Windows XP system service details

1. What is system service?
In Windows 2000/XP/2003, a service is a program, routine, or process that executes a specific system function to support other programs, especially low-layer (close to hardware) programs. When services are provided through the network, services can be published in Active Directory, which facilitates service-centric management and use.
A service is an application type that runs in the background. Service applications can provide users with functions locally and over the network, such as client/server applications, Web servers, database servers, and other server-based applications.

Ii. configure and manage system services
In fact, similar to the system registry, we can perform operations on system services through the "Service Management Console.
Log on as an administrator or a member of the Administrators group, click the Start> RUN menu item, type "services. msc" in the displayed dialog box, and press enter to open the "Service Management Console ". You can also click "Start> Control Panel> Management Tools> service" to start the console.
On the service console, double-click any service to open the Service Properties dialog box. Here, we can configure and manage the service. By changing the Service Startup type, we can set the service to start, close, or disable as needed.
On the "General" tab, "service name" refers to the "abbreviation" of the service and is also the name displayed in the registry; "display name" refers to the name displayed for each service in the service configuration interface; "Description" refers to a simple explanation for this service; the "executable file path" is the specific location of the executable file corresponding to the service. The "Startup Type" is the core of the entire service configuration. For any service, there are usually three types of startup, namely automatic, manual, and disabled. You can change the Service Startup Type by selecting from the drop-down menu. "Service Status" indicates whether the service is started or stopped. Generally, we can use the following "start", "stop", "pause", and "Recover" buttons to change the service status.
Let's take a look at three different types of startup statuses:
Automatic: this service will extend the time required for starting as the system starts. Some services must be set to automatic, such as Remote Procedure Call (RPC ). Due to dependency or other influences, some other services must also be set to automatic. It is recommended that you do not change such services; otherwise, the system cannot run normally.
Manual: If a service is set to manual, you can run it as needed. This can save a lot of system resources and speed up system startup.
Disabled: the service cannot run any more. This setting is generally used to improve system security. If you suspect that a strange Service brings security risks to your system, you can stop it first to see if the system is running normally, you can disable it directly. If you need this service later, you must set the start type to automatic or manual before starting it.
Click the "dependency" tab. Here, we can see that other services are required to run the selected service in the top list, and that the selected service needs to run correctly in the bottom list. It indicates that some services cannot run independently and must rely on other services. Before stopping or disabling a service, you must check its Dependencies. If other services that need to be started depend on this service, they cannot be stopped. Before you stop or disable a service, it is essential to understand the dependencies of the service.

Iii. WINXP System Service Details
1. Alerter (false alarm)
Note: management-related events on the system are sent to a specified computer or user on the network as warning information. For example, when a printing error occurs or the hard disk is about to be filled up, this service collects and sends data. The service is named services.exe.
Reference: Generally, home computers do not need to send or receive administrative alerts from computer systems unless your computer is on a LAN. You can disable this service.
Dependency: Workstation
Suggestion: Manual

2. (XP) Application Layer Gateway Service (Application Layer Gateway Service)
Note: supports third-party communication protocol plug-ins for internet online sharing and internet online firewall.
Reference: if you do not use internet Internet sharing (ICS) to provide Internet access and internet online firewall (ICF) software for multiple computers, you can disable this service.
Dependency: internt Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Suggestion: manual/disabled

3. Application Management (Application Management)
Note: appmgmt (Application Management Service ). Provides software installation services, such as distribution, release, and deletion. The service is named svchost.exe. Windows2000 introduces a software management solution based on the MSI (application installation information package file) file format-application management component service, which not only manages the installation and deletion of software, you can also use this service to modify and repair existing applications, monitor file recovery, and troubleshoot basic faults through restoration.
Reference: when it is set to "disabled", the installation and uninstallation of software on a single machine are not affected, and the installation, repair, and deletion of software in MSI format are also normal.
Suggestion: Manual

4. Automatic update)
Note: wuauserv (automatic update service ). Enable the download and installation of Windows updates from Windows Update. The service is named svchost.exe.
Reference: If a Broadband User needs windows automatic update, the user can enable the Service randomly (automatically) and stay in the background.
Suggestion: Manual

