Windows Service overview)

For Windows 2000/XP, which we often use, there are many services, So what are these services? What do we need? What is not required? I will introduce you here.

The Win32 service program consists of three parts: service application, Service Control Program, and Service Control Manager. The Service Control Manager maintains service data in the registry. The Service Control Program is a module that controls service applications and serves as a bridge between control service applications and service managers. A service application is the main program of a service program. It is the executable code of one or more services. We can find it in Control Panel-management tools-service. You can modify their current status and startup mode. There are three ways to start them: 'auto' is enabled when the computer is started or needed. 'Manually 'can be opened by running the 'net start' command and 'net stop' command in the command prompt. 'disallowed' means that it is not started before the startup mode is changed.

Many of them are mutually dependent among many service programs, so we cannot stop a service at will. Otherwise, the system may be abnormal, however, some services do not play any role for us and occupy our valuable system resources. In fact, many programs are not available and can be closed, to save resources.

Alert)
Notifies the selected user and Computer System Management alert. If you stop this service, programs that use system management alerts will not be notified. All services dependent on it cannot be started. Generally, home computers do not need to send or receive warnings managed by computer systems (administrative alerts) unless your computer is used on a local area network.
Dependency: Workstation
Suggestion: Disable

Application Layer Gateway Service
Third-party communication protocol plug-ins that provide Internet online sharing and internet online firewall support if you do not use internet online sharing (ICS) to provide Internet access for multiple computers and internet online firewall (ICF) you can turn off the software.
Dependency: internt Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Suggestion: Disable

Application Management)
An all-new and effective software management solution based on MSI file format introduced from Win2000-application management component service, which can not only manage the installation and deletion of software, you can also use this service to modify and repair existing applications, monitor file recovery, and troubleshoot basic faults through recovery.
Suggestion: Manual

Automatic Updates
Enable download and installation of important windows updates. If you disable this service, you can manually update the operating system from the Windows Update Website. Allow Windows to go to Microsoft servers to automatically check and download the update Patch under Background automatic connection.
Suggestion: Disable

Background Intelligent Transfer Service
Use idle network bandwidth to transmit data. For example, Windows Update is one of the tasks of transferring data in the background through via http1.1.
Dependency: Remote Procedure Call (RPC) and workstation
Suggestion: Disable

Clipbook)
Enable the clipboard viewer to store information and share it with remote computers. If this service is stopped, the clipboard viewer cannot share information with a remote computer. Any service that explicitly depends on it cannot be started. Share information in the clipboard with other computers.
Dependency: Network DDE
Suggestion: Disable

COM + Event System (COM + Event System)
The 'System Event Notification Service (SENS) 'is supported to automatically distribute events to COM components. If the service is stopped, sens will shut down and cannot provide logon and logout notifications. Any services that depend on it obviously cannot be started. Some programs may use COM + components, such as the optimize system application of bootvis. For example, the DCOM shown in the event check is not enabled.
Dependency: Remote Procedure Call (RPC) and System Event Notification
Suggestion: Manual

COM + System Application
Manage the settings and tracking of COM + components. If you stop this service, most COM + components cannot run smoothly. Any service that explicitly depends on it cannot be started. If the DCOM shown in the event check is not enabled
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

Computer Browser)
Maintain the updated computer list on the network and provide this list to the computer used as a browser. If you stop the service, the configuration will not be updated or maintained. If this service is disabled, all services dependent on it cannot be started. Generally, you do not need a home computer unless your computer is used on a LAN, but is it necessary to slow down the local computer on a large lan?
Dependency: Server and workstation
Suggestion: Disable

Cryptographic Services
Three management services are provided: Confirm Windows File authentication; add and remove trusted root certificate authentication authorization creden from this computer; and assist in registering this computer for obtaining creden. If this service is stopped, these management services will not work properly. Any service that explicitly depends on it cannot be started. Simply put, Windows Hardware Quality Lab (WHQL) is a type of Microsoft authentication. If you use automatic update, you may need this
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

