Disabling Task Mgr. in Windows XP

Discussion in 'Computer Support' started by Bob H, Feb 4, 2006.

  1. Bob H

    Bob H Guest

    Trying to edit the registry to disable TM. Following the
    HKEY_CURRENT_USER there is no System listed under Policies. The process
    I'm following as follows:

    There is a registry hack to enable or disable Windows NT TaskManager.
    The same registry hack applies to Windows 2000 and Windows XP.

    Hive: HKEY_CURRENT_USER
    Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
    Name: DisableTaskMgr
    Type: REG_DWORD
    Value: 1=Enablethis key, that is DISABLE TaskManager
    Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager

    Reply
     
    Bob H, Feb 4, 2006
    #1
    1. Advertising

  2. Bob H

    Duane Arnold Guest

    Bob H wrote:
    > Trying to edit the registry to disable TM. Following the
    > HKEY_CURRENT_USER there is no System listed under Policies. The process
    > I'm following as follows:
    >
    > There is a registry hack to enable or disable Windows NT TaskManager.
    > The same registry hack applies to Windows 2000 and Windows XP.
    >
    > Hive: HKEY_CURRENT_USER
    > Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
    > Name: DisableTaskMgr
    > Type: REG_DWORD
    > Value: 1=Enablethis key, that is DISABLE TaskManager
    > Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager
    >
    > Reply
    >


    And what would be your reasoning for disabling Task Manager?

    Duane :)
     
    Duane Arnold, Feb 4, 2006
    #2
    1. Advertising

  3. Bob H

    old jon Guest

    "Duane Arnold" <> wrote in message
    news:B34Ff.4920$...
    > Bob H wrote:
    >> Trying to edit the registry to disable TM. Following the

    >

    snipped
    >
    > And what would be your reasoning for disabling Task Manager?
    >

    He doesn`t want to know what`s going on in his machine <G>.
    >
    > Duane :)
     
    old jon, Feb 4, 2006
    #3
  4. Bob H

    Bob H Guest

    What do I need it for for one and I seem to find lots of folks looking
    to disable it. I inhereted a computer that has some 70 items listed in
    TM. I am a single computer home user with no networking involved. Does
    having 70 items in TM slow my computer down?
     
    Bob H, Feb 4, 2006
    #4
  5. Bob H

    p-nut Guest

    Bob H wrote:
    > What do I need it for for one and I seem to find lots of folks looking
    > to disable it. I inhereted a computer that has some 70 items listed in
    > TM. I am a single computer home user with no networking involved. Does
    > having 70 items in TM slow my computer down?


    Yes, very much so, 35-50 would be normal.
    Disabling TM isn't going to help anything though as all 70 of those
    processes would still be running, you just couldn't get to TM to see what
    all is running.

    Can't say I've ever heard of anyone wanting to disable TM before your post.
     
    p-nut, Feb 4, 2006
    #5
  6. Bob H

    Toolman Tim Guest

    In news:zn4Ff.89472$,
    p-nut spewed forth:
    > Bob H wrote:
    >> What do I need it for for one and I seem to find lots of folks
    >> looking to disable it. I inhereted a computer that has some 70 items
    >> listed in TM. I am a single computer home user with no networking
    >> involved. Does having 70 items in TM slow my computer down?

    >
    > Yes, very much so, 35-50 would be normal.
    > Disabling TM isn't going to help anything though as all 70 of those
    > processes would still be running, you just couldn't get to TM to see
    > what all is running.
    >
    > Can't say I've ever heard of anyone wanting to disable TM before your
    > post.


    It's called 'hijackers' and 'malware programmers'. I've had systems come to
    me for work that didn't display TM or control panel or anything - the
    crapware on it had fracked the system to prevent access to the tools needed
    to remove it.

    --
    If at first you don't succeed, redefine success.
     
    Toolman Tim, Feb 4, 2006
    #6
  7. Bob H

    Bob H Guest

    OK fair enough - let me rephrase the question. Of the 70 that are
    running how do I find some guidance as to what I can disable to get
    down to 30 to 50?
     
    Bob H, Feb 4, 2006
    #7
  8. Bob H

    old jon Guest

    "Bob H" <> wrote in message
    news:...
    > OK fair enough - let me rephrase the question. Of the 70 that are
    > running how do I find some guidance as to what I can disable to get
    > down to 30 to 50?
    >

    OK Bob. Go here
    www.majorgeeks.com/page.php?id=12

    and download, and print out `Black Vipers` list of services, that are `safe`
    to disable.
    This list applies to most average users.

    --
    bw..OJ
     
    old jon, Feb 4, 2006
    #8
  9. Bob H

    Duane Arnold Guest

    Bob H wrote:
    > What do I need it for for one and I seem to find lots of folks looking
    > to disable it. I inhereted a computer that has some 70 items listed in
    > TM. I am a single computer home user with no networking involved. Does
    > having 70 items in TM slow my computer down?
    >


    Task Manager is just a graphical user interface that shows you what is
    running on the machine. It in no way is slowing the machine down as it
    only runs when you request it to run. If you have not requested that it
    run by showing you the screens of what is running, then how can Task
    Manager be slowing down the machine if it's not running all the time as
    the 70 items or processes you're looking at are running?

    The problem is those 70 processes that are running with one or more
    processes slowing the machine down and not Task Manager itself.

    Duane :)
     
    Duane Arnold, Feb 4, 2006
    #9
  10. Bob H

    NC Guest

    "Bob H" <> wrote:

    >Trying to edit the registry to disable TM. Following the
    >HKEY_CURRENT_USER there is no System listed under Policies. The process
    >I'm following as follows:
    >
    >There is a registry hack to enable or disable Windows NT TaskManager.
    >The same registry hack applies to Windows 2000 and Windows XP.
    >
    >Hive: HKEY_CURRENT_USER
    >Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
    >Name: DisableTaskMgr
    >Type: REG_DWORD
    >Value: 1=Enablethis key, that is DISABLE TaskManager
    >Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager
    >
    >Reply



    Inelegant without the PDF format.
    Someone had their website stolen out from under them.

    NC
    (Doesn't mean people forget.)


    ___________________________
    BlackViper's PDF sent to text follows.
    ___________________________

    Windows XP Home and Professional Service Configurations


    Original content created July 28, 2001
    Last update was Sunday, August 31, 2003


    Copyright © 2001-2003 by Black Viper
    All Rights Reserved.


    All trademarks mentioned in this document are property of their
    respective owners.

    Up to date content and contact information is located at
    http://www.blkviper.com or http://www.blackviper.com

    Table of contents:
    This Page: Page 1
    Notes for a Happier Computer and User: Page 2
    Table Header Information: Page 3
    Services Configuration Table: Pages 4-12
    Services Information: Pages 13-58
    Strange Processes Pages 59-64

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 1 Revision 5: Sunday, August 31, 2003


    Notes for a Happier Computer and User:


    Do NOT use “msconfig” to disable services, type “services.msc” in the
    Run box
    instead!

    Before disabling any service, check out the information about each
    starting on Page 13 of
    this document.

    Service settings are global, meaning changes apply to all users.

    All of these services are “Standard” with Windows XP. If you discover
    something other
    than these listed here running, another program installed them. A few of
    the more
    common processes are listed starting on page 41.

    Still unsure? Put your setting to “manual” or the listing under “Safe.”
    Manual allows
    Windows XP to start the service when it needs to (or when ever it feels
    like it), but not at
    boot up. Depending on your configuration, not all services will start
    when required while
    in “Manual” mode. If you find you need a service, place it in Automatic.

    After adjusting your service settings, reboot your computer.

    If you do not have some of these services listed, do not panic! If your
    computer
    manufacture “pre-installed” your XP, they choose not to have certain
    services installed
    for you. This is, in most cases, a fact with OEM versions of Windows XP
    Home.

    If you find this document helpful and you wish to use this information
    (forums, web
    sites), please link to http://www.blkviper.com and do not copy or
    redistribute it. The
    online information is up to date and I do not want anyone posting old
    content.

    Disabling all of the “unneeded services” frees up 12-70 MB of RAM,
    depending on
    system.

    Do you mean that out of 89 services, 36 are set to Automatic as DEFAULT,
    but, we
    MAY only need 8 running?!? YES.
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 2 Revision 5: Sunday, August 31, 2003


    Table Header Information:


    Display Name ~ is how it displays in the Services Control Panel.

    Service Name ~ is what the service’s “short” name is and what displays
    in the registry.

    Process Name ~ name of the Process running in the background (displays
    in Task
    Manager by hitting Ctrl+Alt+Del).

    Dependencies ~ describe what other services this service needs to run.

    Default Home ~ this is what runs by default on Windows XP Home.

    Default Pro ~ this is what runs by default on Windows XP Professional.

    “SAFE” Configuration ~ this is the configuration that 95% of the people
    will be able to
    use with little or no side effects. It will also minimizes the amount of
    “errors” that is
    reported in the Event Viewer. This does NOT guarantee it will work for
    you, but if this
    scares you, this configuration would be a good starting point.

    Internet Gateway Configuration ~ setup to allow multiple computers on a
    network to
    share one access point using Microsoft's “Internet Connection Sharing
    and Personal
    Firewall” software. If you do not have this type of setup, compare the
    differences
    between “SAFE” and “GAMING” to find a middle ground that works for your
    system.
    Other software or hardware type firewall and gateway software may
    require a slightly
    different configuration.

    Gaming Configuration ~ this is the power user setup. This setup is a
    system that
    connects through a network (such as a gateway / router) to the internet,
    provides file and
    print sharing resources and gaming enjoyment. Some things MAY not
    function with this
    setup. No passwords save. Its use is not for a computer with analog
    modems or some
    direct DSL/cable connections. Try “Internet Gateway” Configuration
    first.

    Super Tweak Configuration ~ this is the Super Geek setup. This setup is
    a system that
    connects through a network (such as a gateway / router) to the internet
    with a static IP
    address. This system does not provide file and print sharing resources,
    nor have the
    ability to print. Its use is not for a computer with analog modems or
    many direct
    DSL/cable connections. You can use this configuration for extreme
    tweaking and testing
    purposes. Many things MAY not function with this setup. No passwords
    save. The Event
    Log may display “errors” of not being able to start certain services.
    CDRW functions
    may no longer work. Please do not ask, “How do I fix” questions while
    using this
    configuration. The answer will be “Use SAFE.” This information’s
    intention is for
    reference only. However, I use this configuration on a daily basis.

    Automatic ~ With a service in this state, it will start at boot time.
    Some services, when
    no longer required, will also automatically stop when not needed.
    However, this is very
    rare. If you find you do not need a service, place it into Manual or
    Disabled.

    Manual ~ Manual mode allows Windows to start a service when needed.
    However, very
    few services will start up when required in Manual mode. If you find you
    need a service,
    place it into Automatic.