5. Background Intelligent Transfer Service (Background Intelligent Transmission Service)
Note: It is used to transmit information between servers in http1.1. Microsoft claims that it supports resumable data transfer during windows updates. Windows Update is one of the tasks.
Dependency: Remote Procedure Call (RPC) and workstation
Suggestion: Manual

6. Clipbook)
Note: You can use the Network Dynamic Data Exchange Service provided by Network DDE and Network dde dsdm to view the clipboard in a remote machine for sharing and pasting content on computers in the LAN.
Reference: share the information in the clipboard with other computers. Generally, the home computer cannot be used at all. You can set it to disabled.
Dependency: Network DDE
Process: clipsrv.exe
Suggestion: this service is not involved in general home computers. You can stop it according to the actual situation.

7. COM + Event System (COM + component system)
Note: COM + advocates a new concept, which promotes COM component software to the application layer (User usage layer) instead of the underlying software structure. Through various support of the operating system, the component object model is built on the application layer, leaving the underlying details of all components to the operating system. Some COM + software requires the support of this service. The service is named svchost.exe.
Reference: Some programs may use COM + components, such as the optimize system application of bootvis. Check the program filescomplus applications directory. If this directory is empty, you can disable this service.
Dependency: Remote Procedure Call (RPC) and System Event Notification
Suggestion: Manual

8. (XP) COM + System Application (COM + System Application Layer)
Note: comsysapp (COM + System Application Service ). Manage configuration and Tracking Based on COM + components. The service is named dllhost.exe.
Dependency: Remote Procedure Call (RPC)
Suggestion: If the COM + Event System is a vehicle, the COM + system application is the driver.

9. Computer Browser)
Note: Maintain the latest list of computers in the network neighbors and notify the Requesting program of this list to view the services of LAN computers.
Reference: set normal users to disabled, and LAN users to manual.
Dependency: Server and workstation
Suggestion: Manual

10. Cryptographic Services (Certification Service)
Note: three management services are provided: confirm the "category directory database service" in the Windows digital signature chapter "; add and remove the "protected root directory service" for the Trusted Root Certificate authorization credential from this computer, and the "key service" that assists in registering this computer to obtain the credential ". If this service is stopped, these management services will not work properly. The service is named svchost.exe.
For more information, see Windows Hardware Quality Lab (WHQL) certification. If you use automatic updates, You may need this.
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

11. DHCP Client (Dynamic Host Configuration Protocol client)
Description: DHCP is a TCP/IP service protocol that provides dynamic IP Address allocation and management. It is part of the Network startup process. The DHCP Client System can request and lease IP addresses from the DHCP server.
Reference: If you connect to the Internet through dialing, you need to maintain the Automatic startup status of the service, because the IP addresses on the Internet are dynamically allocated by the ISP. Unless the system should not be used on any network, you can set it to disabled.
Dependency: AFD network supports environment, netbt, symtdi, TCP/IP protocol driver, and NetBIOS over TCP/IP
Suggestion: automatic

12. Distributed Link Tracking Client (Distributed Link tracing client)
Note: The Distributed Link Tracking Client can track the movement of files in the NTFS Volume of the network domain and send a notification to update the file link information in the LAN. The background usually occupies 4 MB of memory.
For details, see "disabled" for common users and "Manual" for LAN users (the hard disk format is NTFS.
Dependency: Remote Procedure Call (RPC)
Suggestion: manual/disabled

13. Distributed Transaction Coordinator (Distributed Collaborative processor)
Note: The resource manager for protecting other transactions distributed in more than two databases, message queues, and file systems coordinates transactions across multiple resource administrators, such as databases, information queues, and file systems. If the service is stopped, these transactions will not occur. The service is named msdtc.exe.
Reference: common users are useless unless Message Queuing is enabled.
Dependency: Remote Procedure Call (RPC) and security accounts manager
Suggestion: Manual

14. DNS Client (Domain Name System Client)
Note: Resolve a domain name to an IP address. If you stop this service, the computer will not be able to resolve the DNS name and find the location of the Active Directory domain control site.
Reference: the service should be automatically started unless it is not connected to any network. In addition, IPSec is required.
Dependency: TCP/IP protocol driver
Process: dns.exe
Suggestion: automatic

15. (XP) Error Reporting Service (Error Reporting Service)
Note: error reports for services and applications executed in non-standard environments are allowed. The service is named svchost.exe.
Dependency: Remote Procedure Call (RPC)
Suggestion: this service is Microsoft's application error report. It is stopped based on security considerations.

