Windows XP Service Pack 2  - Description of Services
Last modified:  2005-05-05
Service	Process Name	Default Setting	"Safe" Settings	Services.inf Settings	Description	Registry Setting
Alerter	svchost.exe	Disabled	Disabled	Disabled	Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. This service usually is not required under normal circumstances. Note: This is NOT 'WinPopUp.'	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]
Application Layer Gateway Service	alg.exe	Manual	Manual	Manual	Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Internet Connection Firewall.  This service is required if using Internet Connection Sharing / Internet Connection Firewall to connect to the internet. This service uses about 1.5 MB of memory in an idle state.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG]
Application Management	svchost.exe	Manual	Manual	Not defined	Provides software installation services such as Assign, Publish, and Remove.  If you cannot modify your software installation of certain applications, put this service in to Manual.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt]
Automatic Updates	svchost.exe	Automatic	Automatic	Automatic	Enables the download and installation of Windows updates. If this service is disabled, this computer will not be able to use the Automatic Updates feature or the Windows Update Web site.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
ClipBook	clipsrv.exe	Disabled	Disabled	Disabled	Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. This service alone uses about 1.3 MB of memory.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv]
COM+ Event System	svchost.exe	Manual	Manual	Not defined	Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. You may  receive, in the Event Log, an entry from DCOM complaining about not having this service running if disabled. This service is required for System Event Notification.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem]
COM+ System Application	dllhost.exe	Manual	Manual	Not defined	Manages the configuration and tracking of Component Object Model (COM)+ based components. If the service is stopped, most COM+ based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. You may receive, in the Event Log, an entry from 'DCOM' complaining about not having this service running if disabled.  This service is required for System Event Notification.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp]
Computer Browser	svchost.exe	Automatic	Disabled	Disabled	Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. This service is not required on a standalone system. Even if you want to browse the network (workgroup or domain) or have mapped network shares as local hard drives, you can still do so. On a large network, one computer is designated the 'master' browser and another one is the 'backup' browser. All others just announce they are available every 12 minutes to take over duties if one of the other computers fail. No lag time is discernable if this service remains Disabled on all but one computer.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser]
Cryptographic Services	svchost.exe	Automatic	Automatic	Not defined	Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. . This service is required for Windows Update to function in Manual and Automatic mode and this service is required to install Service Pack 1 unified updates and DirectX 9.0. Windows Media Player and future .NET applications may also require this service for some features to function.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc]
DCOM Server Process Launcher *	svchost.exe	Automatic	Automatic *	Not defined	Provides launch functionality for DCOM services.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DComLaunch]
DHCP Client	svchost.exe	Automatic	Automatic	Automatic	Manages network configuration by registering and updating IP addresses and DNS names. This service automatically receives a Dynamic IP address from your DHCP server and DNS updates. Required for ICS - internet client and if you run IPSEC, disable on a standalone system or one that has a static IP address. Note: Most DSL or cable ISP's use DHCP to provide internet access. If you disable this service and your Internet connection no longer works, place this back into automatic. Most DSL and cable hardware routers have the option of enabling a DHCP server for the internal network. Ensure that the router is configured the same as your local PC's.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp]
Distributed Link Tracking Client	svchost.exe	Automatic	Manual	Not defined	Maintains links between NTFS files within a computer or across computers in a network domain. It uses about 3.5 MB to 4 MB in an idle state.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks]
Distributed Transaction Coordinator	msdtc.exe	Manual	Manual	Disabled	Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. This service is required if using Message Queuing. You may also see complaints in the Event Log if this service is disabled, but there should be no side effects. Microsoft's .NET may require this service in the future.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC]
DNS Client	svchost.exe	Automatic	Automatic	Automatic	Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start.  This service is not required for DNS lookups. However, DNS Client is required if using IPSEC. If you attempt to 'repair' your network connection and a dialog box complains that the 'DNS resolver failed to flush the cache,' this service is the reason.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache]
Error Reporting Service	svchost.exe	Automatic	Disabled	Disabled	Allows error reporting for services and applictions running in non-standard environments.Calls home to Microsoft when application errors occur.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc]
Event Log	services.exe	Automatic	Automatic	Automatic	Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. Windows Management Instrumentation also requires Event Log Service to be running. If you disable the Event Log Service, but do not disable Windows Management Instrumentation, your computer may have an extended boot time while Windows Management Instrumentation is waiting for the Event Log to start. It is just best to keep Event Log active for troubleshooting purposes and normal operations.  Note:  Manual (and Automatic) updates via Windows Update Version 5 web site requires Cryptographic Services, Background Intelligent Transfer Service, and Event Log to be running. Place All three in to automatic if you do not wish to update manually.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog]
