritization of work based on system-wide task priorities. If the service is
stopped, individual tasks resort to their default priority. Requires by
Windows audio to give higher priority to multimedia applications.
Net.Tcp Port Sharing Service (SMSvcHost.exe) - Disabled
Provides ability to share TCP ports over the net.tcp protocol. .NET
applications that use this service will be affected if disabled.
Netlogon (lsass.exe) - Manual
Maintains a secure channel between the PC and the domain controller for
authenticating users and services. If the service is stopped, the computer may
not authenticate users and services and the domain controller cannot register
DNS records.
Network Access Protection Agent (svchost.exe) - Manual
Enables NAP functionality, which allows network administrators to set
security requirements for computers that want to connect to a network.
Network Connections (svchost.exe) - Manual
Manages objects in the Network and Dial-Up Connections folder.
Network List Service (svchost.exe) - Manual
Identifies the networks to which the computer has connected, collects and
stores properties for these networks, and notifies applications when these
properties change. If disabled, the network icon in system tray (notification
area) wont be able to tell if network is connected, although the network
connection wont be affected. Disable if not connected to a LAN with multiple
computers or if dont share files or printers through LAN.
Network Location Awareness (svchost.exe) - Automatic
Collects and stores configuration information for the network and notifies
programs when the information is modified. If the service is stopped,
configuration information might be unavailable. Disable if not connected to a
LAN with multiple computers or if dont share files or printers through LAN.
Network Store Interface Service (svchost.exe) - Automatic
Delivers network notifications to clients. Stopping the service will cause
loss of network connectivity.
Offline Files (svchost.exe) - Automatic
Performs maintenance activities on the Offline Files cache, responds to user
logon and logoff events, implements the internals of the public API, and
dispatches interesting events to those interested in Offline Files activities
and changes in cache state. Disable if not connecting to domain or use only
local profiles.
Parental Controls (svchost.exe) - Manual
Enables Parental Controls.
Peer Name Resolution Protocol (svchost.exe) - Manual
Enables Serverless Peer Name Resolution over the Internet. If disabled, some
Peer-to-Peer and Collaborative applications, such as Windows Meetings, may not
function.
Peer Networking Grouping (svchost.exe) - Manual
Provides Peer Networking Grouping services.
Peer Networking Identity Manager (svchost.exe) - Manual
Provides Identity service for Peer Networking.
Performance Logs & Alerts (svchost.exe) - Manual
Collects performance data from local or remote computers based on
preconfigured schedule parameters, then writes the data to a log or triggers
an alert. If this service is stopped, performance information will not be
collected.
Plug and Play (svchost.exe) - Automatic
Enables a computer to recognize and adapt to hardware changes with little or
no user input. Stopping or disabling this service will result in system
instability.
PnP-X IP Bus Enumerator (svchost.exe) - Manual
Manages the virtual network bus. It discovers network-connected devices
using the SSDP/WS discovery protocols and gives them presence in PnP. If this
service is stopped or disabled, presence of NCD devices will not be maintained
in PnP.
PNRP Machine Name Publication Service (svchost.exe) - Manual
Publishes a machine name using the Peer Name Resolution Protocol.
Portable Device Enumerator Service (svchost.exe) - Automatic
Enforces group policy for removable mass-storage devices. Enables
applications such as Windows Media Player and the Image Import Wizard to
transfer and synchronize content using removable mass-storage devices.
Print Spooler (spoolsv.exe) - Automatic
Loads files to memory for later printing.
Problem Reports and Solutions Control Panel Support (svchost.exe) - Manual
Provides support for viewing, sending, and deleting system-level problem
reports for the Problem Reports and Solutions control panel.
Program Compatibility Assistant Service (svchost.exe) - Automatic
Provides support for the Program Compatibility Assistant. If this service is
stopped, the Program Compatibility Assistant will not function properly. If
this service is disabled, any services that depend on it will fail to start.
Protected Storage (lsass.exe) - Manual
Provides protected storage for sensitive data, such as private keys, to
prevent access by unauthorized services, processes, or users.