16. Event Log (Event Log)
Note: records error messages sent by programs and systems, including information helpful for problem diagnosis. After the service is disabled, several network-related services cannot be started, and dial-up Internet access cannot be implemented. The service is named services.exe.
Reference: if an internet or LAN connection exists, we recommend that you enable the service automatically. This service cannot be stopped.
Dependency: Windows Management Instrumentation
Suggestion: automatic

17. (XP) Fast User Switching Compatibility (quick User Switching)
Description: provides application management in a multi-user environment. The service is named svchost.exe.
Refer to the switch User Function on the logout screen.
Dependency: Terminal Services
Suggestion: based on security considerations, if you do not use a multi-user environment, stop.

18. Fax Service (Fax Service)
Note: The fax function supported in Windows 95 is supported in windows and better integrated with the system.
Reference: if you do not use a fax machine, you can set it to disabled.
Process: faxsvc.exe

19. FTP Publishing Service (FTP Publishing Service)
Note: The management unit of Internet Information Service (IIS) provides FTP connection and management.
Process: inetinfo.exe
Suggestion: automatic/manual

20. (XP) Help and Support (Help and Support Center)
Note: The instruction and support center can be executed on this computer. If this service is stopped, you will not be able to use the instructions and support center. The service is named svchost.exe.
Dependency: Remote Procedure Call (RPC)
Suggestion: You can stop it according to the actual situation.

21. (XP) Human Interface Device Access (user-friendly interface access)
Note: enable universal input access to the human interface device (HID). The HID device starts and maintains the use of the shortcut defined on the keyboard, remote control, and other multimedia devices. If the service is stopped, the shortcut of the service control will no longer work. The service is named svchost.exe.
Dependency: Remote Procedure Call (RPC)
Suggestion: manual or disabled

22. IIS Admin Service (IIS Management Service)
Description: Web and FTP services can be managed through the management units of Internet Information Service (IIS.
Suggestion: automatic/manual

23. (XP) imapi CD-Burning COM Service (imapi disc burning Service)
Note: Use Image Mastering Applications Programming Interface (imapi) to manage the disc burning.
Reference: WINXP integrated CD-R and CD-RW drive on the drag and drop burning function, but unfortunately not comparable to the burning software, close this service can also accelerate the startup speed of Nero, Hoho ~~.
Suggestion: manual or disabled

24. Indexing Service (Index Service)
Note: The Indexing Service can index the content and attributes of documents on a local hard drive or shared network drive, and quickly locate the required documents through the Windows2000 unique document filter, the search capability of Windows2000 is greatly enhanced. However, index search consumes a lot of system resources.
Microsoft recommends that you disable this service for systems with only 64 MB of memory and more than 100,000 documents to be indexed. But in fact, in 64 MB memory systems, even if the number of documents is far smaller than 100,000, the consumption of system resources is also amazing, and the situation does not significantly improve on the MB system, therefore, we strongly recommend that you disable it. Process: cisvc.exe
Dependency: Remote Procedure Call (RPC)
Suggestion: Disabled

25. Internet Connection Firewall (Internet Connection Firewall)/Internet Connection Sharing (Internet Connection Sharing)
Note: This service provides Internet shared connections for LAN computers and provides shortcuts for multiple networked computers to share a dial-up network to access the Internet. In the past, proxy software such as Sygate and Wingate was used to implement this function in Windows9x. Now this function has been directly supported by Windows2000. The service is named svchost.exe.
Reference: if you do not use Internet Connection Sharing or the Internet Connection Firewall contained in WINXP, set it to disabled.
Dependency: Application Layer Gateway Service, Network Connections, Network Location Awareness (NLA), Remote Access Connection Manager
Suggestion: ICF automatic, ICS Manual

