Jump to content


Windows XP Services Companion

  • This topic is locked This topic is locked
No replies to this topic

#1 Bold_Fortune


    WinCert Friend

  • Members
  • PipPipPipPip
  • 103 posts
  • Location:San Diego, California
  • OS:Windows XP Home

Posted 27 September 2007 - 04:44 PM

Windows XP Services Companion

Windows XP Services Companion is a companion to Slimming Down Windows XP: The Complete Guide PART 2: Disabled Services. Here I can shed more light on Windows XP Services that space restrictions will not allow in PART 2.

The settings below reflect my Services settings.

10 Services are set to Automatic:

Automatic Updates

Automatic Updates, the Windows Update Agent, enables the download and installation of Windows Updates.

Automatic Updates doesn't mean that you can't turn off the Automatic Updates feature in System Properties, because you prefer to manually choose and download Windows Updates from the Windows Update Web site. That you can do.

But, if the Automatic Updates Service is disabled, your computer will be unable to use either the Automatic Updates feature or the Windows Update Web site.

wuauserv.dll....(Windows Update AutoUpdate Service). <---(Main Service File)

DCOM Server Process Launcher

Distributed Component Object Model (DCOM) is a Microsoft proprietary technology for software components distributed across several networked computers to communicate with each other. It extends Microsoft's COM, and provides the communication substrate under Microsoft's COM+ application server infrastructure. It has been deprecated in favor of Microsoft .NET.

DCOM Server Process Launcher provides launch functionality for DCOM services.

Note: Windows Firewall/Internet Connection Sharing (ICS) cannot start if the DCOM Process Launcher Service is disabled. PerfectDisk needs it too, so I personally can't disable DCOM on my system.

Most home users don't need DCOM; in that, most home users are operating stand-alone computers, and are not running any software that requires DCOM.

In addition to disabling DCOM in Services, I've seen this registry change suggested. It seems to make sense, since DCOM, in actuality, is OLE (Object Linking and Embedding).

Navigate in the Registry to:


In the right pane, look for the string "EnableDCOM" and set the Value to N. (The default setting is Y).

DHCP Client

Dynamic Host Configuration Protocol Client (DHCP Client) manages network configuration by registering and updating IP addresses and (DNS) names.

This is how your computer gets a Dynamic IP address so you can connect to the internet.

Internet Protocol address (IP address) is a unique number that devices use in order to identify and communicate with each other on a network utilizing the Internet Protocol standard.

Domain Name Server (DNS) is a system that stores information associated with domain names in a distributed database on networks, such as the Internet.

DHCP Client is required for Internet connectivity by most DSL and Cable connections.

DHCPCSVC.DLL....(DHCP Client Service). <---(Main Service File)

Event Log

The Event Log Service writes events sent by applications, services, and the operating system to log files. These reports contain diagnostic information in addition to errors specific to the source application, service, or component. They contain information that can sometimes be useful in diagnosing problems. These reports can be viewed through the Event Viewer.

If the Event Log Service is disabled, you will be unable to track events, which reduces your ability to diagnose problems with your system.

EVENTVWR.EXE....(Event Viewer Snapin Launcher). <---(Main Service File)

Plug and Play

Plug and Play enables a computer to recognize and adapt to hardware changes with little or no user input.

With Plug and Play, a user can add or remove devices, without any intricate knowledge of computer hardware, and without being forced to manually configure hardware or the operating system.

A simple example, a user can plug in a USB keyboard and Plug and Play will detect the new device, find a driver for it and install it.

A more complicated example, a user can dock a portable computer and use the docking station's Ethernet card to connect to the network without changing the configuration. Later, the user can undock that same computer and use a modem to connect to the network - again without making any manual configuration changes.

PnP (Plug and Play) is not related to UPnP (Universal Plug and Play).

services.exe....(Services and Controller app). <---(Main Service File)

Remote Procedure Call (RPC)

A remote procedure call (RPC) is initiated by the caller (client) sending a request message to a remote system (the server) to execute a certain procedure using parameters supplied. A result message is returned to the caller.

A parameter is a a set of values (or variables) which can be accepted by a subroutine.

A subroutine is a portion of code within a larger program, which performs a specific task.

RPC is a the paradigm (or pattern) for implementing the client/server model of distributed computing (the coordinated use of physically separated computers).

Client/Server is a network architecture which separates the client from the server.

Picture, if you will, the use of web pages on the internet. Your computer and web browser would be considered a client, and the computers, databases, and applications that make up a particular web page you are looking at could be considered the server.

When your web browser makes a request of a web site, the web site's server gathers all of the information required to display the information from its database, and assembles it onto the web page, and sends it back to your web browser for you to look at.