Fast User Switching Compatibility	svchost.exe	Manual	Manual	Disabled	Provides management for applications that require assistance in a multiple user environment.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FastUserSwitchingCompatibility]
Fax	fxssvc.exe	Not Installed	Not Installed	Not Installed	Not installed by default, but if needed, you may install it later off the Windows XP CD. Maintains the ability to send and receive FAX documents on your computer.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fax]
FTP Publishing	inetinfo.exe	Not Installed	Not Installed	Not Installed	This feature is not available on Windows XP Home or installed by default on Windows XP Pro, but if you need it, you may install it later off the Windows XP CD. This service provides a FTP server on your network.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSFTPsvc]
HTTP SSL	svchost.exe	Manual	Manual *	Manual	This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HttpFilter]
Help and Support	svchost.exe	Automatic	Manual *	Disabled	Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. This service is required for MicrosoftÆs online (or offline) help documents. If you ever attempt to use Help and Support, the service places itself back into Automatic	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc]
Human Interface Device Access	svchost.exe	Disabled	Disabled	Manual	Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. You may not have any peripherals that require this service. If one of yours magically does not function anymore, set it to automatic. Namely, scanners with function buttons (fax, copy) or even an Internet keyboard with volume or play controls.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ]
IIS Admin	inetinfo.exe	Not Installed	Not Installed	Not Installed
IMAPI CD-Burning COM Service	imapi.exe	Manual	Manual *	Not defined	Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start. This service operates that cool 'drag and drop' CD burn capability. If you set this service to manual, the service starts and stops itself when used with some software packages.  If you still cannot burn a CD with it on manual, switch to Automatic	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ImapiService]
Indexing Service	cisvc.exe	Manual	Disabled	Disabled	Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. This service always has been a major resource hog.  You can also remove the function via the 'Add / Remove Programs' icon in the control panel (Windows Setup Programs). It uses about 500 K to 2 MB in an idle state, not to mention the amount of memory and CPU resources it takes to INDEX the drives.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cisvc]
IPSEC Services	lsass.exe	Automatic	Automatic *	Automatic	Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.  May be required on some domains or VPN connections, but the average user will not need this.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]
IPv6 Helper Service	svchost.exe	Not Installed *	Not Installed *	Not Installed *	This service translates IPv6 IP addresses to the older (and much more wide spread) IPv4.
Logical Disk Manager	svchost.exe	Automatic	Manual	Manual	Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. This service is vital to run the Disk Management MMC console for dynamic volumes. If you attempt to 'Manage' your hard drives and a dialog box pops up complaining about not being able to do this, start this service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver]
Logical Disk Manager Administrative Service	dmadmin.exe	Manual	Manual	Manual	Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. BlackViper.com adds this: This service is vital to run the Disk Management MMC console for dynamic volumes.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin]
Message Queuing	mqsvc.exe	Not Installed	Not Installed	Disabled
Message Queuing Triggers	mqtgsvc.exe	Not Installed	Not Installed	Not Installed
Messenger	services.exe	Disabled	Disabled	Disabled	Transmits net send and Alerter service messages between clients and servers. This service provides the ability to send messages between clients and servers. This service needs not to be running under normal home and network conditions. It is advisable to disable this service to avoid the possibility of 'net send' messages hitting your computer from the internet.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger]
MS Software Shadow Copy Provider	dllhost.exe	Manual	Manual	Not defined	Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start.Used in conjunction with the Volume Shadow Copy service, Microsoft Backup uses these services. You will receive, in the Event Log, an entry complaining about not having this service running if disabled.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SwPrv]
Net Logon	lsass.exe	Manual	Disabled	Not defined	Supports pass-through authentication of account logon events for computers in a domain. Used for logging onto a Domain Controller. This service is not required on a standalone system, or for a 'home' network.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon]
NetMeeting Remote Desktop Sharing	mnmsrvc.exe	Manual	Disabled	Disabled	Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Enables a user to access your computer using NetMeeting. This may create a BIG open door for the unwanted.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmsrvc]
Network Connections	svchost.exe	Manual	Manual	Not defined	Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Required for managing network connectivity.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman]
Network DDE	netdde.exe	Disabled	Disabled	Disabled	Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Unless you use remote ClipBook, disable it. This uses about 1.5 MB idle.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDE]
Network DDE DSDM	netdde.exe	Disabled	Disabled	Disabled	Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: I have not found a good use for this service. Unless you use remote ClipBook, disable it.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDEdsdm]