DHCP Client)
Manage network settings by logging on to and updating the IP address and DNS name. All users who use DSL/cable, ICS, and IPSec need this to specify a dynamic IP address. If the system is not on any network, or the network does not have a DHCP service, you can set it to disabled.
Dependency: AFD network supports environment, netbt, symtdi, TCP/IP protocol driver, and NetBIOS over TCP/IP
Suggestion: Manual

Distributed Link Tracking Client (Distributed Link tracing client)
Maintain connections between NTFS files on different computers in the computer or network. For the vast majority of users, it can be closed, except for special users.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Distributed Transaction Coordinator (distributed exchange Coordinator)
Coordinates information exchange across multiple resource administrators, such as databases, message queues, and file systems. If the service is stopped, these transactions will not occur. Any service that obviously depends on it cannot be started. As mentioned above, it is generally not suitable for household computers unless you enable Message Queuing.
Dependency: Remote Procedure Call (RPC) and security accounts manager
Suggestion: Disable

DNS Client)
Resolve and quickly obtain the Domain Name System (DNS) name of this computer. If you stop this service, the computer will not be able to resolve the DNS name and find the location of the Active Directory domain control site. All services dependent on it cannot be started. As mentioned above, in addition, IPSec needs to be used
Dependency: TCP/IP protocol driver
Suggestion: Manual

Error Reporting Service
Allows error reporting for services and applications executed in non-standard environments. Microsoft's application Error Reporting Service is useless to most users and useless to pirated users. We recommend that you disable it.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Event Log (event record file)
Event messages sent from Windows-based programs and components can be viewed in the event viewer. This service cannot be stopped. Allows event messages to be displayed on the event viewer.
Dependency: Windows Management Instrumentation
Suggestion: automatic

Fast User Switching Compatibility
Provides application management in a multi-user environment. In addition, it is recommended that you do not stop switching the User Function in the logout screen. Otherwise, many functions cannot be implemented.
Dependency: Terminal Services
Suggestion: Manual

Help and Support
Microsoft provides services that support instructions and help files. If this service is stopped, you will not be able to use the instructions and support center. All its dependent services cannot be started. If you do not use it, it turns out that not many people need it. We recommend that you stop it unless you have special requirements.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Human Interface Device Access
Enables universal input access to the ergonomic interface device (HID), which enables and maintains the use of predefined shortcuts on this keyboard, remote control, and other multimedia devices. If the service is stopped, the shortcut of the service control will no longer work, and any services explicitly dependent on it will not start. If there is no HID device, you can disable it.
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

Imapi CD-Burning COM Service
Use Image Mastering Applications Programming Interface (imapi) to manage the disc burning. If the service is stopped, the computer cannot burn the disc. Any service that explicitly depends on it cannot be started. XP integrated CD-R and CD-RW drive drag and drop burning function, but unfortunately not comparable to the burning software, turn off can also accelerate the speed of Nero, if not used to use third-party software, please keep.
Suggestion: Disable

Indexing Service (Index Service)
Indexing content and file attributes of local and remote computers; quick file access through elastic query languages. To put it simply, it can speed up your search, but I think few people should search for it with remote computers unless it is special work.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Provides network address translation, addressing and name resolution services and services to your home network or small office network to prevent interference. If you do not use internet online sharing (ICS) or internet online firewall (ICF) contained in XP, you can turn it off.
Dependency: Application Layer Gateway Service, Network Connections, Network Location Awareness (NLA), Remote Access Connection Manager
Suggestion: Disable

IPSec services (IP Security Service)
Manage IP Security Principles and start ISAKMP/Oakley (IKE) and IP Security drivers. Helps protect data transmitted over the network. As an important part, IPSec provides security for Virtual Private Networks (VPNs), while VPN allows organizations to transmit data over the Internet securely. Some domains may be needed, but most users do not need it.
Dependency: IPsec Driver, Remote Procedure Call (RPC), TCP/IP protocol driver
Suggestion: Manual