Remote Procedure Call (RPC) is vital to the operation of your system. Your system will not boot without.

RPCSS.DLL.......(Distributed COM Services). <---(Main Service File)

Shell Hardware Detection

Shell Hardware Detection allows you the option of selecting what action you wish taken with a type of file on a CD or DVD, (Music files, Pictures, Video files, a Music CD, or a DVD movie), when you place the disc into one of your optical drives. When you disable Shell Hardware Detection, when checking the Properties of an optical drive, you won't have the AutoPlay tab available. (Where you would normally make these selections.) Everything else will work fine with your optical drives. You just won't have the AutoPlay selections available to you.

If you disable Shell Hardware Detection, in "My Computer," you may not see your optical drives displayed as "DVD Drive" and/or "DVD-RW Drive." They will still be displayed, only now they might be displayed simply as "CD Drive."

Also, you disable Shell Hardware Detection, in Display Properties under the Appearance tab, you will no longer be able to choose the Windows XP Theme over the Windows Classic Theme.

shsvcs.dll......(Windows Shell Services Dll). <---(Main Service File)


Themes allows you to see and manage the default Windows XP theme (Windows XP style) which was designed especially for Windows XP. You can even change its color scheme in Display Properties under the Appearance tab. The Themes Service makes that option available to you.

Some discard the Windows XP theme as a resource hog, and choose to go with the Windows Classic style theme.

Whether you are memory conscious, or prefer the look of the Classic-Style theme, you can disable Themes.

When you disable the Themes Service, the Classic-Style theme will appear instantly for you.

UXTHEME.DLL.....(Microsoft UxTheme Library). <---(Main Service File)

User Profile Hive Cleanup

User Profile Hive Cleanup is a Service I installed to help me with faster shutdowns. It really works too.

The User Profile Hive Cleanup service helps to ensure user sessions are completely terminated when a user logs off. System processes and applications occasionally maintain connections to registry keys in the user profile after a user logs off. In those cases the user session is prevented from completely ending. This can result in problems when using Roaming User Profiles in a server environment or when using locked profiles as implemented through the Shared Computer Toolkit for Windows XP.

On Windows 2000 you can benefit from this service if the application event log shows event id 1000 where the message text indicates that the profile is not unloading and that the error is "Access is denied". On Windows XP and Windows Server 2003 either event ids 1517 and 1524 indicate the same profile unload problem.

To accomplish this the service monitors for logged off users that still have registry hives loaded. When that happens the service determines which application have handles opened to the hives and releases them. It logs the application name and what registry keys were left open. After this the system finishes unloading the profile.

The Main Service File is uphclean.exe (User Profile Hive Cleanup Service) located in C:\Program Files\UPHClean.

Windows Audio

Windows Audio is required if you wish to hear any audio at all. Unless your computer doesn't have a sound card installed...in which case, you're not going to be able to hear anything anyway. (A little joke there.)

AUDIOSRV.DLL...(Windows Audio Service). <---(Main Service File)

6 Services are set to Manual:

Acronis Scheduler2 Service

Not much I can tell you or you need to know about Acronis Scheduler2 Service, other than this service is installed by Acronis TrueImage and it is needed for the program to work.

The Main Service File is schedul2.exe (Acronis Scheduler 2) located in C:\Program Files\Common Files\Acronis\Schedule2.

Background Intelligent Transfer

Background Intelligent Transfer (BITS) transfers data between clients and servers in the background using idle network bandwidth.

BITS is a file transfer service that transfers files in the foreground or background (default) between a client and a server.

Background transfers use only idle network bandwidth in order to preserve the user’s interactive experience with other network applications, such as Internet Explorer.

BITS examines the network traffic, and uses only the idle portion of the network bandwidth. It regulates its use of bandwidth as users increase or decrease their use of the bandwidth.

BITS suspends file transfers if the user logs off or the network connection is lost. When the user logs on and a network connection exists, it resumes the transfer from where it left off previously. The same is true for system reboots.

If Background Intelligent Transfer is disabled, the Windows Automatic Update feature will not work. Neither will you be able to manually download Windows Updates from the Windows Update Web site.

qmgr.dll........(Background Intelligent Transfer Service). <---(Main Service File)

Cryptographics Services

Cryptographics Services, Management of Certification Authority certificates.

Cryptographics Services provides three management services.

1.) Catalog Database Service, which confirms the signatures of Windows files.

2.) Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from your computer.

3.) Key Service, which helps enroll your computer for certificates.

If Cryptographics Services is stopped, these management services will not function properly.

Automatic Windows Updates, and even Manual updates at the Windows Update Web site, requires Cryptographic Services to be running.