26. IPSec Policy Agent (IP Security policy proxy)
Note: This service allows IP Security Policies to encrypt data packets transmitted between two computers, so as to prevent people who see it online from modifying and deciphering it. IPSec is an important defense method used to protect intranets, Private Networks (the Internet), and external networks (exists) from attacks. Before using IPSec, you must first define mutual trust and communication security between two computers.
Note: In Windows, the "IP Security policy proxy" is automatically started by default, the "IP Security Policy" is not enabled (network and dial-up connection → dial-up connection properties → network → Internet Protocol (TCP/IP) properties → advanced → the "IP Security Mechanism" attribute in the option can be seen ).
Reference: Generally, you can disable this proxy service.
Dependency: IPsec Driver, Remote Procedure Call (RPC), TCP/IP protocol driver
Process: lsass.exe
Suggestion: Manual

27. Logical Disk Manager (Logical Disk Management)
Description: disk management service.
Reference: dynamically manage disks, such as displaying available disk space, and using the features of the Microsoft Management Console (MMC) console. When necessary, this service will notify the user, so you can usually disable this service.
Dependency: Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager Administrative Service
Suggestion: Manual

28. Logical Disk Manager Administrative Service (Logical Disk Management Service)
Note: To set the hard disk and disk area, the service only executes the setting program and then stops.
Reference: used only when you use the features of the Microsoft Management Console (MMC) console.
Dependency: Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager
Process: dmadmin.exe
Suggestion: Manual

29. Messenger)
Note: this service is not an MSN Messenger Service. It sends and receives messages sent by the system administrator or Alerter Service. The Alerter service depends on this service.
Reference: allows mutual message transmission between networks, such as the net send function. If Alerter is disabled, you can set it to manual or disabled.
Dependency: NetBIOS interface, Plug and Play, Remote Procedure Call (RPC), and workstation
Suggestion: manual/disabled

30. (XP) MS Software Shadow Copy Provider (Microsoft shadow replication service)
Description: manages the shadow replication service in the disk area for software-based shadow replication. If you stop this service, you cannot manage shadow replication in the software-based Disk Area.
Reference charge: this service is required when the MS Backup program is used.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disabled

31. Net Logon)
Description: this service is used to verify the logon information options and control the logon domain name on the LAN.
Reference: You can set it to disabled or manual.
Suggestion: manual/disabled

32. NetMeeting Remote Desktop Sharing (NetMeeting Remote Desktop Sharing)
Note: This service allows users with permissions to remotely access Windows desktops through netmeeting.
Reference: users can share control of computers with other users on the network. The functions provided by this service are not very useful to general users and may cause security problems. You can set them to disabled.
Process: mnmsrvc.exe
Suggestion: manual/disabled

33. network connections (network connection)
Manage all objects in the "Network and dial-up connections" folder.
Reference: if any network connection (including dial-up connections) exists, the service is automatically/manually maintained. If this service is disabled, the "Network and dial-up connections" folder will be empty. You cannot create a new connection or dial-up Internet access.
Dependency: Remote Procedure Call (RPC), Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Suggestion: Manual

34. Network DDE (dynamic network data exchange)

35. Network DDE DSDM
Note: These two services are used with ClipBook. Network Dynamic Data Exchange is a service that provides network transmission and security for DDE dialogs. Dynamic Data Exchange (DDE) is a form of process communication. It allows two or more programs of DDE to exchange information and commands.
Reference: You can set it to disabled.
Dependency: Network dde dsdm, Clipbook
Suggestion: manual/disabled

36. (XP) Network Location Awareness (NLA)
Note: collect and store network settings and location information, and notify the application when this information is changed.
Reference: you can disable this service if you do not use ICF or IC.
Dependency: AFD network supports environment, TCP/IP procotol driver, Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Suggestion: Disabled

37. nt lm Security Support Provider (nt lm Security Support Provider)
Note: this service is used by the telnet service and provides a security mechanism for Remote Procedure Call (RPC) programs that use transmission protocols instead of named pipelines.
Reference: if you do not use Message Queuing or telnet server, you can disable it. Determine the Startup Type as needed.
Suggestion: manual/disabled

38. Performance Logs and alerts (Performance Logs and alarms)
Note: records the running status of the computer and regularly writes logs or issues warnings. However, the recorded content may be too professional and hard to understand.
Process: smlogsvc.exe
Suggestion: manual/disabled