Quality Windows Audio Video Experience (qWave) (svchost.exe) - Manual
A networking platform for Audio Video (AV) streaming applications on IP home
networks. qWave enhances AV streaming performance and reliability by ensuring
network quality of service (QoS) for AV applications. The technology is not
wide-spread yet, and can be disabled.
ReadyBoost (svchost.exe) - Automatic
Provides support for improving system performance using ReadyBoost. Disable
if dont have USB flash drive or dont use this feature.
Remote Access Auto Connection Manager (svchost.exe) - Manual
Creates a connection to a remote network whenever a program references a
remote DNS or NetBIOS name or address.
Remote Access Connection Manager (svchost.exe) - Manual
Creates a network connection. Disable if dont use dial-up connections and
VPN-networks.
Remote Procedure Call (RPC) (svchost.exe) - Automatic
Provides the endpoint mapper and other miscellaneous RPC services.
Remote Procedure Call (RPC) Locator (locator.exe) - Manual
Manages the RPC name service database.
Remote Registry (svchost.exe) - Manual
Enables remote users to modify Registry settings on this computer. If this
service is stopped, only users on this computer can modify the Registry. Use
mostly in corporate network.
Routing and Remote Access (svchost.exe) - Disabled
Offers routing services to businesses in local- and wide-area network
environments. Disable if dont need to route network data within a LAN or WAN.
Secondary Logon (svchost.exe) - Automatic
Enables starting processes under alternate credentials. If this service is
stopped, this type of logon access will be unavailable. Some application may
need this service, such as Postgres. Disable if simultaneous logon to 2 users
is needed.
Security Accounts Manager (lsass.exe) - Automatic
Stores security information for local user accounts.
Security Center (svchost.exe) - Automatic (Delayed Start)
Monitors system security settings and configurations. Disable will stop all
security warnings.
Server (svchost.exe) - Automatic
Supports file, print, and named-pipe sharing over the network for this
computer. If this service is stopped, these functions will be unavailable,
affecting file and printer sharing through LAN.
Shell Hardware Detection (svchost.exe) - Automatic
Provides notifications for AutoPlay hardware events. Disable to remove auto
play functionality on removable media.
SL UI Notification Service (svchost.exe) - Manual
Provides Software Licensing activation and notification. Manually run the
service when needed for activation or other software licensing issues.
Smart Card (svchost.exe) - Manual
Manages access to smart cards read by this computer. If this service is
stopped, this computer will be unable to read smart cards.
Smart Card Removal Policy (svchost.exe) - Manual
Allows the system to be configured to lock the user desktop upon smart card
removal.
SNMP Trap (Snmptrap.exe) - Manual
Receives trap messages generated by local or remote Simple Network
Management Protocol (SNMP) agents and forwards the messages to SNMP management
programs running on this computer. If this service is stopped, SNMP-based
programs on this computer will not receive SNMP trap messages.
Software Licensing (slsvc.exe) - Automatic
Enables the download, installation, and enforcement of digital licenses for
Windows and Windows applications. If the service is disabled, the operating
system and licensed applications may run in a reduced function mode.
SSDP Discovery Service (svchost.exe) - Manual
Enables discovery of UPnP devices on your home network.
Superfetch (svchost.exe) - Automatic
Maintains and improves system performance over time.
System Event Notification (svchost.exe) - Automatic
Tracks system events such as Windows logon, network, and power events.
Notifies COM+ Event System subscribers of these events.
Tablet PC Input Service (svchost.exe) - Automatic
Enables Tablet PC pen and ink functionality. Mostly for Tablet PC use.
Task Scheduler (svchost.exe) - Automatic
Enables a user to configure and schedule automated tasks on this computer.
If this service is stopped, these tasks will not be run at their scheduled
times.
TCP/IP NetBIOS Helper (svchost.exe) - Automatic
Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name
resolution. Modern network rarely need this service.
Telephony (svchost.exe) - Manual
Provides Telephony API (TAPI) support for programs that control telephony
devices and IP-based voice connections on the local computer and, through the
LAN, on servers that are also running the service. Disable if dont use
dial-up connections.