Network Location Awareness (NLA)	svchost.exe	Manual	Disabled *	Manual	Collects and stores network configuration and location information, and notifies applications when this information changes. This service is required for use with the Internet Connection Sharing service (server only).	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla]
Network Provisioning Service	svchost.exe	Manual	Disabled *	Disabled	This service is used in conjunction with a domain controller and XML configuration files. Home networks does not require this service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\XMLProv]
NT LM Security Support Provider	lsass.exe	Manual	Manual	Not defined	Provides security to remote procedure call (RPC) programs that use transports other than named pipes. Manages local system security information on the computer. You need this service if you are running Message Queuing or Telnet server.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp]
Peer Name Resolution Protocol *	svchost.exe	Not Installed *	Not Installed *	Not Installed *
Peer Networking *	svchost.exe	Not Installed *	Not Installed *	Not Installed *
Peer Networking Group Authentication *	svchost.exe	Not Installed *	Not Installed *	Not Installed *
Peer Networking Identity Manager *	svchost.exe	Not Installed *	Not Installed *	Not Installed *
Performance Logs and Alerts	smlogsvc.exe	Manual	Disabled	Not defined	Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog]
Plug and Play	services.exe	Automatic	Automatic	Automatic	Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. This service is the heart and soul of the Plug and Play environment. I do not recommend disabling this service, but if you want to, you are on your own. Note: UPnP is NOT PnP. UPnP is for connectivity on networks via TCP/IP to devices, such as scanners or printers. Your sound card is PnP. Do NOT disable Plug and Play service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay]
Portable Media Serial Number Service	svchost.exe	Manual		Disabled	Retrieves the serial number of any portable music player connected to your computer. Disable it unless something of yours ceases to function properly, such as Windows Media Player, Microsoft's integration with Digital Rights Management and copy protection.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSn]
Print Spooler	spoolsv.exe	Automatic	Automatic	Automatic	Loads files to memory for later printing. This service is required if you have printers, even if they are network printers.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler]
Protected Storage	lsass.exe	Automatic	Automatic	Disabled	Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.  Allows for the saving of local passwords or even web sites information (AutoComplete).	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage]
QoS RSVP	rsvp.exe	Manual	Disabled	Disabled	Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.Provides traffic control on a network using IPSEC and applications that support QoS, and have an adapter that supports it. The QoS Packet Driver installs by default on any TCP/IP connections.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSVP]
Remote Access Auto Connection Manager	svchost.exe	Manual	Manual	Disabled	Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.  This service may be required for your internet connection. If things cease to function after disabling this service, put it to automatic. Note: you may require this service for some direct cable or DSL providers and connections, depending on how they implement their logon process. If your Dial-up, cable or DSL internet access no longer functions properly with this service disabled, place this service into automatic. If you use a hardware gateway or router, this service is not required.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto]
Remote Access Connection Manager	svchost.exe	Manual	Manual	Disabled	Creates a network connection. This service is required if you use Internet Connection Sharing. If things cease to function after disabling this service, put it to automatic. Note: you may require this service for some direct cable or DSL providers and connections, depending on how they implement their logon process. If your Dial-up, cable or DSL internet access no longer functions properly with this service disabled, place this service into automatic. If you use a hardware gateway or router, this service is not required.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan]
Remote Desktop Help Session Manager	sessmgr.exe	Manual	Disabled	Disabled	Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr]
Remote Procedure Call (RPC)	svchost.exe	Automatic	Automatic	Automatic	Provides the endpoint mapper and other miscellaneous RPC services.  This service is rather vital. Practically everything depends on this service to be running. This is also the only service that you cannot disable via the Services MMC.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs]
Remote Procedure Call (RPC) Locator	locator.exe	Manual	Manual	Not defined	Manages the RPC name service database.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator]
Remote Registry Service	svchost.exe	Automatic	Disabled	Disabled	Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry]
Removable Storage	svchost.exe	Manual	Manual	Automatic	Used for managing removable media. Disable this service if you do not have items like tape backup devices, etc. If your CD ROM / DVD drive starts acting funny, (no auto play, etc) place this service into automatic. Normally, this service does not need to be running and you will not miss any of its functionality.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc]
RIP Listener	svchost.exe	Not Installed	Not Installed	Not Installed
Routing and Remote Access	svchost.exe	Disabled	Disabled	Disabled	Offers routing services to businesses in local area and wide area network environments. Allows computers to dial in to the local computer through a modem (or other devices) to access the local network using a standard or VPN connection. Unless you require this functionality, disable it for security reasons. Upon enabling this service, Incoming Connections icon will be available in the Network Connections control panel.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess]
Secondary Logon	svchost.exe	Automatic	Disabled	Manual	Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.  If you disable this service, the 'run as' function will no longer be available.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon]