39. Plug and Play (plug-and-play)
Note: plug-and-play is a set of specifications developed by Intel. It provides computers with the ability to automatically detect and configure devices and install drivers. When a device is changed, the current device status of the program that uses the device is automatically notified.
Reference: Keeping the service status automatically started is conducive to device management and maintenance.
Dependency: Logical Disk Manager, Logical Disk Manager Administrative Service, messenger, smart card, telephony, Windows Audio
Suggestion: automatic

40. (XP) Portable Media Serial Number (Portable Media Serial number)
Re: retrieves the serial number of any portable music player connected to your computer
Reference: it is useless to obtain any music playing sequence number through the online computer.
Suggestion: Disabled

41. Print Spooler (print background processing)
Note: The function of this service is to save and manage documents printed with multiple requests in a unified manner. After the printer resources are idle, the data is sent to the printer for processing.
Reference: If no printing device exists, set it to disabled. Otherwise, set it to automatic.
Dependency: Remote Procedure Call (RPC)
Process: spoolsv.exe
NOTE: If Fax service is enabled, the Service should remain automatic because the fax service depends on Print Spooler.

42. Protected Storage (protective storage)
Note: provides services for storing the local password and the online service password, including the automatic completion function during table filling to prevent unauthorized services, processes, or unauthorized access by users.
Refer to: services for storing passwords on computers, such as outlook, Dialup programs, other applications, and master-slave architecture.
Dependency: Remote Procedure Call (RPC)
Suggestion: automatic

43. QoS RSVP (QoS license control)
Note: The network signal and local communication control installation function is provided for quality service (QoS)-dependent programs and control programs.
Reference: a service used to retain 20% bandwidth. If the network card does not support 802.1p or there is no ACs server on the computer's network, you can disable this service.
Dependency: AFD network supports environment, TCP/IP procotol driver, Remote Procedure Call (RPC)
Process: rsvp.exe
Suggestion: manual or disabled

44. Remote Access Auto Connection Manager (remote access to the Automatic Connection Manager)
Note: The system automatically connects to the network when a program attempts to read network information.
Reference: some DSL/cable providers may need to use this to process the login program.
Dependency: Remote Access Connection Manager, telephony
Suggestion: Manual

45. Remote Access Connection Manager (Remote Access Connection Manager)
Note: create a network connection.
Reference: Online Network
Dependency: telephony, Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS), Remote Access Auto Connection Manager
Suggestion: Manual

46. (XP) Remote Desktop Help Session Manager (Remote Desktop Help Management)
Microsoft: manages and controls Remote Assistance. If the service is stopped, Remote Assistance will be unavailable.
Reference: you can disable remote assistance without using management and control.
Dependency: Remote Procedure Call (RPC)
Suggestion: manual/stopped

47. Remote Procedure Call (RPC) (Remote Procedure Call)
Description: a message transmission function. During Remote Computer Management, it allows distributed applications (that is, COM + applications) to call available services on different computers on the network. Many services depend on its running.
Reference: Many process services depend on this service and are manually maintained.
Suggestion: automatic

48. Remote Procedure Call Locator (remote process call Locator)
Description: manages the RPC database service, which generally occupies 1 MB of memory during background running.
Reference: it is rarely used on computers. You can try to disable it.
Process: locator.exe
Suggestion: Manual

49. Remote Registry Service (Remote Registry Service)
Note: this service enables you to edit the Registry on another computer, which may cause security problems.
Reference: normal single-host users do not need to use this service unless they need remote assistance in modifying your Logon Settings. The service is named svchost.exe. It can be set to disabled.
Process: regsvc.exe
Suggestion: manual/disabled

50. removable storage (removable storage)
Reference: unless a zip drive, USB or other portable hardware or tape backup device is available, you can try to disable it.
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

51. Routing and Remote Access (Routing and Remote Access)
Note: The routing service is provided for enterprises in LAN and WAN environments.
Reference: Provides Dial-Up to the LAN or VPN service, which is generally unavailable to users.
Suggestion: Disabled

52. Run as service (the service that runs the service as another user)
Note: When you log on to the system as a general user with normal permissions and need to modify the system settings that can only be modified by the system administrator during use, this service provides a shortcut to log on as an administrator without restarting the system. You only need to run the RunAs command at the command prompt to make the change.
Reference: You can set it to disabled before you are familiar with the RunAs command usage.
Suggestion: Disabled