Logical Disk Manager (Logical Disk administrator)
Detects and monitors new hard disk and transfers Disk Area Information to the Logical Disk Management System for configuration. If the service is stopped, the dynamic disk status and settings may be out of date. Any service that explicitly depends on it cannot be started. The disk administrator is used to dynamically manage disks, such as displaying available disk space and using functions of the Microsoft Management Console (MMC) console.
Dependency: Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager Administrative Service
Suggestion: automatic

Logical Disk Manager Administrative Service (Logical Disk Administrator System Management Service)
Set the hard disk and disk area. The service only executes the setup program and then stops. Microsoft Management Console (MMC)
Dependency: Plug and Play, Remote Procedure Call (RPC), and Logical Disk Manager
Suggestion: Manual

Messenger)
Transmit the 'alerter] 'service text message over the network between the client and the server. This service has nothing to do with Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. All services dependent on it cannot be started. For example, the net send function is used to send prompt messages between networks. If you do not want to be harassed, you can turn it off.
Dependency: NetBIOS interface, Plug and Play, Remote Procedure Call (RPC), and workstation
Suggestion: Disable

MS Software Shadow Copy Provider
Manage the disk area shadow replication service for software-based Disk Area shadow replication. If you stop this service, you cannot manage shadow replication in the software-based Disk Area. Any service that explicitly depends on it cannot be started. As mentioned above, what is used for backup, such as the MS backup program, requires this service, but most people cannot use this function.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Net Logon
Supports pass-through verification for account logon events on computers on the network. Generally, a home computer is unlikely to use the logon Network review service.
Dependency: Workstation
Suggestion: Disable

NetMeeting Remote Desktop Sharing (NetMeeting Remote Desktop Sharing)
Authorized users can use NetMeeting to remotely access the computer through the company's internal network. If this service is stopped, the Remote Desktop Sharing function will be unavailable. Any service that depends on it cannot be started. As mentioned above, users can share control of computers with other users on the Internet or the Internet. if you pay attention to security and do not want to open a backdoor more, you can close it.
Suggestion: Disable

Network Connections (network connection)
Manage objects in the network and dial-up connection data folder, where you can view the local network and remote connection. Control your network connection
Dependency: Remote Procedure Call (RPC), Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Suggestion: Manual

Network DDE)
Provides network transmission and security for Dynamic Data Exchange (DDE) programs executed on the same or different computers. If this service is stopped, DDE transmission and security cannot be used. Any service that explicitly depends on it cannot be started. The average person does not seem to be able to use
Dependency: Network dde dsdm, Clipbook
Suggestion: Disable

Network dde dsdm (Network dde dsdm)
Information Dynamic Data Exchange (DDE) network sharing. If the service is stopped, the DDE network sharing will be unavailable. Any service that explicitly depends on it cannot be started. The average person does not seem to be able to use
Dependency: Network DDE
Suggestion: Disable

Network Location Awareness (NLA)
Collect and store network settings and location information, and notify the application when this information is changed. If you do not use ICF or ICS, you can disable it.
Dependency: AFD network supports environment, TCP/IP procotol driver, Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS)
Suggestion: Disable

Nt lm Security Support Provider (NTLM security support provider)
Provides security for Remote Procedure Call (RPC) programs that do not use named pipe transmission. If you do not use Message Queuing or telnet server, disable it. Generally, you cannot use it.
Dependency: Telnet
Suggestion: Disable

Performance Logs and alerts (performance record files and warnings)
Collects performance data from the local computer or remote computer based on preset parameters, and then writes the data to the record. If the service is stopped, no performance information is collected. Any service that explicitly depends on it cannot be started. No value for services.
Suggestion: Disable

Plug and Play (plug-and-play)
Enable the computer to identify and adapt to hardware changes with little or no input from the user. Stopping or disabling this service will cause system instability. As the name implies, it is a PNP environment. Generally, a computer requires support from the PNP environment, so do not disable it.
Dependency: Logical Disk Manager, Logical Disk Manager Administrative Service, messenger, smart card, telephony, Windows Audio
Suggestion: automatic