Terminal Services (svchost.exe) - Automatic
Allows multiple users to be connected interactively to a machine as well as
the display of Desktops and applications to remote computers. The underpinning
of Remote Desktop (including RD for Administrators), Fast User Switching,
Remote Assistance, and Terminal Server. Disable if not using Remote Desktop,
and its not needed to remotely connect to another computer. Disable this
service will improve system security.
Terminal Services Configuration (svchost.exe) - Manual
Responsible for all Terminal Services and Remote Desktop-related
configuration and session maintenance activities that require SYSTEM context.
Terminal Services UserMode Port Redirector (svchost.exe) - Manual
Allows the redirection of printers/drives/ports for RDP connections.
Themes (svchost.exe) - Automatic
Provides user experience theme management.
Thread Ordering Server (svchost.exe) - Manual
Provides ordered execution for a group of threads within a specific period
of time.
TPM Base Services (svchost.exe) - Manual
Enables access to the Trusted Platform Module (TPM), which provides
hardware-based cryptographic services to system components and applications.
If this service is stopped or disabled, applications will be unable to use
keys protected by the TPM.
Universal Plug and Play Device Host (svchost.exe) - Automatic
Provides support to host Universal Plug and Play devices.
User Profile Service (svchost.exe) - Automatic
Responsible for loading and unloading user profiles. If this service is
stopped or disabled, users will no longer be able to successfully log on or
log off, applications may have problems getting to users data, and components
registered to receive profile event notifications will not receive them.
Virtual Disk (vds.exe) - Manual
Provides management services for disks, volumes, filesystems, and hardware
array objects such as subsystems, controllers, and so on. Set as manual if
dont use Disk Management in the Computer Management console. It can be
started manually at any time when need to use Disk Management.
Volume Shadow Copy (vssvc.exe) - Manual
Manages and implements Volume Shadow Copies used for backup and other
purposes. If this service is stopped, shadow copies will be unavailable for
backup and the backup may fail. Disable this service will have a negative
impact on system redundancy.
WebClient (svchost.exe) - Automatic
Enables Windows-based programs to create, access, and modify Internet-based
files. If this service is stopped, these functions will not be available.
Windows Audio (svchost.exe) - Automatic
Manages audio devices for Windows-based programs. If this service is
stopped, audio devices and effects will not function properly.
Windows Audio Endpoint Builder (svchost.exe) - Automatic
Manages audio devices for the Windows Audio service. If this service is
stopped, audio devices and effects will not function properly.
Windows Backup (svchost.exe) - Manual
Provides Windows Backup and Restore capabilities.
Windows CardSpace (infocard.exe) - Manual
Securely enables the creation, management, and disclosure of digital
identities.
Windows Color System (svchost.exe) - Manual
Hosts third-party Windows Color System color device model and gamut map
model plug-in modules.
Windows Connect Now - Config Registrar (svchost.exe) - Manual
Acts as a registrar; issues network credential to enrollee.
Windows Defender (svchost.exe) - Automatic
Scans your computer for unwanted software, schedules scans, and gets the
latest unwanted software definitions. Can be stopped if user has another anti-spyware
application. Entry in registry needs to be removed too to avoid Unable to
Start error message. Run msconfig, click on Startup tab and uncheck Windows
Defender.
Windows Driver FoundationUser-mode Driver Framework (svchost.exe) - Manual
Manages user-mode driver host processes.
Windows Error Reporting Service (svchost.exe) - Automatic
Allows errors to be reported when programs stop working or responding and
allows existing solutions to be delivered. Also allows logs to be generated
for diagnostic and repair services. If this service is stopped, error
reporting might not work correctly and results of diagnostic services and
repairs might not be displayed.
Windows Event Collector (svchost.exe) - Manual
Manages persistent subscriptions to events from remote sources that support
the WS-Management protocol. This includes Windows Vista event logs, hardware,
and IPMI-enabled event sources. If this service is stopped or disabled, event
subscriptions cannot be created and forwarded events cannot be accepted.
Windows Event Log (svchost.exe) - Automatic
Manages events and event logs. It supports logging events, querying events,
subscribing to events, archiving event logs, and managing event metadata. It
can display events in both XML and plain-text formats. Stopping this service
may compromise security and reliability of the system.