53. Security Accounts Manager (Security Account Manager)
Note: stores the Security Information of the local user account. The protected storage and IIS admin services all need support from this service. The service is named lsass.exe.
Reference: this service is required for managing accounts and groups (gpedit. MSC) applications.
Dependency: Remote Procedure Call (RPC) and Distributed Transaction Coordinator
Suggestion: automatic

54. Server)
Reference: this service is used for LAN file/print sharing. It can be disabled unless you share it with other computers.
Dependency: Computer Browser
Suggestion: manual/disabled

55. (XP) Shell Hardware Detection (outer hardware detection)
Note: Notifications are provided for automatic playback of hardware events.
Reference: generally used on a memory card or CD-ro, DVD-ROM.
Dependency: Remote Procedure Call (RPC)
Suggestion: automatic/manual

56. Smart Card)

57. Smart Card Helper (Smart Card Assistant)
Note: Smart Card devices are supported.
Process: scardsvr.exe
Suggestion: Disabled

58. (XP) SSDP Discovery Service (plug-and-play Device Detection Service)
Note: the discovery of General plug-and-play devices is enabled on your home network.
Reference: the universal plug-and-play and UPnP service allows computers to find and use devices on the network and search for devices through TCP/IP, for example, a network scanner digital camera or printer uses the UPnP function. Based on Security, you can disable this service if you do not need it. The service is named svchost.exe.
Dependency: Universal Plug and Play Device Host
Suggestion: Disabled

59. System Event Notification (System Event Notification)
Description: records user logon, logout, restart, and shutdown information. SENS (System Event Notification Service ). Tracks system events, such as logon to Windows, network, and power events. Notify the COM + Event System subscriber of these events )". The service is named svchost.exe.
Dependency: COM + Event System
Suggestion: automatic

60. (XP) system restore service (System Restoration Service)
Note: The system restoration function is executed. To stop the service, choose my computer> Properties> System Restore.
Dependency: Remote Procedure Call (RPC)

61. Task Scheduler (scheduled task)
Note: Schedule (scheduled Task Service ). Allows you to configure and schedule automatic tasks on this computer. This allows programs to run automatically at a scheduled time, for example, regular disk fragmentation.
Reference: users who do not need this function can set it to disabled.
Dependency: Remote Procedure Call (RPC)
Process: mstask.exe

62. TCP/IP NetBIOS Helper Service (TCP/IP NetBIOS Support Service)
Note: NetBIOS is supported on TCP/IP. NetBIOS is based on LAN.
Reference: a common user who accesses Internet resources can disable it unless the system is in the LAN.
Process: wins.exe
Suggestion: Manual

63 telephony (Telephone Service)
Description: Provides dialing capabilities for computers.
Reference: Generally, a dial-up modem or some DSL/cable may be used. If you use a dial-up method to connect to the Internet or use a telephone line to connect to other computers, set it to manual.
Dependency: Plug and Play, Remote Procedure Call (RPC), Remote Access Connection Manager, Remote Access Auto Connection Manager
Suggestion: Manual

64. telnet (Remote logon Protocol)
Note: remote control of the computer to execute console commands. Generally, 2 MB of memory is occupied when running in the background. This service allows you to log on to the system from a remote computer and operate on this computer using command lines.
Reference: allow remote users to use Telnet to log on to the computer. Most people will misunderstand that the service is disabled and cannot use BBS. It has nothing to do with BBS. For security reasons, you can set it to manual or disabled.
Process: tlntsvr.exe
Suggestion: manual/disabled

65. (XP) Terminal Services (Terminal Services)
Description: Allows multiple users to interact with the display on the same computer and desktop and applications on remote computers. Enhance the Remote Desktop (including the RD of the system administrator), quickly switch users, remote assistance, and terminal servers.
For details, refer to remote desktop or remote assistance. You can disable remote desktop or remote assistance.
Dependency: Remote Procedure Call (RPC), Fast User Switching Compatibility, interactivelogon
Suggestion: Disabled

66. (XP) themes (themes)
Description: Provides theme management of user experience, which affects the appearance interface of Windows XP.
Suggestion: automatic/manual

67. uninterruptible power supply (UPS/uninterruptible power supply)
Manages the uninterruptible power supply (UPS) services connected to the computer.
Reference: if you do not have a UPS device, set it to disabled.
Process: ups.exe
Suggestion: manual/disabled

68. (XP) Universal Plug and Play Device Host (General plug-and-play device of the host)
Note: provides support for General plug-and-play devices of the host.
Reference: used to detect and install a universal plug-and-play and UPnP Device, such as a digital camera or printer.
Dependency: SSDP Discovery Service
Suggestion: Disabled

69. Upload Manager
Description: uploadmgr (upload Management Service ). Manage synchronous and asynchronous file transfers between clients and servers on the network. The service is named svchost.exe.
Dependency: Remote Procedure Call (RPC)
Suggestion: Click it to stop.