Portable Media Serial Number
Retrieves the serial number of any portable music player connected to your computer re-obtains the Music Dial number through a networked computer. This item has no value. Don't worry about turning it off!
Suggestion: Disable

Print Spooler (print multi-task buffer processor)
Load the file into memory for printing later. Printing can be optimized, which is helpful for printing. If no printer is available, you can turn it off.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Protected Storage (protected storage device)
Provides protected storage areas to store important data and prevent unauthorized services, processing, or users from accessing the data. A service used to store passwords on your computer, such as outlook, Dialup programs, and other applications.
Dependency: Remote Procedure Call (RPC)
Suggestion: automatic

QoS RSVP (QoS licensing control, RSVP)
Provides network signal and Regional Traffic Control and installation functions for programs that can identify QoS and control applets. This service is used to retain 20% bandwidth. If your network adapter does not support 802.1 p or you do not have an ACS server on your computer's network, you don't need to say it.
Dependency: AFD network supports environment, TCP/IP procotol driver, Remote Procedure Call (RPC)
Suggestion: Disable

Remote Access Auto Connection Manager (Remote Access automatic online administrator)
When the program refers to the remote DNS or NetBIOS name or address, establish a remote network connection. Some DSL/cable vendors may need to use this to process login programs
Dependency: Remote Access Connection Manager, telephony
Suggestion: Manual

Remote Access Connection Manager (Remote Access Connection administrator)
Establishing a network connection, as the name implies, is of great significance in the network connection. Of course, if you do not use a network, you can disable it.
Dependency: telephony, Internet Connection Firewall (ICF)/Internet Connection Sharing (ICS), Remote Access Auto Connection Manager
Suggestion: Manual

Remote Desktop Help Session Manager
Manage and Control Remote Assistance. If the service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the 'dependency' label in the content dialog box. The Management and Control remote assistance mentioned above is useless for common users and can be disabled.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Remote Procedure Call (RPC) (Remote Procedure Call, RPC)
Provides end point applications and other RPC services. Many program devices need to use this service, which is complex and dependent. Therefore, do not disable it unless you are an advanced user.
Dependency: there are too many dependencies, so I cannot enumerate them one by one.
Suggestion: automatic

Remote Procedure Call (RPC) Locator (remote process call locating Program)
Manage the RPC Name Service database. It is rarely used on general computers and has no special requirements. You can try to disable it.
Dependency: Workstation
Suggestion: Disable

Remote Registry (Remote Logon Service)
Enable remote services to operate on remote computers. If the service is stopped, the user on the computer can only modify the logon status. Any service that explicitly depends on it cannot be started. For security reasons, it is recommended that you disable it unless you need remote assistance to modify your Logon Settings.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Removable Storage (detachable storage device)
Unless you have a zip disk drive, a portable hardware such as USB, or a tape backup device, you can try to turn it off. There are many devices in this area, so we recommend you keep them.
Dependency: Remote Procedure Call (RPC)
Suggestion: automatic

Routing and Remote Access (Routing and Remote Access)
Provides the company's routing service connected to the LAN and WAN. Provides dial-up connections to the network or VPN service. Generally, users cannot use it and can disable it.
Dependency: Remote Procedure Call (RPC), netbiosgroup
Suggestion: Disable

Secondary Logon
Enable the Start Program for other authentication. If this service is stopped, this type of login and access will be unavailable. Any service that explicitly depends on it cannot be started. Allow multiple user handlers and execute separation.
Suggestion: automatic

Security Accounts Manager (Security Account administrator)
Stores the Security Information of the local account. Although many people do not know about the application of managing accounts and groups (gpedit. MSC), it does not play a major role.
Dependency: Remote Procedure Call (RPC) and Distributed Transaction Coordinator
Suggestion: automatic