Security Accounts Manager	lsass.exe	Automatic	Automatic	Automatic	Stores security information for local user accounts. Like Protected Storage, it saves profile and security information for local users. This service is required for the IIS Admin Service. If you have ever used the Group Policy Editor (gpedit.msc) to modify your settings, you need to keep this service running; otherwise, your modifications will not apply.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs]
Security Center	svchost.exe	Automatic	Disabled *	Not defined	This service monitors the status of Automatic Updates, Windows Firewall and virus protection software. It is always displayed in the system tray as to the status of these particular functions. If you do not want the Security Center to monitor these functions for you, disabling this service is not enough. After rebooting the system, this service will again be placed into automatic and started. While the service is in the started state, go to Start > Control Panel > Security Center and select the link on the left hand side labeled "Change the way Security Center alerts me." In the resulting dialog box, uncheck Firewall, Automatic Update and Virus Protection. After that step is complete, you may place the Security Center service in disabled and it will not start again or continue to be displayed in the system tray after a reboot.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvd]
Server	svchost.exe	Automatic	Disabled	Automatic	Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Used for file and print sharing from your computer or Message Queuing. For security purposes, you may disable this service if you do not require local printers and files shared across your network. Connectivity, however, still exists even on incoming shared network drives. Workstation needs to be running to connect to another computer that has the files you are looking for. Note: If you disable File and Print sharing, the Server Service may disappear from the Services listing. Just enable File and Print sharing again and the Server Service will return.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver]
Shell Hardware Detection	svchost.exe	Automatic	Automatic	Not defined	Used for the auto play of devices like memory cards, CD drives, etc.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection]
Simple Mail Transport Protocol (SMTP)	inetinfo.exe	Not Installed	Not Installed	Not Installed
Simple TCP/IP Services	tcpsvcs.exe	Not Installed	Not Installed	Not Installed
Smart Card	SCardSvr.exe	Manual	Disabled	Not defined	Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. Supports the use of a Smart Card for local or network computer authentication. If you do not have a Smart Card, you do not need this service running.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr]
Smart Card Helper					Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start. Supports the use of a Smart Card for local or network computer authentication. If you do not have a Smart Card, you do not need this service running.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardDrv]
SNMP Service	snmp.exe	Not Installed	Not Installed	Not Installed
SNMP Trap Service	snmptrap.exe	Not Installed	Not Installed	Not Installed
SSDP Discovery Service	svchost.exe	Manual	Disabled	Disabled	Enables discovery of UPnP devices on your home network. Used in conjunction with Universal Plug and Play Device Host, it detects and configures UPnP devices on your home network. For security reasons disable this service. If any EXTERNAL device does not function because of this service being disabled, place it back in to automatic. MSN Messenger uses this service in conjunction with supported UPnP devices, to provide support for networks behind a NAT firewall or router.  This service  that it broadcasts UDP port 1900 a lot. If you notice plenty of network activity even though nothing is happening, this serivice is sometimes the cause. Note: Do NOT disable the Plug and Play service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV]
System Event Notification	svchost.exe	Automatic	Automatic	Not defined	Tracks system events such as Windows logon, network, and power events.  Notifies COM+ Event System subscribers of these events. Used in conjunction with COM+ Event System, this service notifies particular services when system events, such as logon and power events occur.  You may receive, in the Event Log, an entry complaining about not having this service running if disabled.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS]
System Restore Service	svchost.exe	Automatic	Disabled	Disabled	Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties. This service creates system snap shots or restores a point for returning to later.  By default, System Restore Service uses a LARGE amount of disk space to store rollback points. On large hard drives, this could be well over 10 to 20 GB.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
Task Scheduler	svchost.exe	Automatic	Automatic	Automatic	Enables a user to configure and schedule automated tasks on this computer. Some third party software may require this service to be active for automated functions, such as virus scanners, system maintenance tools, and Automatic Updates	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule]
TCP/IP NetBIOS Helper Service	svchost.exe	Automatic	Disabled	Automatic	Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.  This feature provides legacy support for NetBIOS over TCP/IP. If your network does not use NetBIOS and / or WINS, disable this function.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts]
TCP/IP Printer Server	tcpsvcs.exe	Not Installed	Not Installed	Not Installed
Telephony	svchost.exe	Manual	Manual	Disabled	Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.  This service is required for dial-up modem connectivity. Note: you may require this service for some direct cable or DSL providers, depending on how they implement their logon process or some AOL functionality, depending on software used. If Dial-up, cable or DSL internet access no longer functions properly with this service disabled, place it into automatic. If you are connecting via a hardware router or gateway, this service is not needed.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv]