Windows Firewall (svchost.exe) - Automatic
Helps protect your computer by preventing unauthorized users from gaining
access to your computer through the Internet or a network. Not needed if
another firewall exists.
Windows Image Acquisition (WIA) (svchost.exe) - Manual
Provides image acquisition services for scanners and cameras. Can be
disabled if dont have both gadgets.
Windows Installer (msiexec.exe) - Manual
Installs, repairs, and removes software according to instructions contained
in .msi files.
Windows Management Instrumentation (svchost.exe) - Automatic
Provides a common interface and object model to access management
information about operating systems, devices, applications, and services. If
this service is stopped, most Windows-based software will not function
properly.
Windows Media Center Extender Service (mcx2svc) - Disabled
Windows Media Center Service to allow connection for Media Center devices
such as XBox 360.
Windows Media Center Receiver Service (ehrecvr.exe) - Manual
Windows Media Center Service for TV and FM broadcast reception.
Windows Media Center Scheduler Service (ehsched.exe) - Manual
Starts and stops recording of TV programs within Windows Media Center.
Windows Media Center Service Launcher (svchost.exe) - Automatic (Delayed
Start)
Starts Windows Media Center Scheduler and Windows Media Center Receiver
services at startup if TV is enabled within Windows Media Center.
Windows Media Player Network Sharing Service (wmpnetwk.exe) - Manual
Shares Windows Media Player libraries with other networked players and media
devices using Universal Plug and Play.
Windows Modules Installer (trustedinstaller.exe) - Manual
Enables installation, modification, and removal of Windows updates and
optional components. If this service is disabled, you may not be able to
install or uninstall Windows updates.
Windows Presentation Foundation Font Cache (presentationfontcache.exe) -
Manual
Optimizes performance of Windows Presentation Foundation (WPF) applications
by caching commonly used font data. WPF applications will start this service
if it is not already running. It can be disabled, though doing so will degrade
the performance of WPF applications.
Windows Process Activation Service (svchost.exe)
Provides process activation, resource management, and health management
services for message-activated applications.
Windows Remote Management (WS-Management) (svchost.exe) - Manual
Implements the WS-Management protocol for remote management, a standard web
services protocol used for remote software and hardware management.
Windows Search (searchindexer.exe) - Automatic
Provides content indexing and property caching for file, email, and other
content (via extensibility APIs). If the service is stopped or disabled, the
Explorer will not be able to display virtual folder views of items, and search
in the Explorer will fall back to item-by-item slow search. Used to call
Indexing Service. Disable will not affect search function, but search will be
perform slower.
Windows Time (svchost.exe) - Automatic
Maintains date and time synchronization on all clients and servers in the
network. If this service is stopped, date and time synchronization will be
unavailable.
Windows Update (svchost.exe) - Automatic (Delayed Start)
Enables the detection, download, and installation of updates for Windows and
other programs. If this service is disabled, users of this computer will not
be able to use Windows Update or its automatic updating feature, and programs
will not be able to use the Windows Update Agent (WUA) API.
WinHTTP Web Proxy Auto-Discovery Service (svchost.exe) - Manual
Implements the client HTTP stack and provides developers with a Win32 API
and COM Automation component for sending HTTP requests and receiving
responses. In addition, WinHTTP provides support for auto-discovering a proxy
configuration via its implementation of the Web Proxy Auto-Discovery (WPAD)
protocol. Most applications dont use this service.
Wired AutoConfig (svchost.exe) - Manual
Performs IEEE 802.1X authentication on Ethernet interfaces.
WLAN AutoConfig (svchost.exe) - Manual
Enumerates WLAN adapters, and manages WLAN connections and profiles.
WMI Performance Adapter (wmiapsrv.exe) - Manual
Provides performance library information from WMI HiPerf providers.
Workstation (svchost.exe) - Automatic
Creates and maintains client network connections to remote servers. If this
service is stopped, these connections will be unavailable.
World Wide Web Publishing Service (svchost.exe)
Provides web connectivity and administration through the Internet
Information Services Manager.