Server)
Sharing archives, printing, and named pipelines for this computer over the network. If you stop this service, you cannot use these functions. All services dependent on it cannot be started. Simply put, it is the sharing of files and printing. Unless you share files with other computers, it will be disabled.
Dependency: Computer Browser
Suggestion: Disable

Shell Hardware Detection
Provides notifications for automatic playback of hardware events. It is usually used on mobile storage, CD devices, and DVD devices. This is annoying and can be closed.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Smart Card
Manage the access to the smart card read by this computer. If the service is stopped, the computer cannot read the smart card. Any service that explicitly depends on it cannot be started. If you do not use smart card, you can disable it.
Dependency: Plug and Play
Suggestion: Disable

Smart Card Helper)
Enable non-plug-and-play smart card reading support for older versions of computers. If the service is stopped, the computer does not support the old smart card version. Any service that explicitly depends on it cannot be started. If you do not use smart card, you can disable it.
Suggestion: Disable

SSDP Discovery Service
Enable generic plug-and-play device search on your home network. The universal plug-and-play and play (UPnP) service allows computers to find and use devices on the network, and search devices through TCP/IP through network connections, like the scanner, digital camera, or printer on the network, the UPnP function is used, which is useless based on security. However, digital devices are very popular now and users who need them can keep them
Dependency: Universal Plug and Play Device Host
Suggestion: Disable
System Event Notification (System Event Notification)
Tracks system events such as Windows login, network, and power events. The COM + Event System subscriber that notifies these events. This is especially important for servers.
Dependency: COM + Event System
Suggestion: automatic

System Restore Service
Execute the System Restoration function. If you want to stop the service, the reason for disabling the system from my computer -- Property -- System Restoration is determined by the reason. I think it is a waste of resources and can turn it off.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Task Scheduler
Allows users to set and execute automatic work plans on this computer. If you stop this service, these tasks will not be executed at the time they are set. Any service that explicitly depends on it cannot be started. Set an automatic work plan, such as scheduled disk scanning, virus scanning, update, and so on. However, it is rarely used and can be disabled.
Dependency: Remote Procedure Call (RPC)
Suggestion: Manual

TCP/IP NetBIOS Helper (TCP/IP NetBIOS Helper Program)
Enable NetBIOS over TCP/IP (netbt)] service and NetBIOS name resolution support. If your network does not use netbios or wins, you can close it. We recommend that you keep it for users who are not familiar with the network. Otherwise, your network may be faulty.
Dependency: AFD network supports environment, netbt
Suggestion: Disable

Telephony)
Provides telephone voice API (TAPI) support for the local machine and the server that is connected to the service that is executing the service through the local area network, controls the telephone voice device and IP voice connection service. A general dial-up modem or some DSL/cable may be used
Dependency: Plug and Play, Remote Procedure Call (RPC), Remote Access Connection Manager, Remote Access Auto Connection Manager
Suggestion: Manual

Telnet
Enable a remote user to log on to this computer and run applications, and support various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If the service is stopped, remote users may not be able to access the application. Any other service explicitly stored in this service will fail to start. Remote users are allowed to use Telnet to log on to the computer. Generally, BBS cannot be used if it is misunderstood. This is not related to BBs. It is recommended that you disable it if there is no special requirement for security reasons.
Dependency: nt lm Security Support Provider, Remote Procedure Call (RPC), TCP/IP protocol driver
Suggestion: Disable

Terminal Services)
Allows multiple users to connect to the same computer, desktop, and remote computer applications. Enhance the Remote Desktop (including the RD of the system administrator), quickly switch users, remote assistance, and terminal servers. Remote Desktop or remote assistance is disabled without any need. At present, this service also causes many network server security problems.
Dependency: Remote Procedure Call (RPC), Fast User Switching Compatibility, interactivelogon
Suggestion: Disable

Themes
Provides topic management for users. Many people use set themes to create a personalized system. However, if they are not used, they can be disabled.
Suggestion: automatic