Reportedly, Cryptographic Services is also required for the installation of some key Windows components, like DirectX, and Windows Media Player. (I wouldn't know, because I've never tried installing either of these Windows compontents with Cryptographic Services disabled.)

Set to Manual, Cryptographics Services will start automatically when needed.

cryptsvc.dll...(Cryptographic Services). <---(Main Service File)


Not much I can tell you or you need to know about PDEngine, other than this service is installed by PerfectDisk and it is needed for the program to work.

The Main Service File is PDEngine.exe (PerfectDisk defrag engine) located in C:\Program Files\RAXCO\PerfectDisk.


Not much I can tell you or you need to know about PDSched.exe, other than this service is installed by PerfectDisk and it is needed for the program to work.

The Main Service File is PDSched.exe (PerfectDisk defrag engine) located in C:\Program Files\RAXCO\PerfectDisk.

Windows Installer

Windows Installer uses the information within .MSI files that are provided with some applications, and installs, repairs, or removes software using this information.

You can view these .MSI (Windows Installer File) files within the C:\WINDOWS\Installer folder.

MSIEXEC.EXE.....(Windows Installer) <---(Main Service File)

62 Services are set to Disabled:

Alerter Service

Alerter Service notifies users of administrative alerts on a network.

alrsvc.dll.....(Alerter Service DLL). <---(Main Service File)

Application Layer Gateway Service

Application Layer Gateway Service is a subcomponent of the Windows Firewall/Internet Connection Sharing (ICS) Service. It provides support for 3rd party plug-ins that allow network protocols to pass through the firewall and work behind ICS.

However, BlackViper tells us that after the installation of Service Pack 2 it no longer is required.

ALG.EXE.........(Application Layer Gateway Service). <---(Main Service File)

Application Management

Application Management is a software installation Group Policy extension. It processes requests to enumerate, install, and remove applications deployed via a corporate network.

The Main Service File would be appmgmts.dll, and it should be located in C:\WINDOWS\system32. Not installed on XP Home Edition.


Enables the Clipbook Viewer to create and share "pages" of data to be viewed by remote computers. This service depends on the NetDDE/Network Dynamic Data Exchange (DDE) service to create the actual file shares that other computers can connect to, while the Clipbook application and service allow users to create the pages of data to share.

CLIPSRV.EXE.....(Windows NT DDE Server). The network dynamic data exchange (DDE) clipboard service used by Clipboard Viewer to access objects or data copied into memory. <---(Main Service File)

COM+ Event System & COM+ System Application

COM+ Event System supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If this service is turned off, SENS will close and will not be able to provide logon and logoff notifications.

COM+ System Application manages the configuration and tracking of Components Object Model (COM)+ based components.

es.dll..........<----(Main Service File)

Computer Browser

Maintains an up-to-date list of computers on your network, and supplies the list to programs that request it.

browser.dll.....(Computer Browser Service DLL). <---(Main Service File)

Distributed Link Tracking Client

Distributed Link Tracking Client maintains links between the NTFS file system files within a computer or across computers in a network domain. The service ensures that shortcuts and (Object Linking and Embedding) OLE links continue to work after the target file is renamed or moved.

trkwks.dll......(Distributed Link Tracking Client).<---(Main Service File)

Distributed Transaction Coordinator

Distributed Transaction Coordinator coordinates transactions that are distributed across multiple computer systems and/or resource managers, such as databases, message queues, file systems, or other transaction-protected resource managers. It is closely related to Distributed Link Tracking Client. It really doesn't serve much of a purpose for home user systems.

MSDTC.EXE.......(MS DTC console program). The console for the Distributed Transaction Coordinator (DTC). <---(Main Service File)

DNS Client

DNS Client resolves and caches (Domain Name Server) DNS names. DNS Client is required if using IPSEC.

There are lots of arguments about this one. My opinion, it's not required. If you disable it, all the lookups will be done by your Internet Service Provider's DNS.

dnsrslvr.dll....(DNS Caching Resolver Service). <---(Main Service File)

Error Reporting Service

Error Reporting Service calls home to Microsoft when application errors occur.

ersvc.dll.......(Windows Error Reporting Service). <---(Main Service File)

Fast User Switching Compatibility

Fast User Switching Compatibility allows for switching users without closing all existing applications running under a different account.

Designed for the home, Fast User Switching lets everyone use a single computer as if it were their own. There is no need to log someone else off and have to decide whether to save another user's files. Instead Windows XP takes advantage of Terminal Services technology and runs each user session as a unique Terminal Services session, enabling each user's data to be entirely separated.

shsvcs.dll.........(Windows Shell Services Dll). <---(Main Service File)

Help and Support

Help and Support is required for viewing Microsoft's online help documents.

HelpSvc.exe.....(Microsoft Help Center Service). <---(Main Service File) Located in C:\WINDOWS\\helpctr\binaries folder.