    Disabled ~ This setting will stop a service from starting, even if
    needed. Errors in the
    Event Viewer will show up complaining of that fact. Some services, while
    Disabled, will
    constantly complain. However, this situation is taken care of if placed
    in Manual. The
    service descriptions identifies those that should be in Manual vice
    Disabled.
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 3 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Alerter Alerter services.exe Workstation Manual Manual Disabled Disabled
    Disabled Disabled
    Application Layer
    Gateway Service ALG Alg.exe None Manual Manual Manual Automatic Disabled
    Disabled
    Application
    Management AppMgmt svchost.exe None Manual Manual Manual Manual Manual
    Manual
    Automatic
    Updates wuauserv svchost.exe None Automatic Automatic Automatic
    Automatic Disabled Disabled
    Background
    Intelligent
    Transfer Service
    BITS svchost.exe
    Remote Procedure
    Call (RPC),
    Workstation
    Manual Manual Disabled Disabled Disabled Disabled
    ClipBook ClipSrv clipsrv.exe Network DDE Manual Manual Disabled Disabled
    Disabled Disabled
    COM+ Event
    System EventSystem svchost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled
    COM+ System
    Application COMSysApp dllhost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled
    Computer
    Browser Browser svchost.exe Server, Workstation Automatic Automatic
    Disabled Automatic Disabled Disabled
    Cryptographic
    Services CryptSvc svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
    DHCP Client Dhcp svchost.exe
    AFD Networking
    Support Environment,
    NetBios over TCP/IP,
    TCP/IP Protocol
    Driver
    Automatic Automatic Automatic Disabled Automatic Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 4 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Distributed Link
    Tracking Client TrkWks svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Manual Manual Disabled Disabled
    Distributed Remote Procedure
    Transaction MSDTC msdtc.exe Call (RPC), Security Manual Manual Manual
    Manual Disabled Disabled
    Coordinator Accounts Manager
    DNS Client Dnscache svchost.exe TCP/IP Protocol
    Driver Automatic Automatic Automatic Automatic Disabled Disabled
    Error Reporting
    Service ERSvc svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
    Event Log Eventlog services.exe None Automatic Automatic Automatic
    Automatic Automatic Automatic
    Fast User
    Switching
    Compatibility
    FastUserSwitching
    Compatibility svchost.exe Terminal Services Manual Manual Manual Manual
    Disabled Disabled
    Fax Service FAX fxssvc.exe
    Plug and Play, Print
    Spooler, Remote
    Procedure Call
    (RPC), Telephony
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    FTP Publishing
    Service NA inetinfo.exe IIS Admin Not
    Available
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Help and Support helpsvc svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
    Human Interface
    Device Access HidServ svchost.exe Remote Procedure
    Call (RPC) Disabled Disabled Disabled Disabled Disabled Disabled
    IIS Admin IISADMIN inetinfo.exe
    Remote Procedure
    Call (RPC), Security
    Accounts Manager
    Not
    Available
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 5 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    IMAPI CD-
    Burning COM
    Service
    ImapiService imapi.exe None Manual Manual Automatic Automatic Disabled
    Disabled
    Indexing Service Cisvc cisvc.exe Remote Procedure
    Call (RPC) Manual Manual Disabled Disabled Disabled Disabled
    Internet
    Connection
    Firewall/Internet
    Connection
    Sharing
    SharedAccess svchost.exe
    Application Layer
    Gateway Service,
    Network
    Connections,
    Network Location
    Awareness, Remote
    Access Connection
    Manager
    Manual Automatic Automatic Automatic Disabled Disabled
    IPSEC Services PolicyAgent lsass.exe
    IPSEC driver,
    Remote Procedure
    Call (RPC), TCP/IP
    Protocol Driver
    Automatic Automatic Disabled Disabled Disabled Disabled
    Logical Disk
    Manager dmserver svchost.exe
    Plug and Play,
    Remote Procedure
    Call (RPC)
    Manual Automatic Manual Manual Disabled Disabled
    Logical Disk
    Manager
    Administrative
    Service
    dmadmin dmadmin.exe
    Logical Disk
    Manager, Plug and
    Play, Remote
    Procedure Call (RPC)
    Manual Manual Manual Manual Disabled Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 6 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Message Queuing NA mqsvc.exe
    Distributed
    Transaction
    Coordinator, Message
    Queuing access
    control, NT LM
    Security Support
    Provider, Reliable
    Multicast Protocol
    driver, Remote
    Procedure Call
    (RPC), Server
    Not
    Available
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Message Queuing
    Triggers NA mqtgsvc.exe Message Queuing Not
    Available
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Messenger Messenger svchost.exe
    NetBIOS Interface,
    Plug and Play,
    Remote Procedure
    Call (RPC),
    Workstation
    Automatic Automatic Disabled Disabled Disabled Disabled
    MS Software
    Shadow Copy
    Provider
    SwPrv dllhost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled
    Net Login Netlogon lsass.exe Workstation Manual Automatic Disabled
    Disabled Disabled Disabled
    NetMeeting
    Remote Desktop
    Sharing
    mnmsrvc mnmsrvc.exe None Manual Manual Disabled Disabled Disabled
    Disabled
    Network
    Connections Netman svchost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Automatic Manual Disabled
    Network DDE NetDDE netdde.exe Network DDE
    DSDM Manual Manual Disabled Disabled Disabled Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 7 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Network DDE
    DSDM NetDDE netdde.exe
    AFD Networking
    Support Enviroment,
    TCP/IP Protocol
    Driver
    Manual Manual Disabled Disabled Disabled Disabled
    Network Location
    Awareness
    (NLA)
    Nla svchost.exe None Manual Manual Manual Automatic Disabled Disabled
    NT LM Security
    Support Provider NtLmSsp lsass.exe None Manual Manual Manual Manual
    Manual Disabled
    Performance
    Logs and Alerts SysmonLog smlogsvc.exe None Manual Manual Disabled
    Disabled Disabled Disabled
    Plug and Play PlugPlay services.exe None Automatic Automatic Automatic
    Automatic Automatic Automatic
    Portable Media
    Serial Number WmdmPmSp svchost.exe None Automatic Automatic Disabled
    Disabled Disabled Disabled
    Print Spooler Spooler spoolsv.exe Remote Procedure
    Call (RPC) Automatic Automatic Automatic Automatic Automatic Disabled
    Protected Storage ProtectedStorage lsass.exe Remote Procedure
    Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
    QoS RSVP RSVP rsvp.exe
    AFD Networking
    Support Environment,
    Remote Procedure
    Call (RPC), TCP/IP
    Protocol Driver
    Manual Manual Disabled Disabled Disabled Disabled
    Remote Access
    Auto Connection
    Manager
    RasAuto svchost.exe
    Remote Access
    Connection Manager,
    Telephony
    Manual Manual Manual Automatic Disabled Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 8 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Remote Access
    Connection RasMan svchost.exe Telephony Manual Manual Manual Automatic
    Disabled Disabled
    Manager
    Remote Desktop
    Help Session
    Manager
    RDSessMgr sessmgr.exe Remote Procedure
    Call (RPC) Manual Manual Disabled Disabled Disabled Disabled
    Remote
    Procedure Call
    (RPC)
    RpcSs svchost.exe None (but everything
    depends on it) Automatic Automatic Automatic Automatic Automatic
    Automatic
    Remote
    Procedure Call RpcLocator locator.exe Workstation Manual Manual Manual
    Manual Manual Disabled
    (RPC) Locator
    Remote Registry
    Service RemoteRegistry svchost.exe None Not
    Available Automatic Disabled Disabled Disabled Disabled
    Removable
    Storage NtmsSvc svchost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled
    RIP Listener NA svchost.exe Remote Procedure
    Call (RPC)
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Routing and
    Remote Access RemoteAccess svchost.exe
    NetBIOSGroup,
    Remote Procedure
    Call (RPC)
    Disabled Manual Disabled Disabled Disabled Disabled
    Secondary Logon seclogon svchost.exe None Automatic Automatic Disabled
    Disabled Disabled Disabled
    Security
    Accounts
    Manager
    SamSs lsass.exe Remote Procedure
    Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
    Server lanmanserver svchost.exe None Automatic Automatic Disabled
    Automatic Disabled Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 9 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Shell Hardware
    Detection ShellHWDetection svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
    Simple Mail
    Transport
    Protocol (SMTP)
    SMTPSVC inetinfo.exe Event Log, IIS
    Admin
    Not
    Available
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Simple TCP/IP
    Services NA tcpsvcs.exe AFD Networking
    Support Environment
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Smart Card SCardSvr SCardSvr.exe Plug and Play Manual Manual Disabled
    Disabled Disabled Disabled
    Smart Card
    Helper SCardDrv SCardSvr.exe None Manual Manual Disabled Disabled
    Disabled Disabled
    SNMP Service NA snmp.exe Event Log Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    SNMP Trap
    Service NA snmptrap.exe Event Log Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    SSDP Discovery
    Service SSDPSRV svchost.exe None Manual Manual Disabled Disabled
    Disabled Disabled
    System Event
    Notification SENS svchost.exe COM+ Event System Automatic Automatic
    Automatic Automatic Disabled Disabled
    System Restore
    Service srservice svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
    Task Scheduler Schedule svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Automatic Automatic Disabled Disabled
    TCP/IP NetBIOS
    Helper Service LmHosts svchost.exe
    AFD Networking
    Support Environment,
    NetBios over TCP/IP
    Automatic Automatic Disabled Disabled Disabled Disabled
    TCP/IP Printer
    Server LPDSVC tcpsvcs.exe Print Spooler, TCP/IP
    Protocol Driver
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 10 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Telephony TapiSrv svchost.exe
    Plug and Play,
    Remote Procedure
    Call (RPC)
    Manual Manual Manual Automatic Disabled Disabled
    Telnet TlntSvr tlntsvr.exe
    NT LM Security
    Support Provider,
    Remote Procedure
    Call (RPC), TCP/IP
    Protocol Driver
    Not
    Available Manual Disabled Disabled Disabled Disabled
    Terminal Services TermService svchost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled
    Themes Themes svchost.exe None Automatic Automatic Automatic Automatic
    Disabled Disabled
    Uninterruptible
    Power Supply UPS ups.exe None Manual Manual Disabled Disabled Disabled
    Disabled
    Universal Plug
    and Play Device
    Host
    UPNPhost svchost.exe SSDP Discovery
    Service Manual Manual Disabled Disabled Disabled Disabled
    Upload Manager uploadmgr svchost.exe Remote Procedure
    Call (RPC) Automatic Automatic Disabled Disabled Disabled Disabled
    Volume Shadow
    Copy VSS vssvc.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled
    WebClient WebClient svchost.exe WebDav Client
    Redirector Automatic Automatic Disabled Disabled Disabled Disabled
    Windows Audio AudioSrv svchost.exe
    Plug and Play,
    Remote Procedure
    Call (RPC)
    Automatic Automatic Automatic Automatic Automatic Automatic
    Windows Image
    Acquisition
    (WIA)
    Stisvc svchost.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Disabled Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 11 Revision 5: Sunday, August 31, 2003


    Display Name Service Name Process
    Name Dependencies Default
    Home
    Default
    Pro “SAFE” Internet
    Gateway Gaming Super
    Tweak
    Windows
    Installer MSIServer msiexec.exe Remote Procedure
    Call (RPC) Manual Manual Manual Manual Manual Manual
    Windows
    Management
    Instrumentation
    Winmgmt svchost.exe Event Log, Remote
    Procedure Call (RPC) Automatic Automatic Automatic Automatic Automatic
    Automatic
    Windows
    Management
    Instrumentation
    Driver Extension
    Wmi svchost.exe None Not
    Available Manual Manual Manual Manual Disabled
    Windows Time W32Time svchost.exe None Automatic Automatic Disabled
    Disabled Disabled Disabled
    Wireless Zero
    Configuration WZCSVC svchost.exe
    NDIS Usermode I/O
    Protocol, Remote
    Procedure Call (RPC)
    Automatic Automatic Disabled Disabled Disabled Disabled
    WMI
    Performance
    Adapter
    WmiApSrv wmiapsrv.exe Remote Procedure
    Call (RPC) Manual Manual Disabled Disabled Disabled Disabled
    Workstation lanmanworkstation svchost.exe None (but plenty
    depend on it) Automatic Automatic Automatic Automatic Automatic
    Automatic
    World Wide Web
    Publishing
    Service
    W3SVC inetinfo.exe IIS Admin Not
    Available
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed
    Not
    Installed

    Up to date content and contact information is located at
    http://www.blkviper.com or http://www.blackviper.com

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 12 Revision 5: Sunday, August 31, 2003


    Black Viper’s Windows XP Home and Professional
    Services 411


    Original content created July 28, 2001
    Last update was Sunday, August 31, 2003


    Copyright © 2001-2003 by Black Viper
    All Rights Reserved.