Uninterruptible power supply (Power Supply System)
Manages the uninterruptible power supply (UPS) that is connected to this computer ). Is uninterruptible power supply (UPS) useful to ordinary people? Unless your power supply has this function, it will be turned off.
Suggestion: Disable

Universal Plug and Play Device Host
Provides support for General plug-and-play devices of the host. It is used to detect and install a universal plug-and-play and play (UPnP) device, such as a digital camera or printer, which is required by many devices.
Dependency: SSDP Discovery Service
Suggestion: automatic

Volume Shadow Copy
Manage and perform disk image copies for backup and other purposes. If this service is stopped, image copying cannot be used for backup, and backup may fail. Any service that explicitly depends on it cannot be started. As mentioned above, something to back up, such as the MS backup program needs this service
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

WebClient
Enable Windows-based programs to create, access, and modify Internet-based files. If you stop this service, these functions will be unavailable. Any service that explicitly depends on it cannot be started. Use WebDAV to upload files or files to all web services. For security reasons, you can try to disable
Dependency: webDAV client Redirector
Suggestion: Disable

Windows Audio
Manage the audio devices used for Windows as the main program. If the service is stopped, the audio device and effect will not work properly. Any service that explicitly depends on it cannot be started. If you don't have a sound card, you can turn it off, but the current PC doesn't have a sound card, right?
Dependency: Plug and Play, Remote Procedure Call (RPC)
Suggestion: automatic

Windows Image Acquisition (WIA) (Windows Image Acquisition Program)
Provides Image Acquisition Services for scanners and digital cameras. If the scanner and digital camera support Wia, you can directly view the image file without other drivers, so no scanner or digital camera users can close it.
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Windows Installer (Windows Installer)
Install, repair, and remove software as instructed in the. MSI file. Is a system service that helps users correctly install, set, track, upgrade, and remove software programs and manages standard formats for application creation and installation, and tracking components such as archive groups, login projects, shortcuts, and so on, many software installation requires this service, so we recommend that you keep it, otherwise it will encounter a lot of trouble.
Dependency: Remote Procedure Call (RPC)
Suggestion: automatic

Windows Management Instrumentation (Wmi)
Provides public interfaces and object models to access management information about operating systems, devices, applications, and services. If this service is stopped, most Windows software will not work properly. All services dependent on it cannot be started. As mentioned above, it is a service that provides a standard infrastructure to monitor and manage system resources.
Dependency: Event Log, Remote Procedure Call (RPC)
Suggestion: automatic

Windows Management Instrumentation Driver Extensions (Windows Management Instrumentation Driver extension) provides the System Management Information Management driver. Windows Management Instrumentation extends to provide information, which can be set to manual
Suggestion: Manual

Windows Time (Windows Time Setting)
Maintains data and time synchronization of all clients and servers on the network. If the service is stopped, the date and time synchronization cannot be performed. All dependent services are stopped. The network does not have much significance for time calibration, and occupies a lot of resources and can be disabled.
Suggestion: Disable

Wireless Zero Configuration
Automatic Configuration of wireless network devices is provided for the 802.11 adapter, which means that unless you are using a wireless network device, you need to use this network zero management service, otherwise, this will not work for you at all.
Dependency: NDIS usermode I/O protocol, Remote Procedure Call (RPC)
Suggestion: Disable

WMI Performance Adapter
Provides performance link library information from the wmihiperf provider. It has little effect on most users
Dependency: Remote Procedure Call (RPC)
Suggestion: Disable

Workstation)
Establish and maintain a client network online to the remote server. If you stop this service, these connections will be unavailable. All services dependent on it cannot be started. Is necessary for network connection.
Dependency: Alerter, Background Intelligent Transfer Service, Computer Browser, messenger, Net Logon, Remote Procedure Call (RPC) Locator
Suggestion: automatic

In Windows, many services are unavailable. You can decide what to retain and what to close based on your needs. We believe that the system resources will be greatly increased after your modifications.
From China-based Hacker Alliance