70. Utility Manager (auxiliary tools)
Note: Enable and configure auxiliary tools in a window.
Suggestion: Manual

71. (XP) Volume Shadow Copy (Disk Area shadow copy)
Description: manages the shadow replication service in the disk area for software-based shadow replication. If you stop this service, you cannot manage shadow replication in the software-based Disk Area. The service is named vssvc.exe.
Reference: this service is required to use the MS Backup program.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disabled

72. (XP) WebClient (network client)
Enables Windows-based programs to create, access, and modify Internet-based files.
Reference: Use WebDAV to upload files or folders to all web services. For security reasons, you can try to disable it.
Dependency: webDAV client Redirector
Suggestion: Stop.

73. (XP) Windows Audio (Windows Audio Service)
Description: Manages audio devices used in Windows as the main program. If the service is stopped, the audio device and effect will not work properly.
Reference: you can disable this service without a sound card.
Dependency: Plug and Play, Remote Procedure Call (RPC)
Suggestion: automatic

74. (XP) Windows Image Acquisition (WIA/Windows Image Acquisition Program)
Note: provides image capture services for scanners and digital cameras.
Reference: If the scanner and digital camera support The WIA function, you can directly view the image without other drivers. Users without scanners and digital cameras can turn them off.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disabled

75. Windows Installer (Windows Installation Service)
Note: Install, repair, or delete the software in Windows based on instructions in the. MSI file.
Reference: helps users correctly install, set, track, upgrade, and uninstall software, and manages standard formats for application creation and installation, track components such as file groups, logon projects, and shortcuts. Process: msiexec.exe
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

76. Windows Image Acquisition (WIA/Windows Image Acquisition)
Note: Some digital cameras and scanners are used.
Suggestion: Set the Startup Type as needed

77. Windows Management Instrumentation (Windows Management specifications)
Description: WMI is the basic management structure in windows. It controls and monitors system resources through a set of common interfaces (such as viewing and modifying system attributes and setting user permissions ).
Dependency: Event Log, Remote Procedure Call (RPC)
Process: winmgmt.exe
Suggestion: automatic

78. Windows Management Instrumentation Driver Extensions (Windows Management Specification driver extension)
Description: exchanges system management information with drivers.
See Windows Management Instrumentation.
Suggestion: Manual

79. Windows Time (Windows Time)
Note: automatic online time verification is enabled.
Suggestion: Manual

80. (XP) Wireless Zero Configuration (Wireless Adapter Service)
Note: automatic configuration is provided for the 802.11 adapter.
See: automatically configure wireless network devices. If you do not use a wireless network adapter, disable this service.
Dependency: NDIS usermode I/O protocol, Remote Procedure Call (RPC)
Suggestion: Disabled

81. (XP) WMI Performance Adapter (Windows Management specifications)
Microsoft: Provides performance link library information from the wmihiperf provider.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disabled

82. Workstation)
Note: Establish and maintain a client network online to the remote server. If you stop this service, these connections will be unavailable. All services dependent on it cannot be started. Is necessary for network connection.
Dependency: Alerter, Background Intelligent Transfer Service, Computer Browser, messenger, Net Logon, Remote Procedure Call (RPC) Locator
Suggestion: automatic. If you already have SP2, there will be a few more. For example, there is a security center service. If you think it is redundant, you can just turn it off, it does not affect anything !!

83. World Wide Web Publishing Service (World Wide Web Publishing Service)
Description: Provides Web connection and management through the management unit of Internet Information Service (IIS.
Suggestion: automatic/manual

Another article to look at http://blog.csdn.net/freexploit/archive/2005/07/31/443054.aspx