    Up to date content and contact information is located at
    www.blkviper.com or www.blackviper.com.


    Alerter

    The Alerter service notifies users of administrative alerts on a
    network. This service usually is
    not required under normal circumstances. Note: This is NOT “WinPopUp.”

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service Alerter needs to function properly:


    Workstation
    What other service require Alerter to function properly:


    None
    Application Layer Gateway Service

    Provides support for 3rd party plug-ins for Internet Connection
    Sharing/Internet Connection
    Firewall. This service is required if using Internet Connection Sharing
    / Internet Connection
    Firewall to connect to the internet. This service uses about 1.5 MB of
    memory in an idle state.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: NT AUTHORITY\LocalService

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 13 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What service Application Layer Gateway Service needs to function
    properly:


    None
    What other service require Application Layer Gateway Service to function
    properly:


    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
    Application Management

    Used for Assign, Publish and Remove software services. If you cannot
    modify your software
    installation of certain applications, put this service in to Automatic
    or Manual. If you have
    Windows XP Home Version, this service may be causing problems described
    in this knowledge
    base article:

    http://support.microsoft.com/default.aspx?scid=kb;en-us;Q328213?SD=EE

    I have not tested this, but for now, Disable this service in Windows XP
    Home until installation of
    Service Pack 1.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service Application Management needs to function properly:


    None
    What other service require Application Management to function properly:


    None
    Automatic Updates

    This service is used to check up to see if there is any critical or
    otherwise updates available for
    download. You may choose to update manually due to the very long lag
    time from when an
    update is available and when Windows XP reports it. After the
    installation of Service Pack 1,
    you may configure how “often” updates are checked. Using default values,
    Windows XP
    “automatically” downloads the updates and asks to “install” them. A few
    reasons why you may
    think this is unacceptable in your situation:


    You could have a dial-up connection. If XP feels like downloading
    whenever it wants, it
    just may not allow you to do what “you” want.

    You may also: Wish to know what, when and how an update installs BEFORE
    using any
    bandwidth.

    Want to read about the update BEFORE downloading.
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 14 Revision 5: Sunday, August 31, 2003



    Want to know WHY you need it and WHAT it fixes.
    It is very important that if you decide to disable this service, you
    check the Windows
    Update site often to ensure the latest patches install properly.

    Take note: Manual (and Automatic) updates via Windows Update web site
    requires
    Cryptographic Services to be running. Place both Automatic Updates and
    Cryptographic
    Services in to automatic if you do not wish to update manually.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What service Automatic Updates needs to function properly:


    None
    What other service require Automatic Updates to function properly:


    None
    Background Intelligent Transfer Service

    This service is used to transfer asynchronous data via http1.1 servers.
    According to Microsoft's
    site, Windows Update uses this “feature.” It “continues” a download if
    you log off or shutdown
    the system (that is, when you log back in). The problem with that is, I
    do not like having this
    “feature” running all of the time. Even though I have found no side
    effects as to this being
    disabled, you may require this service for some MSN Explorer, Windows
    Messenger, Windows
    Media Player or future .NET functions. Take note: Manual update via
    Windows Update web site
    requires Cryptographic Services to be running.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What services Background Intelligent Transfer Service needs to function
    properly:


    Remote Procedure Call (RPC)

    Workstation
    What other service require Background Intelligent Transfer Service to
    function properly:


    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 15 Revision 5: Sunday, August 31, 2003


    ClipBook

    Used to store information (cut / paste) and share it with other
    computers. I have never found
    enough need for this to allow this service to always be running. This
    service alone uses about 1.3
    MB of memory.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What services ClipBook needs to function properly:


    Network DDE
    o
    Network DDE DSDM
    What other service require ClipBook to function properly:


    None
    COM+ Event System

    You will receive, in the Event Log, an entry from “DCOM” complaining
    about not having this
    service running if disabled. I am unaware of any application that uses
    COM+, but if set to
    manual, many services report to it, so it will start anyway. This
    service is required for System
    Event Notification. For the fun of it:

    “C:\Program Files\ComPlus Applications\”

    On your system, see if you have any installed “COM+” Applications. If
    not, you can probably
    disable this service with no side effects (besides the Event Log
    complaining upon reboots). Take
    note: BootVis requires Task Scheduler and COM+ Event System to be
    running if you wish to
    take advantage of the “optimize system” function. Why is it required? It
    is due to the pre-
    fetching function built into Windows XP. Another Note: Pre-fetching only
    occurs on boot up and
    application start, so if you do not care about a few extra seconds of
    boot time, you may decide to
    not even bother with it and disable Task Scheduler. Depending on the
    system, pre-fetching may
    increase performance. Windows Media Player may also require this service
    for some “features”
    to function. MS' .NET may require this service in the future. I
    recommend disabled for Super
    Tweaking, automatic for “safe,” and manual for most other
    configurations.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 16 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What service COM+ Event System needs to function properly:


    Remote Procedure Call (RPC)
    What other service require COM+ Event System to function properly:


    System Event Notification
    COM+ System Application

    You will receive, in the Event Log, an entry from “DCOM” complaining
    about not having this
    service running if disabled. I am unaware of any application that uses
    COM+, but if set to
    manual, many services report to it, so it will start anyway. For the fun
    of it:

    “C:\Program Files\ComPlus Applications”

    On your system, see if you have any installed “COM+” Applications. If
    not, you can probably
    disable this service with no side effects (besides the Event Log
    complaining upon reboots). This
    service is required for System Event Notification.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service COM+ System Application needs to function properly:


    Remote Procedure Call (RPC)
    What other service require COM+ System Application to function properly:

    None
    Computer Browser

    Computer Browser service maintains a listing of computers and resources
    located on the
    network. This service is not required on a standalone system. In fact,
    even if you want to browse
    the network (workgroup or domain) or have mapped network shares as local
    hard drives, you can
    still do so. On a large network, one computer is designated the “master”
    browser and another one
    is the “backup” browser. All others just announce they are available
    every 12 minutes to “take
    over” duties if one of the other computers fail. No lag time is
    discernable if this service remains
    disabled on all but one computer. Honestly, I do not even believe one
    needs to be running. You
    could, “just in case,” but it sure does not need to be running on all
    computers, all of the time.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 17 Revision 5: Sunday, August 31, 2003


    Log on as: Local System account

    Dependencies:

    What services Computer Browser needs to function properly:


    Server

    Workstation
    What other service require Computer Browser to function properly:


    None
    Cryptographic Services

    Mainly, it confirms signatures of Windows files. You may always get a
    dialog box complaining
    about uncertified drivers if this is disabled. This service is required
    for Windows Update to
    function in manual and automatic mode and this service is required to
    install Service Pack 1
    unified updates and DirectX 9.0. Windows Media Player and future .NET
    applications may also
    require this service for some “features” to function. This service uses
    about 1.9 MB of memory.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Dependencies:

    What service Cryptographic Services needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Cryptographic Services to function properly:


    None
    DHCP Client

    This service automatically receives a Dynamic IP address from your DHCP
    server and DNS
    updates. Required for ICS / internet client and if you run IPSEC,
    disable on a standalone system
    or one that has a static IP address. Take note: Most DSL/cable ISP's use
    DHCP to provide
    internet access. If you disable this service and your Internet
    connection no longer works, place
    this back into automatic. Most DSL and cable hardware routers have the
    option of enabling a
    DHCP server for the internal network. Ensure that the router is
    configured the same as your local
    PC's.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 18 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What services DHCP Client needs to function properly:


    AFD Networking Support Environment

    NetBIOS over TCP/IP
    o
    TCP/IP Protocol Driver
    °
    IPSEC driver

    TCP/IP Protocol Driver
    o
    IPSEC driver
    What other service require DHCP Client to function properly:


    None
    Distributed Link Tracking Client

    Maintains links with NTFS files within your computer or across a domain.
    For example, you
    could make a file on “Computer A.” You then create a “short cut” or
    “link” to that file on
    “Computer B.” If you would move the file on Computer A to a different
    location, this service
    would tell Computer B to update its information to allow uninterrupted
    connectivity. Even
    though this is rather valuable on a large network, I have not found a
    use for this service on a
    home network. It uses about 3.5 MB to 4 MB in an idle state.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service Distributed Link Tracking Client needs to function
    properly:


    Remote Procedure Call (RPC)
    What other service require Distributed Link Tracking Client to function
    properly:


    None
    Distributed Transaction Coordinator

    Automatically takes care of transactions that span multiple resources.
    This service is required if
    using Message Queuing. You may also see complaints in the Event Log if
    this service is
    disabled, but I have experienced no side effects. Microsoft's .NET may
    require this service in the
    future.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 19 Revision 5: Sunday, August 31, 2003


    Log on as: NT AUTHORITY\NetworkService

    Dependencies:

    What services Distributed Transaction Coordinator needs to function
    properly:


    Remote Procedure Call (RPC)

    Security Accounts Manager
    o
    Remote Procedure Call (RPC)
    What other services require Distributed Transaction Coordinator to
    function properly:


    Message Queuing
    o
    Message Queuing Triggers
    DNS Client

    Resolves and caches DNS names and Active Directory domain controller
    functions. This service
    is not required for DNS lookups, but if it makes you happy to have it
    running, you may.
    However, DNS Client is required if using IPSEC. If you attempt to
    “repair” your network
    connection and a dialog box complains that the “DNS resolver failed to
    flush the cache,” this
    service is the reason.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: NT AUTHORITY\NetworkService

    Dependencies:

    What service DNS Client needs to function properly:


    TCP/IP Protocol Driver
    o
    IPSEC driver
    What other service require DNS Client to function properly:


    None
    Error Reporting Service

    Calls home to Microsoft when application errors occur. I personally do
    not like this. I feel it is a
    waste of memory and resources. On the other hand, if you are
    experiencing system crashes often,
    the best way to deal with them is to report them using this tool.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 20 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What service Error Reporting Service needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Error Reporting Service to function properly:

    None
    Event Log

    View Event Log messages from applications in Event Viewer. Always
    helpful to check out the
    Event Log to see what problems with applications are popping up that is
    “hidden” from the
    normal user. To see quickly what, if anything has resulted in your
    adjustments, you may consider
    clearing the Event Log. Windows Management Instrumentation also requires
    Event Log Service
    to be running. If you disable the Event Log Service, but do not disable
    Windows Management
    Instrumentation, your computer may have an extended boot time while
    Windows Management
    Instrumentation is waiting for the Event Log to start. It is just best
    to keep Event Log active for
    troubleshooting purposes and normal operations.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What service Event Log needs to function properly:


    None
    What other services require Event Log to function properly:


    Simple Mail Transfer Protocol (SMTP)

    SNMP Service

    SNMP Trap Service

    Windows Management Instrumentation
    Fast User Switching Compatibility

    Unless you have many users on a system, you probably do not even need
    this service to be
    running. You could benefit, however, greatly if you use this service in
    conjunction with many
    users on your local computer to allow switching users without closing
    all existing applications
    running under a different account.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 21 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What services Fast User Switching Compatibility needs to function
    properly:


    Terminal Services
    o
    Remote Procedure Call (RPC)
    What other service require Fast User Switching Compatibility to function
    properly:


    None
    Fax Service

    Not installed by default, but if needed, you may install it later off
    the Windows XP CD.
    Maintains the ability to send and receive FAX documents on your
    computer.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    Dependencies:

    What services Fax Service needs to function properly:


    Plug and Play

    Print Spooler
    o
    Remote Procedure Call (RPC)

    Remote Procedure Call (RPC)

    Telephony
    o
    Plug and Play
    o
    Remote Procedure Call (RPC)
    What other service require Fax Service to function properly:


    None
    FTP Publishing Service

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if you need it, you may install it later off the Windows XP CD. This
    service provides a FTP
    server on your network.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 22 Revision 5: Sunday, August 31, 2003


    Dependencies:
    What services FTP Publishing Service needs to function properly:



    IIS Admin
    o
    Remote Procedure Call (RPC)
    o
    Security Accounts Manager
    °
    Remote Procedure Call (RPC)
    What other service require FTP Publishing Service to function properly:


    None
    Help and Support

    This service is required for Microsoft’s online (or offline) help
    documents. If you ever “attempt”
    to use Help and Support, the service places itself back into “Automatic”
    and starts even if you
    already had this service on disabled. I try to avoid as much Microsoft
    help as I can… :)

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service Help and Support needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Help and Support to function properly:

    None
    Human Interface Device Access

    You may not have any peripherals that require this service. If one of
    yours magically does not
    function anymore, set it to automatic. Namely, scanners with function
    buttons (fax, copy) or even
    an “Internet” keyboard with volume or play controls.