Telnet	tlntsvr.exe	Manual	Disabled	Disabled	Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. For security reasons, disable this unless you specifically require its functionality.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr]
Terminal Services	svchost.exe	Manual	Manual	Disabled	Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]
Themes	svchost.exe	Automatic	Automatic	Not defined	Provides user experience theme management.  Used to display all those new XP themes and colors on your desktop. If memory conscious and does not care about the new XP look, disable this service to save RAM.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes]
Uninterruptible Power Supply	ups.exe	Manual	Disabled	Not defined	Manages an uninterruptible power supply (UPS) connected to the computer.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS]
Universal Plug and Play Device Host	svchost.exe	Manual	Disabled	Disabled	Provides support to host Universal Plug and Play devices. Used in conjunction with SSDP Discovery Service, it detects and configures UPnP devices on your home network. For security reasons, disable this service. If any EXTERNAL device does not function because of this service being disabled, place it back in to automatic. MSN Messenger uses this service in conjunction with supported UPnP devices, to provide support for networks behind a NAT firewall or router. Note: UPnP is NOT PnP. Your sound card is PnP. Do NOT disable Plug and Play service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost]
Volume Shadow Copy	vssvc.exe	Manual	Manual	Disabled	Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. Used in conjunction with the MS Software Shadow Copy Provider service. Microsoft Backup also uses these services. You may receive, in the Event Log, an entry complaining about not having this service running if disabled.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS]
WebClient	svchost.exe	Automatic	Disabled	Not defined	Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient]
Windows Audio	svchost.exe	Automatic	Automatic	Not defined	Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.  This service is required if you wish to hear any audio at all. If your computer does not have a sound card, disable this service.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv]
Windows Firewall / Internet Connection Sharing	svchost.exe	Automatic	Automatic	Not defined	Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.Used to allow multiple computers on your network to access the internet via only one account. This service installs on the modem computer. If you are using a third party firewall or Internet Connection Sharing software package, this service is not required.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
Windows Image Acquisition (WIA)	svchost.exe	Manual	Manual	Not defined	Provides image acquisition services for scanners and cameras. Used for some scanners, web cams, and cameras. If, after disabling this service, your scanner or camera fails to function properly, enable this service by placing it into automatic.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc]
Windows Installer	msiexec.exe	Manual	Manual	Not defined	Installs, repairs and removes software according to instructions contained in .MSI files. This service is required for software applications that install using MSI files. If your applications don't install properly or you get an error that involves 'RPC Service,' place this service in to Automatic.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer]
Windows Management Instrumentation	svchost.exe	Automatic	Automatic	Not defined	Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. This service is required if you want to see the Dependencies tab in service configuration.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt]
Windows Management Instrumentation Driver Extension	svchost.exe	Manual	Manual	Not defined	Provides systems management information to and from drivers. This feature is not available on Windows XP Home.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi]
Windows Time	svchost.exe	Automatic	Disabled	Automatic	Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.  Automatically sets your clock by contacting a server (Microsoft’s server by default) on the internet. Great idea if your network connects to the internet 24/7. The Event Log fills up with 'cannot find server' messages on a non-dedicated setup, though. After successful synchronizing, this service will not attempt to do it again for 7 days, meanwhile, taking up resources. You may choose to set your clock manually on a dial up connection, but with a 24/7 broadband setup, this could keep you on time for work. Note: as mentioned, 'time.windows.com' is the default server for synchronization. For those privacy conscious people that prefer to connect to a government site rather then MS, use 'time.nist.gov.'"	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]
Wireless Zero Configuration	svchost.exe	Automatic	Disabled	Disabled	Provides Automatic configuration for the 802.11 adapters (wireless network devices) and connection quality feedback. If you do not have any wireless network devices in use on the local system, disable this service. You may require this service for connectivity with some hot sync software for a PDA, laptop or other portable computer."	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC]
WMI Performance Adapter	wmiapsrv.exe	Manual	Disabled	Not defined	Provides performance library information from WMI HiPerf providers	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrv]
Workstation	svchost.exe	Automatic	Automatic	Automatic	Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Used to connect local computer to remote computers. Examples may include local network connectivity and File and Print sharing. Many services depend on Workstation to be functioning.	[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation]
World Wide Web Publishing *	inetinfo.exe	Not Installed	Not Installed	Not Installed	This feature is not available on Windows XP Home or installed by default on Windows XP Pro, but if needed, you may install it later off the Windows XP CD. Used for setting up a local web server. If you do not need this function, leave it uninstalled, mainly because this service requires IIS Admin to be running and IIS has been "popular" for crackers to break.