    Default XP Home: Disabled
    Default XP Pro: Disabled
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service Human Interface Device Access needs to function properly:


    Remote Procedure Call (RPC)
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 23 Revision 5: Sunday, August 31, 2003


    What other service require Human Interface Device Access to function
    properly:


    None
    IIS Admin

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if needed, you may install it later off the Windows XP CD. This
    service usually operates in
    conjunction with a local web site or FTP server. Leave it uninstalled
    mainly because IIS has been
    “popular” for crackers to break.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    Dependencies:

    What services IIS Admin needs to function properly:


    Remote Procedure Call (RPC)

    Security Accounts Manager
    o
    Remote Procedure Call (RPC)
    What other services require IIS Admin to function properly:


    FTP Publishing Service

    Simple Mail Transport Protocol (SMTP)

    World Wide Web Publishing Service
    IMAPI CD-Burning COM Service

    This service operates that cool “drag and drop” CD burn capability. You
    will need this service to
    burn CD's. What is the good news? If you set this service to manual, the
    service starts and stops
    itself when used with some software packages. This is practically the
    only service that does do
    this! If you still cannot burn a CD with it on manual, switch to
    automatic and feel safe that it
    starts only when “needed.” This service may take up about 1.6 MB of
    memory in an idle state.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What service IMAPI CD-Burning COM Service needs to function properly:


    None
    What other service require IMAPI CD-Burning COM Service to function
    properly:


    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 24 Revision 5: Sunday, August 31, 2003


    Indexing Service

    This service always has been a major resource hog. I NEVER recommend
    having this service
    enabled. Remove the function via the “Add / Remove Programs” icon in the
    control panel
    (Windows Setup Programs). It uses about 500 K to 2 MB in an idle state,
    not to mention the
    amount of memory and CPU resources it takes to INDEX the drives. I have
    had people (and
    witnessed it on other people's computers) report to me that the Indexing
    Service sometimes starts
    up EVEN while the system is NOT idle… as in the middle of a game. You
    may feel, as I do, that
    this is unacceptable. If your computer suddenly seems “sluggish,”
    Indexing Service is usually the
    cause of it.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service Indexing Service needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Indexing Service to function properly:


    None
    Internet Connection Firewall and Internet Connection Sharing

    This service is used to allow multiple computers on your network to
    access the internet via only
    one account. This service installs on the “modem” computer. If you are
    using a third party
    firewall or Internet Connection Sharing software package, this service
    is not required.

    Default XP Home: Manual
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What services Internet Connection Firewall (ICF) and Internet Connection
    Sharing (ICS) needs
    to function properly:


    Application Layer Gateway Service

    Network Connections
    o
    Remote Procedure Call (RPC)

    Network Location Awareness (NLA)
    o
    AFD Networking Support Environment
    o
    NetBIOS over TCP/IP
    °
    TCP/IP Protocol Driver

    IPSEC driver
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 25 Revision 5: Sunday, August 31, 2003



    Remote Access Connection Manager
    o
    Telephony
    °
    Plug and Play
    °
    Remote Procedure Call (RPC)
    What other service require Internet Connection Firewall (ICF) and
    Internet Connection Sharing
    (ICS) to function properly:


    None
    IPSEC Services

    May be required on some domains or VPN connections, but the “average”
    user will not need
    this.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What services IPSEC Services needs to function properly:


    IPSEC driver

    Remote Procedure Call (RPC)

    TCP/IP Protocol Driver
    o
    IPSEC driver
    What other service require IPSEC Services to function properly:


    None
    Logical Disk Manager

    This service is vital to run the Disk Management MMC console for dynamic
    volumes. If you
    attempt to “Manage” your hard drives and a dialog box pops up
    complaining about not being
    able to do this, start this service.

    Default XP Home: Manual
    Default XP Pro: Automatic
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What services Logical Disk Manager needs to function properly:


    Plug and Play

    Remote Procedure Call (RPC)
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 26 Revision 5: Sunday, August 31, 2003


    What other service require Logical Disk Manager to function properly:


    Logical Disk Manager Administrative Service
    Logical Disk Manager Administrative Service

    This service is vital to run the Disk Management MMC console for dynamic
    volumes.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What services Logical Disk Manager Administrative Service needs to
    function properly:


    Logical Disk Manager
    o
    Plug and Play
    o
    Remote Procedure Call (RPC)

    Plug and Play

    Remote Procedure Call (RPC)
    What other service require Logical Disk Manager Administrative Service
    to function properly:


    None
    Message Queuing

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if needed, you may install it later off of the Windows XP CD. May be
    used on some
    domains, but the “average” home user will never need this service.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    Dependencies:

    What services Message Queuing needs to function properly:


    Distributed Transaction Coordinator
    o
    Remote Procedure Call (RPC)
    o
    Security Accounts Manager
    °
    Remote Procedure Call (RPC)

    Message Queuing access control

    NT LM Security Support Provider

    Reliable Multicast Protocol driver

    Protected Storage
    o
    Remote Procedure Call (RPC)
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 27 Revision 5: Sunday, August 31, 2003



    Remote Procedure Call (RPC)

    Server
    What other service require Message Queuing to function properly:


    Message Queuing Triggers
    Message Queuing Triggers

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if needed, you may install it later off the Windows XP CD. This
    service is required if you use
    Message Queuing service.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    What services Message Queuing Triggers needs to function properly:


    Message Queuing
    o
    Distributed Transaction Coordinator
    °
    Remote Procedure Call (RPC)
    °
    Security Accounts Manager

    Remote Procedure Call (RPC)
    o
    Message Queuing access control
    o
    NT LM Security Support Provider
    o
    Reliable Multicast Protocol driver
    o
    Protected Storage
    °
    Remote Procedure Call (RPC)
    o
    Remote Procedure Call (RPC)
    o
    Server
    What other service require Message Queuing Triggers to function
    properly:


    None
    Messenger

    This service provides the ability to send messages between clients and
    servers. This service
    needs not to be running under normal “home” conditions. It is also
    advisable to make this service
    go away to avoid the possibility of “net send” messages hitting your
    computer from the internet.
    This has nothing to do with MSN Messenger, nor is it “WinPopUp.”

    To test for this security vulnerability, at the command prompt, (run:
    cmd.exe) type:

    net send 127.0.0.1 hi

    If you get a popup “hi” message, you should disable the Messenger
    service.
    If you get an error stating, “The message alias could not be found on
    the network,” you are safe.


    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 28 Revision 5: Sunday, August 31, 2003


    If, for whatever reason, you need the Messenger service running but wish
    not to have spam
    popups active, you can disable the particular ports at your firewall.
    The Messenger service uses
    UDP ports 135, 137, and 138; TCP ports 135, 139, and 445.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What services Messenger needs to function properly:


    NetBIOS Interface

    Plug and Play

    Remote Procedure Call (RPC)

    Workstation
    What other service require Messenger to function properly:

    None
    MS Software Shadow Copy Provider

    Used in conjunction with the Volume Shadow Copy service, Microsoft
    Backup uses these
    services. You will receive, in the Event Log, an entry complaining about
    not having this service
    running if disabled. I have yet to find a side effect, though, but to
    avoid the messages; you can
    place the service in manual. Some third party hard disk “ghost” or
    “imaging” software may
    require this service to be running.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service MS Software Shadow Copy Provider needs to function
    properly:


    Remote Procedure Call (RPC)
    What other service require MS Software Shadow Copy Provider to function
    properly:

    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 29 Revision 5: Sunday, August 31, 2003


    Net Login

    Used for logging onto a Domain Controller. This service is not required
    on a standalone system,
    or for a “home” network.

    Default XP Home: Manual
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Dependencies:

    What service Net Logon needs to function properly:


    Workstation
    What other service require Net Logon to function properly:


    None
    NetMeeting Remote Desktop Sharing

    Enables a user to access your computer using NetMeeting. This may create
    a BIG open door for
    the unwanted. If you are paranoid about security, disable this function.
    Even if you were not
    worried, I would still get rid of it.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account (with permission to interact with
    desktop)

    Dependencies:

    What service NetMeeting Remote Desktop Sharing needs to function
    properly:


    None
    What other service require NetMeeting Remote Desktop Sharing to function
    properly:


    None
    Network Connections

    Required for managing network connectivity. Set to disabled if you have
    no network or you do
    not toy with the configurations a lot. If your internet connectivity no
    longer operates after
    disabling this function, set it back to Automatic! Note: While disabling
    this service, you will no
    longer see the system tray icon (lower right) displayed, even for modem
    connections.
    Connectivity, however, still exists even on incoming shared network
    drives.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 30 Revision 5: Sunday, August 31, 2003


    Log on as: Local System account (with permission to interact with
    desktop)
    Dependencies:
    What service Network Connections needs to function properly:



    Remote Procedure Call (RPC)
    What other service require Network Connections to function properly:

    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
    Network DDE

    I have not found a good use for this service. Unless you use remote
    ClipBook, disable it. This

    uses about 1.5 MB idle.
    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account
    Dependencies:
    What service Network DDE needs to function properly:



    Network DDE DSDM
    What other service require Network DDE to function properly:

    ClipBook
    Network DDE DSDM

    I have not found a good use for this service. Unless you use remote
    ClipBook, disable it.
    Default XP Home: Manual

    Default XP Pro: Manual
    Safe Setting: Disabled
    Log on as: Local System account
    Dependencies:
    What service Network DDE DSDM needs to function properly:


    None
    What other services require Network DDE DSDM to function properly:

    Network DDE
    o
    ClipBook
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 31 Revision 5: Sunday, August 31, 2003


    Network Location Awareness (NLA)

    This service is required for use with the Internet Connection Sharing
    service (server only).
    Default XP Home: Manual

    Default XP Pro: Manual
    Safe Setting: Manual
    Log on as: Local System account
    Dependencies:
    What services Network Location Awareness (NLA) needs to function
    properly:


    AFD Networking Support Environment

    NetBIOS over TCP/IP
    o
    TCP/IP Protocol Driver
    °
    IPSEC driver
    What other service require Network Location Awareness (NLA) to function
    properly:


    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
    NT LM Security Support Provider

    Manages local system security information on the computer. You need this
    service if you are

    running Message Queuing or Telnet server.
    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service NT LM Security Support Provider needs to function properly:

    None
    What other services require NT LM Security Support Provider to function
    properly:

    Message Queuing
    o
    Message Queuing Triggers

    Telnet
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 32 Revision 5: Sunday, August 31, 2003


    Performance Logs and Alerts

    Collect performance data on a schedule and send the information to a log
    or trigger an alert. This
    may be a super geek tool, but I feel that the overhead associated with
    it is not worth the benefit.
    You decide.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\NetworkService

    Dependencies:

    What service Performance Logs and Alerts needs to function properly:


    None
    What other service require Performance Logs and Alerts to function
    properly:


    None
    Plug and Play

    This service is the heart and soul of the Plug and Play environment. I
    do not recommend
    disabling this service, but if you want to, you are on your own. Take
    note: UPnP is NOT PnP.
    UPnP is for connectivity on networks via TCP/IP to devices, such as
    scanners or printers. Your
    sound card is PnP. Do NOT disable Plug and Play service.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What service Plug and Play needs to function properly:


    None
    What other services require Plug and Play to function properly:


    Fax Service

    Logical Disk Manager
    o
    Logical Disk Manager Administrative Service

    Logical Disk Manager Administrative Service

    Messenger

    Smart Card

    Telephony
    o
    Fax Service
    o
    Remote Access Auto Connection Manager
    o
    Remote Access Connection Manager
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 33 Revision 5: Sunday, August 31, 2003


    °
    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
    °
    Remote Access Auto Connection Manager


    Windows Audio
    Portable Media Serial Number

    Retrieves serial numbers from portable music players connected to your
    computer. I have not
    really found a good reason to keep this service always running. I am not
    aware of anything that
    actually requires it. Disable it unless something of yours ceases to
    function properly, such as
    Windows Media Player, Microsoft's integration with “Digital Rights
    Management” and copy
    protection.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service Portable Media Serial Number needs to function properly:


    None
    What other service require Portable Media Serial Number to function
    properly:


    None
    Print Spooler

    Queues up print jobs for later printing. This service is required if you
    have printers, even if they
    are network printers. If this does not fit your needs, disable it. You
    will save about 3.8 MB by
    making this service go away. Your printers will still be “installed” if
    you disable this service, but
    not visible in the printers folder. After restarting Print Spooler, they
    will reappear and be
    available for use. I place this service into manual mode and only start
    it up when printing is
    required. In manual mode, the service will not automatically start at
    boot time.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account (with permission to interact with
    desktop)

    Dependencies:

    What service Print Spooler needs to function properly:


    Remote Procedure Call (RPC)
    What other services require Print Spooler to function properly:


    Fax Service

    TCP/IP Printer Server
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 34 Revision 5: Sunday, August 31, 2003


    Protected Storage

    Allows for the saving of local passwords or even web sites information
    (AutoComplete). This
    service is set to Automatic by default. Due to security reasons, I
    recommend leaving this
    “feature” disabled to make things all that much more difficult to steal
    vital information if you do
    not “save” it. On the other hand, you may need this service to manage
    private keys for
    encryption purposes. If so, leave this service on automatic to ensure
    the “higher” security settings
    you choose work. If you disable this service, you will no longer have
    any of your passwords
    saved, no matter how many times you click the box. If you enjoy having
    your passwords saved
    in applications like Outlook or Dial up networking or you are connecting
    to the internet via a
    domain controller/server that requires authentication, set this service
    to Automatic.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account (with permission to interact with
    desktop)

    Dependencies:

    What service Protected Storage needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Protected Storage to function properly:


    None
    QoS RSVP

    Provides traffic control on a network using IPSEC and applications that
    support QoS, and have
    an adapter that supports it. The QoS Packet Driver installs by default
    on any TCP/IP
    connections. I recommend uninstalling it if it is not needed on your
    network. As far as I can tell,
    you also need an ACS Server (Provided with Windows 2000 Server and
    Advanced Server) for
    the QoS Packet Scheduler and Applications to request the needed
    bandwidth. Since my network
    is not straining under any load, this is rather pointless. You may
    require this service to be placed
    on Automatic if you use Windows Media Player or NetMeeting. Take note:
    Some people (as I
    did before I completed extensive research on this) reported that QoS
    uses 20% of your
    bandwidth and does not allow any activity, regardless. This is false.
    For more information, please
    view this KB article from Microsoft (I normally do not post links to
    them, but this warrants it):

    http://support.microsoft.com/default.aspx?scid=kb;EN-US;q316666

    Regardless, if you uninstall the packet scheduler, no “bandwidth” is
    still reserved.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 35 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What services QoS RSVP needs to function properly:


    AFD Networking Support Environment

    Remote Procedure Call (RPC)

    NetBIOS over TCP/IP
    o
    TCP/IP Protocol Driver
    °
    IPSEC driver
    What other service require QoS RSVP to function properly:


    None
    Remote Access Auto Connection Manager

    Creates a connection to a network when a program requests a remote
    address. This service may
    be required for your internet connection. If things cease to function
    after disabling this service,
    put it to automatic. Note: you may require this service for some direct
    cable or DSL providers
    and connections, depending on how they implement their logon process. If
    your Dial-up, cable or
    DSL internet access no longer functions properly with this service
    disabled, place this service
    into automatic. If you use a hardware gateway or router, this service is
    not required.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What services Remote Access Auto Connection Manager needs to function
    properly:


    Remote Access Connection Manager
    o
    Telephony
    °
    Plug and Play
    °
    Remote Procedure Call (RPC)

    Telephony
    o
    Plug and Play
    o
    Remote Procedure Call (RPC)
    What other service require Remote Access Auto Connection Manager to
    function properly:


    None
    Remote Access Connection Manager

    Creates a network connection. This service is required if you use
    Internet Connection Sharing. If
    things cease to function after disabling this service, put it to
    automatic. Note: you may require
    this service for some direct cable or DSL providers and connections,
    depending on how they
    implement their logon process. If your Dial-up, cable or DSL internet
    access no longer functions

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 36 Revision 5: Sunday, August 31, 2003


    properly with this service disabled, place this service into automatic.
    If you use a hardware

    gateway or router, this service is not required.
    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account
    Dependencies:
    What services Remote Access Connection Manager needs to function
    properly:



    Telephony
    o
    Plug and Play
    o
    Remote Procedure Call (RPC)
    What other services require Remote Access Connection Manager to function
    properly:

    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)

    Remote Access Auto Connection Manager
    Remote Desktop Help Session Manager

    Manages and controls Remote Assistance. If you do not want or need to
    use this feature, disable

    it. In an idle state, this service sucks up 3.4 MB to 4 MB of RAM.
    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account
    Dependencies:
    What service Remote Desktop Help Session Manager needs to function
    properly:



    Remote Procedure Call (RPC)
    What other service require Remote Desktop Help Session Manager to
    function properly:

    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 37 Revision 5: Sunday, August 31, 2003


    Remote Procedure Call (RPC)

    This service is rather vital. Practically everything depends on this
    service to be running. This is
    also the only service that you cannot disable via the Services MMC.
    Previously, if you disabled
    this service in Windows 2000, your computer would become unbootable.
    What I am trying to tell
    you is leave this service on automatic and absolutely DO NOT disable it
    in msconfig. If, for
    whatever reason, the service became disabled and you can no longer boot
    your system, please
    read the information here for a way to fix it:
    http://www.blkviper.com/AskBV/2k4.htm

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account (and cannot be changed)

    Dependencies:

    What service Remote Procedure Call (RPC) needs to function properly:


    None
    What other services require Remote Procedure Call (RPC) to function
    properly:


    Background Intelligent Transfer Service

    COM+ Event System
    o
    System Event Notification

    COM+ System Application

    Cryptographic Services

    Distributed Link Tracking Client

    Distributed Transaction Coordinator
    o
    Message Queuing
    °
    Message Queuing Triggers

    Error Reporting Service

    Fax Service

    Help and Support

    Human Interface Device Access

    IIS Admin
    o
    FTP Publishing Service
    o
    Simple Mail Transport Protocol (SMTP)
    o
    World Wide Web Publishing Service

    Indexing Service

    IPSEC Services

    Logical Disk Manager
    o
    Logical Disk Manager Administrative Service

    Logical Disk Manager Administrative Service

    Message Queuing
    o
    Message Queuing Triggers

    Messenger
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 38 Revision 5: Sunday, August 31, 2003



    MS Software Shadow Copy Provider

    Network Connections
    o
    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)

    Print Spooler
    o
    Fax Service
    o
    TCP/IP Printer Server

    Protected Storage

    QoS RSVP

    Remote Desktop Help Session Manager

    Remote Registy

    Removable Storage

    RIP Listener

    Routing and Remote Access

    Security Accounts Manager
    o
    Distributed Transaction Coordinator
    °
    Message Queuing

    Message Queuing Triggers
    o
    IIS Admin
    °
    FTP Publishing Service
    °
    Simple Mail Transport Protocol (SMTP)
    °
    World Wide Web Publishing Service

    Shell Hardware Detection

    System Restore Service

    Task Scheduler

    Telephony
    o
    Fax Service
    o
    Remote Access Auto Connection Manager
    o
    Remote Access Connection Manager
    °
    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
    °
    Remote Access Auto Connection Manager

    Telnet

    Terminal Services
    o
    Fast User Switching Compatibility

    Upload Manager

    Volume Shadow Copy

    Windows Audio

    Windows Image Acquisition (WIA)

    Windows Installer

    Windows Management Instrumentation

    Wireless Zero Configuration

    WMI Performance Adapter
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 39 Revision 5: Sunday, August 31, 2003


    Remote Procedure Call (RPC) Locator

    Manages the RPC name service database. I have not found a reason to keep
    this service running.
    However, if something on your network breaks after you disable this
    service, put it back to
    manual. About 1.2 MB of RAM is in use with this service.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: NT AUTHORITY\NetworkService

    Dependencies:

    What service Remote Procedure Call (RPC) Locator needs to function
    properly:


    Workstation
    What other service require Remote Procedure Call (RPC) Locator to
    function properly:


    None
    Remote Registry Service

    This feature is not available on Windows XP Home. This is one of those
    not needed services.
    One of the first I disable. If you are paranoid about security, disable
    this service. Even if you are
    not or do not care, disable it anyway.

    Default XP Home: Not Available
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service Remote Registry Service needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Remote Registry Service to function properly:

    None
    Removable Storage

    Used for managing removable media. Disable this service if you do not
    have items like tape
    backup devices, etc. If your CD ROM / DVD drive starts acting funny, (no
    auto play, etc) place
    this service into automatic. Normally, this service does not need to be
    running and you will not
    miss any of its functionality.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 40 Revision 5: Sunday, August 31, 2003


    Log on as: Local System account

    Dependencies:

    What service Removable Storage needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Removable Storage to function properly:


    None
    RIP Listener

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if needed, you may install it later off the Windows XP CD. If you do
    not know what RIP
    protocol is, you do not need this service installed. :)

    Default XP Home: Not Available
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Dependencies:


    Remote Procedure Call (RPC)
    Routing and Remote Access

    Allows computers to dial in to the local computer through a modem (or
    other devices) to access
    the local network using a standard or VPN connection. Unless you require
    this functionality,
    disable it for security reasons. Upon enabling this service, “Incoming
    Connections” icon will be
    available in the “Network Connections” control panel.

    Default XP Home: Disabled
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service RIP Listener needs to function properly:


    Remote Procedure Call (RPC)
    What other service require RIP Listener to function properly:


    None
    Secondary Logon

    Enables starting processes under alternate credentials. I have never
    found a reason to keep this
    service running. I have always considered “Alternate Credentials”
    someone other than me! Not
    my idea of fun… Really, though, it allows a “limited user” account to
    start an application or
    process with higher privileges, such as the Administrator account or
    another user. You can also

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 41 Revision 5: Sunday, August 31, 2003


    have a privileged user start an application or process with limited
    privileged account. If you
    right-click a file, the menu will display “Run As” option. If you
    disable this service, that function
    will no longer be available.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account (with permission to interact with
    desktop)

    Dependencies:

    What service Secondary Logon needs to function properly:


    None
    What other service require Secondary Logon to function properly:


    None
    Security Accounts Manager

    Like Protected Storage, it saves profile and security information for
    local users. This service is
    required for IIS Admin. If you have ever used the Group Policy Editor
    (gpedit.msc) to modify
    your settings, you need to keep this service running; otherwise, your
    modifications will not
    apply. For “Safe” configurations, place this into automatic.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What service Security Accounts Manager needs to function properly:


    Remote Procedure Call (RPC)
    What other services require Security Accounts Manager to function
    properly:


    Distributed Transaction Coordinator
    o
    Message Queuing
    °
    Message Queuing Triggers

    IIS Admin
    o
    FTP Publishing Service
    o
    Simple Mail Transport Protocol (SMTP)
    o
    World Wide Web Publishing Service
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 42 Revision 5: Sunday, August 31, 2003


    Server

    Used for file and print sharing from your computer or Message Queuing.
    For security purposes,
    you may disable this service if you do not require local printers and
    files shared across your
    network. Connectivity, however, still exists even on incoming shared
    network drives.
    Workstation needs to be running to connect to another computer that has
    the files you are
    looking for. Note: If you disable File and Print sharing, the Server
    Service may disappear from
    the Services listing. Just enable File and Print sharing again and the
    Server Service will return.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service Server needs to function properly:


    None
    What other services require Server to function properly:


    Computer Browser

    Message Queuing
    o
    Message Queuing Triggers
    Shell Hardware Detection

    Used for the auto play of devices like memory cards, CD drives, etc.
    Also, set to automatic if you
    are experiencing problems with laptop docking stations. In “My
    Computer,” you may not see
    your hardware (example: DVD drive) displayed as a “DVD Drive” if this
    service is disabled.
    However, all functionality still exists. In addition, when checking the
    properties of an “auto
    play” device, such as a DVD drive, you will not have an auto play tab
    displayed or available.
    This service also allows the option of selecting what action you wish to
    take with a particular
    “type” of file. If you enjoy the auto play function of CD's and DVD's
    after inserting them into
    your drive, leave this service on automatic.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 43 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What service Shell Hardware Detection needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Shell Hardware Detection to function
    properly:


    None
    Simple Mail Transport Protocol (SMTP)

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if needed, you may install it later off the Windows XP CD. This
    service supports the use of a
    local (outbound) E-Mail server.

    Default XP Home: Not Available
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    Dependencies:

    What services Simple Mail Transport Protocol (SMTP) needs to function
    properly:


    Event Log

    IIS Admin
    o
    Remote Procedure Call (RPC)
    o
    Security Accounts Manager
    °
    Remote Procedure Call (RPC)
    What other service require Simple Mail Transport Protocol (SMTP) to
    function properly:


    None
    Simple TCP/IP Services

    This service does not install by default, but if needed, you may install
    it later off the Windows
    XP CD. This service supports some old school UNIX networking services.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 44 Revision 5: Sunday, August 31, 2003


    Dependencies:
    What service Simple TCP/IP Services needs to function properly:



    AFD Networking Support Environment
    What other service require Simple TCP/IP Services to function properly:

    None
    Smart Card

    Supports the use of a Smart Card for local or network computer
    authentication. If you do not
    have a “Smart Card,” or you do not know what a Smart Card is, you do not
    need this service
    running. Save the 1.1 MB to 1.4 MB of RAM this service uses.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service Smart Card needs to function properly:


    Plug and Play
    What other service require Smart Card to function properly:

    None
    Smart Card Helper

    Supports the use of a Smart Card for local or network computer
    authentication. If you do not
    have a “Smart Card,” you do not need this service running.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Dependencies:

    What service Smart Card Helper needs to function properly:


    None
    What other service require Smart Card Helper to function properly:

    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 45 Revision 5: Sunday, August 31, 2003


    SNMP Service

    This service does not install by default, but if needed, you may install
    it later off the Windows
    XP CD. This service supports the use of networking equipment that uses
    SNMP as a mode of
    remote management.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    Dependencies:

    What service SNMP Service needs to function properly:


    Event Log
    What other service require SNMP Service to function properly:


    None
    SNMP Trap Service

    This service does not install by default, but if needed, you may install
    it later off the Windows
    XP CD. As above, this supports the use of networking equipment that uses
    SNMP as a mode of
    management.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service SNMP Trap Service needs to function properly:


    Event Log
    What other service require SNMP Trap Service to function properly:


    None
    SSDP Discovery Service

    Used to locate UPnP devices on your home network. Used in conjunction
    with Universal Plug
    and Play Device Host, it detects and configures UPnP devices on your
    home network. For
    security reasons and for the fact that I doubt that you have any of
    these devices, disable this
    service. If any EXTERNAL device does not function because of this
    service being disabled,
    place it back in to automatic. MSN Messenger uses this service in
    conjunction with supported
    UPnP devices, to provide support for networks behind a NAT firewall or
    router. Also, if you are
    experiencing difficulty connecting to multiplayer games that use
    DirectX(7,8,9), place this
    service to automatic and ensure you download all security updates. The
    problem that I have

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 46 Revision 5: Sunday, August 31, 2003


    found with this service is that it broadcasts UDP port 1900 “a lot.”
    Take note: UPnP is NOT PnP.
    UPnP is for connectivity on networks via TCP/IP to devices, such as
    scanners or printers. Your
    sound card is PnP. Do NOT disable Plug and Play service.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service SSDP Discovery Service needs to function properly:


    None
    What other service require SSDP Discovery Service to function properly:


    Universal Plug and Play Device Host
    System Event Notification

    Used in conjunction with COM+ Event System, this service notifies
    particular services when
    system events, such as logon and power events occur. I doubt the average
    user really cares about
    this. I have also not seen any applications that use this. You will
    receive, in the Event Log, an
    entry complaining about not having this service running if disabled. I
    have yet to find a side
    effect, though. For a “safe” configuration, leave this service on
    automatic.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What services System Event Notification needs to function properly:


    COM+ Event System
    o
    Remote Procedure Call (RPC)
    What other service require System Event Notification to function
    properly:


    None
    System Restore Service

    Read all of this before disabling! This service creates system snap
    shots or restores a point for
    returning to later. This is the OTHER service that is a massive resource
    hog. Indexing Service is
    number one. Every time you install a program or new driver, and on a
    schedule, this service
    creates a “restore point” to roll back to if a problem occurs. This
    service would have been nice in
    the Windows 95 days due to plenty of problems occurring (new DirectX
    version every 15
    minutes) but not required for the “much” more stable Windows XP. This is
    the FIRST thing that

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 47 Revision 5: Sunday, August 31, 2003


    I get rid of on a clean installation. I feel it is faster and less
    hassle to just install clean. A rather
    GOOD (and possibly the only) reason to use this “feature” is to roll
    back your OS after installing
    an unknown program or testing software. For example, if you use BETA
    software of any kind.
    NOTE: If you disable this service, your previous “restore points” will
    delete. If, for whatever
    reason, you do not want this to happen, do not disable this service. By
    default, System Restore
    Service uses a LARGE amount of disk space to store rollback points. On
    large hard drives, this
    could be well over 10 to 20 GB.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service System Restore Service needs to function properly:


    Remote Procedure Call (RPC)
    What other service require System Restore Service to function properly:


    None
    Task Scheduler

    You use this service to schedule maintenance, Microsoft Backup sessions,
    or maybe even Auto
    Update. I do everything manually, to avoid having this service running
    all the time. Some third
    party software may require this service to be active for automated
    functions, such as virus
    scanners, system maintenance tools, and automatic patch/driver lookups.
    Take note: BootVis
    requires Task Scheduler and COM+ Event System to be running if you wish
    to take advantage of
    the “optimize system” function. Why may you need this service? It is due
    to the pre-fetching
    function built into Windows XP. Another Note: Pre-fetching only occurs
    on boot up and
    application start, so if you do not care about a few extra seconds of
    boot time, do not even bother
    with it and disable Task Scheduler. On some applications, the
    pre-fetching feature really does
    help. Only you can decide whether to use its functionality and if it
    helps in the performance of
    your system.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account (with permission to interact with
    desktop)

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 48 Revision 5: Sunday, August 31, 2003


    Dependencies:
    What service Task Scheduler needs to function properly:



    Remote Procedure Call (RPC)
    What other service require Task Scheduler to function properly:

    None
    TCP/IP NetBIOS Helper Service

    This feature provides legacy support for NetBIOS over TCP/IP. If your
    network does not use

    NetBIOS and / or WINS, disable this function.
    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService
    Dependencies:
    What service TCP/IP NetBIOS Helper Service needs to function properly:



    AFD Networking Support Environment

    NetBIOS over TCP/IP
    o
    TCP/IP Protocol Driver
    °
    IPSEC driver
    What other service require TCP/IP NetBIOS Helper Service to function
    properly:


    None
    TCP/IP Printer Server

    This service does not install by default, but if needed, you may install
    it later off the Windows
    XP CD. Used for setting up a local UNIX print server. If you do not need
    this function, leave it
    uninstalled.

    Default XP Home: Not Installed
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 49 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What services TCP/IP Print Server needs to function properly:


    Print Spooler
    o
    Remote Procedure Call (RPC)

    TCP/IP Protocol Driver
    o
    IPSEC driver
    What other service require TCP/IP Print Server to function properly:


    None
    Telephony

    Controls telephony devices on the local computer. This service is
    required for dial-up modem
    connectivity. Note: you may require this service for some direct cable
    or DSL providers,
    depending on how they implement their logon process or some AOL
    functionality, depending on
    software used. If Dial-up, cable or DSL internet access no longer
    functions properly with this
    service disabled, place it into automatic. If you are connecting via a
    hardware router or gateway,
    this service is not needed.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What services Telephony needs to function properly:


    Plug and Play

    Remote Procedure Call (RPC)
    What other services require Telephony to function properly:


    Fax Service

    Remote Access Auto Connection Manager

    Remote Access Connection Manager
    o
    Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
    o
    Remote Access Auto Connection Manager
    Telnet

    This service is not available on Windows XP Home. It allows remote login
    to the local computer
    via the telnet function. For security reasons, disable this unless you
    specifically require its
    functionality. You will save about 2 MB of RAM by plugging this security
    hole.

    Default XP Home: Not Available
    Default XP Pro: Manual
    Safe Setting: Disabled

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 50 Revision 5: Sunday, August 31, 2003


    Log on as: Local System account

    Dependencies:

    What services Telnet needs to function properly:


    NT LM Security Support Provider

    Remote Procedure Call (RPC)

    TCP/IP Protocol Driver
    o
    IPSEC driver
    What other service require Telnet to function properly:


    None
    Terminal Services

    Allows remote login to the local computer. This service is required for
    Fast User Switching,
    Remote Desktop Server and Remote Assistance. You will not be able to
    view who is logged on
    to a particular computer by viewing the “user” tab located in the Task
    Manager if this service is
    disabled. For security reasons, disable this unless you specifically
    require its functionality. For
    some reason, start this service to install Norton 2003.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service Terminal Services needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Terminal Services to function properly:


    Fast User Switching Compatibility
    Themes

    Used to display all those new XP themes and colors on your desktop. If
    memory conscious and
    does not care about the “new” XP look, disable this service to save RAM.
    I have observed
    between 4 MB to 12 MB of RAM used for the new themes.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 51 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What service Themes needs to function properly:


    None
    What other service require Themes to function properly:


    None
    Uninterruptible Power Supply

    I have not found a need for this. My UPS that connects via USB does NOT
    need this service to
    run. However, some APC UPS install a totally different service for
    communication. Windows
    Update also has a “patch” for the UPS service. Some UPS connected via
    serial port may require
    this service to be running.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service Uninterruptible Power Supply needs to function properly:


    None
    What other service require Uninterruptible Power Supply to function
    properly:


    None
    Universal Plug and Play Device Host

    Used in conjunction with SSDP Discovery Service, it detects and
    configures UPnP devices on
    your home network. For security reasons and for the fact that I doubt
    that you have any of these
    devices, disable this service. If any EXTERNAL device does not function
    because of this service
    being disabled, place it back in to automatic. MSN Messenger uses this
    service in conjunction
    with supported UPnP devices, to provide support for networks behind a
    NAT firewall or router.
    Also, if you are experiencing difficulty connecting to multiplayer games
    that use DirectX(7,8,9),
    place this service to automatic and ensure you download all security
    updates. Furthermore, if you
    use Internet Connection Sharing and wish to make use of the “allow
    others to modify this
    connection” feature, enable UPnP. Take note: UPnP is NOT PnP. UPnP is
    for connectivity on
    networks via TCP/IP to devices, such as scanners or printers. Your sound
    card is PnP. Do NOT
    disable Plug and Play service.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 52 Revision 5: Sunday, August 31, 2003


    Dependencies:
    What service Universal Plug and Play Device Host needs to function
    properly:



    SSDP Discovery Service
    What other service require Universal Plug and Play Device Host to
    function properly:

    None
    Upload Manager

    This service sends driver information to Microsoft to track availability
    of driver information.
    This service is not required for basic File and Print sharing. I have
    yet to find a need for this
    service, nor do I wish to send my hardware information to Microsoft.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What service Upload Manager needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Upload Manager to function properly:

    None
    Volume Shadow Copy

    Used in conjunction with the MS Software Shadow Copy Provider service.
    Microsoft Backup
    also uses these services. You will receive, in the Event Log, an entry
    complaining about not
    having this service running if disabled. I have yet to find a side
    effect, though. If you do not like
    the errors, place it in manual. By taking it out of automatic, you will
    save about 3.0 MB of
    memory.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service Volume Shadow Copy needs to function properly:


    Remote Procedure Call (RPC)
    What other service require Volume Shadow Copy to function properly:

    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 53 Revision 5: Sunday, August 31, 2003


    WebClient

    I have not found a reason to have this service running. I have a hunch
    that this is going to be
    required for Microsoft's .”Net Software as a service.” For security
    reasons, I recommend for this
    service to be disabled. If some MS products, such as MSN Explorer, Media
    Player, NetMeeting
    or Messenger fail to provide a particular function, try to enable this
    service to see if it is
    “required” for your configuration.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: NT AUTHORITY\LocalService

    Dependencies:

    What service WebClient needs to function properly:


    WebDav Client Redirector
    What other service require WebClient to function properly:

    None
    Windows Audio

    This service is required if you wish to hear any audio at all. If your
    computer does not have a

    sound card, disable this service.
    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account
    Dependencies:
    What services Windows Audio needs to function properly:



    Plug and Play

    Remote Procedure Call (RPC)
    What other service require Windows Audio to function properly:

    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 54 Revision 5: Sunday, August 31, 2003


    Windows Image Acquisition (WIA)

    Used for some scanners, web cams, and cameras. If, after disabling this
    service, your scanner or
    camera fails to function properly, enable this service by placing it
    into automatic.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account

    Dependencies:

    What service Windows Image Acquisition (WIA) needs to function properly:

    Remote Procedure Call (RPC)
    What other service require Windows Image Acquisition (WIA) to function
    properly:


    None
    Windows Installer

    This service is required for software applications that install using
    MSI files. If no applications
    that you have will install properly or you get an error that involves
    “RPC Service,” place this
    service in to Automatic or Manual. Only disable this service after you
    have completed
    installation of your applications, mainly Office and such. I am not
    aware how many Games
    actually use MSI Files. In an idle state, this service uses about 3.4 MB
    of RAM. Put it to manual
    to save that amount.

    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Manual

    Dependencies:


    Remote Procedure Call (RPC)
    Windows Management Instrumentation

    This service is required if you want to see the “Dependencies” tab in
    service configuration and
    you want everything to go smoothly. I do not recommend disabling this
    service as strange things
    may start to happen.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account (with permission to interact with
    desktop)

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 55 Revision 5: Sunday, August 31, 2003


    Dependencies:

    What services Windows Management Instrumentation needs to function
    properly:


    Event Log

    Remote Procedure Call (RPC)
    What other service require Windows Management Instrumentation to
    function properly:


    None
    Windows Management Instrumentation Driver Extension

    This feature is not available on Windows XP Home. This service is not as
    vital as Windows
    Management Instrumentation, but I recommend leaving this service in
    manual.

    Default XP Home: Not Available
    Default XP Pro: Manual
    Safe Setting: Manual

    Log on as: Local System account (with permission to interact with
    desktop)

    Dependencies:

    What service Windows Management Instrumentation Driver Extension needs
    to function
    properly:


    None
    What other service require Windows Management Instrumentation Driver
    Extension to function
    properly:


    None
    Windows Time

    Automatically sets your clock by contacting a server (Microsoft’s server
    by default) on the
    internet. Great idea if your network connects to the internet 24/7. The
    Event Log fills up with
    “cannot find server” messages on a non-dedicated setup, though. After
    successful synchronizing,
    this service will not attempt to do it again for 7 days, meanwhile,
    taking up resources. You may
    also need Task Scheduler running. You may choose to set your clock
    manually on a dial up
    connection, but with a 24/7 broadband setup, this could keep you on time
    for work. Note: as
    mentioned, “time.windows.com” is the default server for synchronization.
    For those privacy
    conscious people that prefer to connect to a government site rather then
    MS, use “time.nist.gov.”

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 56 Revision 5: Sunday, August 31, 2003


    Dependencies:
    What service Windows Time needs to function properly:



    None
    What other service require Windows Time to function properly:

    None
    Wireless Zero Configuration

    Provides automatic configuration for wireless network devices and
    connection quality feedback.
    If you do not have any wireless network devices in use on the local
    system, disable this service.
    You may require this service for connectivity with some “hot sync”
    software for a PDA, laptop
    or other portable computer

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Disabled

    Log on as: Local System account

    Dependencies:

    What services Wireless Zero Configuration needs to function properly:


    NDIS Usermode I/O Protocol

    Remote Procedure Call (RPC)
    What other service require Wireless Zero Configuration to function
    properly:

    None
    WMI Performance Adapter

    I have not found a use for this service. Save the 2.5 MB to 6 MB of
    memory, this service

    consumes.
    Default XP Home: Manual
    Default XP Pro: Manual
    Safe Setting: Disabled

    Log on as: Local System account
    Dependencies:
    What service WMI Performance Adapter needs to function properly:



    Remote Procedure Call (RPC)
    What other service require WMI Performance Adapter to function properly:

    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 57 Revision 5: Sunday, August 31, 2003


    Workstation

    Used to connect local computer to remote computers. Examples may include
    local network
    connectivity and File and Print sharing. Many services depend on
    Workstation to be functioning.
    Leave it on automatic for safe configurations.

    Default XP Home: Automatic
    Default XP Pro: Automatic
    Safe Setting: Automatic

    Log on as: Local System account

    Dependencies:

    What service Workstation needs to function properly:


    None
    What other services require Workstation to function properly:


    Alerter

    Background Intelligent Transfer Service

    Computer Browser

    Messenger

    Net Logon

    Remote Procedure Call (RPC) Locator
    World Wide Web Publishing Service

    This feature is not available on Windows XP Home or installed by default
    on Windows XP Pro,
    but if needed, you may install it later off the Windows XP CD. Used for
    setting up a local web
    server. If you do not need this function, leave it uninstalled, mainly
    because this service requires
    IIS Admin to be running and IIS has been “popular” for crackers to
    break.

    Default XP Home: Not Available
    Default XP Pro: Not Installed
    Safe Setting: Not Installed

    Log on as: Local System account

    Dependencies:

    What services World Wide Web Publishing Service needs to function
    properly:


    IIS Admin

    Remote Procedure Call (RPC)

    Security Accounts Manager

    Remote Procedure Call (RPC)
    What other service require World Wide Web Publishing Service to function
    properly:


    None
    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 58 Revision 5: Sunday, August 31, 2003


    Original content created July 28, 2001
    Last update was Sunday, August 31, 2003


    Copyright © 2001-2003 by Black Viper
    All Rights Reserved.


    Up to date content and contact information is located at
    www.blkviper.com or www.blackviper.com.


    Strange Processes

    Most of these are not really “Services,” but are applications or
    processes running at different
    times:

    Most may be disabled using “msconfig.”

    Ati2evxx.exe

    This service, Ati HotKey Poller, is installed if you update to the
    latest ATI video card drivers. It
    provides the ability to hot key your display settings for what ever
    reason you would need this
    feature. I do not change them often, so there is no point in having this
    service “always running.”

    Ati2sgag.exe

    This service, ATI Smart, is installed if you update to the latest ATI
    video card drivers. It
    provides the ability to test your particular configuration for
    compatibility issues and stability
    issues. The location is also in the ATI display properties control
    panel. After testing “once,” I
    have found no reason to continue to have this service in memory.

    crypserv.exe

    This service, Crypkey License, is installed if you use “Swish”
    (swishzone.com). It is required to
    start up the program, otherwise an error about writing to a memory
    location pops up. Set this to
    Disabled until you need it. Note: If set to “Manual,” this service will
    NOT start on its own (thus
    the error message).

    csrss.exe

    This is “Client Server Runtime Process” is part of the core of Windows.
    You cannot kill it and I
    am not sure why you would even want to. It is a 4k process that sucks up
    about 3 MB to 6 MB or
    so, but I do not support making it go away. Usually, if it is
    “difficult” to get rid of, it is needed.

    ctfmon.exe

    This is your “Language Bar.” Don't know what it is? I bet you do not
    need it. Head to Control
    Panel -> Regional and Language Options -> Languages TAB -> Details
    BUTTON -> Language
    Bar BUTTON (under “Preferences”) -> select the “Turn off advanced text
    services” check box.
    This little detail will save you between 1.5 MB and 4 MB of RAM. If you
    are using a “non-US”
    version, you may be required to install the English localization to
    remove this “feature.”

    CTHELPER.EXE

    This is installed with the SoundBlaster Audigy2 drivers. It takes about
    4 MB of RAM.

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 59 Revision 5: Sunday, August 31, 2003


    CTDVDDET.exe

    This is also installed with the SoundBlaster Audigy2 drivers. A “DVD
    Detection” application. It
    sucks up about 2.2 MB of memory. You can disable it by heading to the
    MediaSource DVD
    Audio Player, selecting Tools, then uncheck the “Auto Start” box. It
    should not start up
    automatically again.

    CTSysVol.exe

    Yet another that is installed with the SoundBlaster Audigy2 Card. A
    “Volume Control”
    application that, by default, sits in the system tray. It takes about
    3.8 to 5 MB of RAM doing
    nothing. Right click the tray icon and select “Close,” then disable it
    via msconfig.

    defwatch.exe

    This service, DefWatch, is installed with Norton. “Virus Definitions
    Daemon.” Unless you do
    not want your Virus Scanner to work properly, keep this going.

    devldr32.exe

    This is installed if you have a Creative Sound Card (SBLive Series that
    I am aware of). It sucks
    up 2.3 MB to 2.6 MB, but I have not completed extensive testing with
    this NOT being there…
    After manually killing the process (this is not a service, it is listed
    as a driver in the hardware
    properties of the sound card) I loaded up a game of Dungeon Siege and
    all EAX features and 5.1
    positional sound worked (with EAX on or off). Also, all Direct Sound
    tests completed without
    errors. Do not get excited, though. After renaming the process, the
    Windows File Protection
    dialog pops up. Upon reboot, devldr32.exe is not displayed in the active
    processes in Task
    Manager, but the Creative Mixer and AudioHQ applications fail to load. I
    also searched for a
    reference in the registry and found little to nothing… Kill it if you
    want to recover some
    memory, but I do not support such “drastic” measures… so you are on your
    own with it. Do not
    E-Mail me asking for help if you killed this process. :)

    explorer.exe

    This is NOT related to Internet Explorer. There will ALWAYS be an
    explorer.exe running in the
    background. It is the user interface process/desktop/shell, etc. This is
    one of the many ways how
    Bill got away with “integrating” IE with Windows… If you load up
    “Windows Explorer” to
    rummage through files, you will see an additional explorer.exe in the
    background. This will
    fluctuate depending on what you have (fonts, background pics, active
    desktop) going at any
    given time. Usage of between 5.8 MB and 36 MB RAM is typical.

    Fast.exe

    This service is installed with Windows XP PowerToys, namely the
    Interactive Login Service.
    Uses 1.4 MB to 2 MB EACH! This service will fire off at least 2 (system
    and user) instances of
    this process.

    IAANTmon.exe

    This service, IAA Event Monitor, is installed with Intel's Application
    Accelerator and uses about
    876 KB of memory.

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 60 Revision 5: Sunday, August 31, 2003


    Idle

    This is a generic process that is used when no other program or process
    is requiring CPU
    resources. It is not a bad thing if it is using 99% of your CPU! This
    process is a 16 k loop that the
    CPU processes while it is not doing “anything” else. If you computer is
    called upon to do any
    other task than “nothing,” the idle process allows that to happen and
    the % used will decrease
    accordingly. You can not disable the idle process. If it is using 97%
    CPU, which only means that
    the other 3% is used by real programs. If your idle process is
    constantly at a low rate (for
    example, 3%) something else, an application or process is using the CPU.
    IEXPLORE.EXE

    This is the IE browser. Pops up only when you want to suck up 7.3 MB to
    ?? MB of memory to
    surf the web. I say ?? MB because every time you open an additional
    browser, you also start
    another one of these processes. If you close “all” browser windows, a
    IEXPLORE.EXE process
    will still be running. This is a “feature” to allow faster startup the
    next time you open IE. Unlike
    Mozilla, you cannot disable this “feature” other than directly killing
    the offending process.

    iTouch.exe

    This process is installed with Logitech software for the “internet” key
    functions on keyboards
    and iTouch features on compatible mice. Plenty of functions remain with
    this software disabled,
    but some of the more “cool” stuff will not. This process takes from 3.6
    MB to 12 MB of
    memory.

    “Generic Host Process for Win32 Services”

    This is what ZoneAlarm complains about while connected to the internet.
    “SVCHOST.EXE” is
    “Generic Service Host.” What that means is it is a “host” for other
    processes or services. Check
    this document starting on Page 4 to see “all” of the services that use
    SVCHOST.EXE as a front
    for something else.

    If your internet connection seems to “no longer work,” it is due to you
    disallowing various
    “required” functions to no longer access the internet. A big one is “DNS
    Lookups.” If you do not
    allow this to get through, you will no longer be able to type in
    “blkviper.com” but you will
    always be able to type in the IP address of the systems. The internet
    connection is still working,
    but you are blocking a “vital” part of the process for surfing web
    pages.

    mdm.exe

    This service, Machine Debug Manager, is installed with Office components
    or possibly the
    Visual series. Make it go away if you are not in need of “Debugging”
    software.

    mozilla.exe

    This is the Mozilla browser executable. It uses between 14 MB and ?? MB
    of memory.
    Optionally, you can disable the system tray icon and not allow the
    “Quick Launch” feature to tell
    Mozilla to completely unload from memory when the final browser window
    is closed. This will,
    of course, increase the startup time when you fire up the browser
    window, again.

    msmsgs.exe

    This is Microsoft Windows Messenger that comes with Windows XP Home and
    Pro. With some
    applications, namely, Outlook and MSN Explorer, this process will still
    run in the background to
    get all of those .NET alerts, etc, that Microsoft is saying will be so
    cool.

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 61 Revision 5: Sunday, August 31, 2003


    msn6.exe

    This is the Microsoft “MSN Explorer” bundled with Windows XP Home and
    Pro. While running
    this application, you will also have the previous process running. See
    msmsgs.exe for more
    information.

    mspmspsv.exe

    This service, WMDM PMSP Service, is installed starting with Windows
    Media Player 7. If you
    do not use Media Player, disable this service. If you begin using Media
    Player again and
    functions do not work properly, such as Digital Rights Management or
    Copy Protection, set this
    to Manual or Automatic.

    navapsvc.exe

    This service, Norton AntiVirus Auto Protect Service, is installed with
    Norton 2002. Unless you
    want your Virus Scanner to not function, keep this in Manual.

    Navapw32.exe

    This is installed with Norton AntiVirus 2002 Software. Unless you want
    your Virus Scanner to
    no longer function, keep this process running. Do not “end” it. This
    process is also responsible
    for automatically updating the virus definitions and displaying that
    cute little icon in the system
    tray.

    Nvsvc32.exe

    This service, NVIDIA Driver Helper Service, is installed when you change
    from the WDM
    drivers to nVidia's latest and greatest version. The service uses about
    945k and zero CPU, but
    there is no need for it. I have even experienced EXTREME shutdown delays
    with this service
    active, but no adverse side effects with it disabled. Make it go away.
    NOTE: If using drivers
    other than nVidia's, such as Asus, this service may have been renamed to
    reflect that.

    point32.exe

    This is installed with Microsoft Mouse Software, Intellimouse and the
    like. Most functions (if
    not all) are built into XP, so there is NO need to suck up 1.1 MB to 1.6
    MB for a useless program
    also running in the background/system tray unless you require “specially
    mapped” key
    configurations for your buttons.

    promon.exe

    This is installed with Intel Pro family graphics adapters. It controls
    the application that displays
    in your system tray. It uses about 656K to 1.1 MB just sitting there. I
    hate icons in the system
    tray… I have none.

    rtvscan.exe

    This service, Norton AntiVirus Client and Server, is installed with
    Norton Corporate Edition.
    Unless you want your Virus Scanner to not function, keep this going.

    SBServ.exe

    This service, ScriptBlocking Service, is installed with Norton 2002.
    Unless you want your Virus
    Scanner to stop preventing malicious scripts from doing damage, keep
    this in Automatic.

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 62 Revision 5: Sunday, August 31, 2003


    smss.exe
    Dubbed “Windows NT Session Manager.” Another process (see csrss.exe
    above) that is part of
    the core of Windows. It is a 45 KB process that uses about 300 KB to 2
    MB. You cannot kill this
    process manually and I do not recommend trying other ways to get rid of
    it. Usually, if it is
    “difficult” to get rid of, it is needed.

    svchost.exe

    A generic process that is “Service Host” for other processes. Yes, this
    is actually a service, but I
    am placing it here because I have no where else to put it. You may have
    3 or 4 copies running in
    task manager (system, network, user, and ?) If you use my tweaking tips
    in this document, you
    can rid yourself of a couple of them.

    SWTrayV4.EXE

    This is installed with the Microsoft SideWinder Version 4 Software. It
    takes between 4 MB and
    5 MB of RAM.

    System IDLE Process

    This is a generic process that is used when no other program or process
    is requiring CPU
    resources. It is not a bad thing if it is using 99% of your CPU! This
    process is a 16 k loop that the
    CPU processes while it is not doing “anything” else. If you computer is
    called upon to do any
    other task than “nothing,” the idle process allows that to happen and
    the % used will decrease
    accordingly. You can not disable the idle process. If it is using 97%
    CPU, which only means that
    the other 3% is used by real programs. If your idle process is
    constantly at a low rate (for
    example, 3%) something else, an application or process is using the CPU.
    taskmgr.exe

    If you are looking at the processes running, this is the application
    that you are using to do it.
    “Windows Task Manager” is the full name. It uses about 3.2 MB of RAM, so
    take that into
    account when you are tweaking your system.

    TaskSwitch.exe

    This is installed with PowerToys for XP. It uses 1.4 MB to 2 MB to
    display those cute icons
    when you hit Alt+tab. I can do without.

    vptray.exe

    This is the cute Norton AV Tray application that displays in your system
    tray. It uses about 2.9
    MB just sitting there. You may recover SOME memory by making the icon go
    away, but it is
    STILL running in the background.

    winlogon.exe

    This takes care of login and logoff tasks. Really, you cannot get rid of
    this process. It is required
    as long as you are “logged in.” I have saw this process fluctuate
    between 1.2 MB to 8.5 MB on a
    system that has been up for only an hour and 1.7 MB and 17 MB on a
    system that has been up
    for 40+ days.

    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 63 Revision 5: Sunday, August 31, 2003


    wowexec.exe

    This is as process that is fired off to help “translate” interrupts, etc
    for 16 bit applications. If you
    see this process running, you are doing just that, running old
    applications or a DOS/command
    line/console window applications. Try and seek out “updated” software.
    :)

    Original content created July 28, 2001
    Last update was Sunday, August 31, 2003


    Copyright © 2001-2003 by Black Viper
    All Rights Reserved.


    Up to date content and contact information is located at
    www.blkviper.com or www.blackviper.com.


    © 2001-2003 Black Viper of http://www.blackviper.com All Rights
    Reserved.
    Page 64 Revision 5: Sunday, August 31, 2003

     
    NC, Feb 5, 2006
    #10
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Splibbilla
    Replies:
    6
    Views:
    588
    Leonidas Jones
    Mar 1, 2005
  2. Doris Penndorf

    connection mgr update

    Doris Penndorf, Jan 18, 2005, in forum: Computer Support
    Replies:
    5
    Views:
    563
    Aquanaut
    Jan 20, 2005
  3. BryanL

    Reset MMC in Call Mgr 3.3

    BryanL, Apr 26, 2004, in forum: VOIP
    Replies:
    0
    Views:
    612
    BryanL
    Apr 26, 2004
  4. webguy

    windows tsk mgr. End Process Help

    webguy, Jan 18, 2006, in forum: Computer Support
    Replies:
    2
    Views:
    428
    Evan Platt
    Jan 18, 2006
  5. Replies:
    3
    Views:
    1,681
Loading...

Share This Page