Http SSL

HTTP SSL enables IIS (Internet Information Services) to perform SSL (Secure Sockets Layer) functions. SSL is an open standard for establishing a secure communications channel to prevent the interception of critical information, such as credit card numbers.

w3ssl.dll.......(SSL service for HTTP). <---(Main Service File)

Human Interface Device Access

Human Interface Device Access enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function.

Some peripherals (devices connected to a computer) require this service. Internet keyboards with volume and play control buttons, scanners with fax or copy buttons.

I do not have the associated file, HidServ.dll, installed on my system.

IMAPI CD-Burning COM Service

Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). Your computer cannot burn audio CDs using Windows Media Player without the IMAPI CD-Burning COM Service. However, third-party burning programs such as Nero still can.

IMAPI.EXE.......(CD-Burning COM Service). <---(Main Service File)

Indexing Service

Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.

CISVC.EXE.......(Content Index Service). The Content Index engine that performs file indexing to improve performance of resource searches. <---(Main Service File)

IPSEC Services

Per Microsoft: Internet Protocol Security (IPsec) is a framework of open standards for ensuring private, secure communications over Internet Protocol (IP) networks, through the use of cryptographic security services. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection.

IPsec is supported by the Windows Server 2003, Windows XP, and Windows 2000 operating systems and is integrated with the Active Directory Service.

Local Disk Manager and Local Disk Manager Administrative Service

Logical Disk Manager watches Plug and Play events for new drives to be detected and passes volume and/or disk information to the Logical Disk Manager Administrative Service to be configured.

DmServer.dll....(Logical Disk Manager service dll) <---Main Service File for Local Disk Manager

DmAdmin.exe....(Local Disk Manager Administrative Service). <---Main Service File for Local Disk Manager Administrative Service


The Messenger system service sends messages to or receives messages from users and computers, administrators, and the Alerter service. This service is not related to Microsoft Windows Messenger or MSN Messenger

msgsvc.dll......(NT Messenger Service). <---(Main Service File)

MS Software Shadow Copy Provider

MS Software Shadow Copy Provider manages software-based volume shadow copies taken by the Volume Shadow Copy service. MS Software Shadow Copy Provider is used in conjunction with the Volume Shadow Copy Service. Microsoft Backup uses these services.

DLLHOST.EXE.....(COM Surrogate). The COM+ process manager. <---(Main Service File)

Netmeeting Remote Desktop Sharing

NetMeeting Remote Desktop Sharing allows authorized users to remotely access your Windows desktop from another PC over a corporate intranet by using Microsoft NetMeeting. You must explicitly enable this service in NetMeeting.

MNMSRVC.EXE.....(NetMeeting Remote Desktop Sharing). Allows authorized users to remotely access your desktop. <---(Main Service File)

Network Connections

Network Connections takes care of network configuration (client side) and displays status in the notification area on the desktop (the area on the taskbar to the right of the taskbar buttons).

NETMAN.DLL......(Network Connections Manager). <---(Main Service File)

Network DDE and Network DDE DSDM

Network DDE provides network transport and security for dynamic data exchange (DDE) by applications running on the same computer or on different computers.

Network DDE DSDM manages shared dynamic data exchange (DDE).

NETDDE.EXE......(Network DDE - DDE Communication). A background network DDE provider. <---(Main Service File)

Network Location Awareness (NLA)

Network Location Awareness collects and stores network configuration and location information, and notifies applications when this information changes.

Mswsock.dll......(Microsoft Windows Sockets 2.0 Service Provider). <---(Main Service File)

Network Provisioning Service

Network Provisioning Service manages XML (Extensible Markup Language) configuration files on a domain basis for automatic network provisioning.

The Extensible Markup Language (XML) is a general-purpose markup language for creating special-purpose markup languages, capable of describing many different kinds of data. Its primary purpose is to facilitate the sharing of data across different systems, particularly systems connected via the Internet.

A markup language combines text and extra information about the text. The extra information, for example about the text's structure or presentation, is expressed using markup, which is intermingled with the primary text.

But a picture is worth a thousand words. Double click on any file with a .XML extension, and you can see it.

xmlprov.dll.....(Network Provisioning Service). <---(Main Service File)

NVDIA Display Driver Service

NVDIA Display Driver Service provides system and desktop level support to the NVIDIA display driver.

nvsvc32.exe.....(NVIDIA Driver Helper Service). <---(Main Service File)

Performance Logs and Alerts

Performance Logs and Alerts is used to collect performance data automatically from local or remote computers that have been configured using the Performance Logs and Alerts snap-in.

SMLOGSVC.EXE....(Performance Logs and Alerts Service). An application that allows statistics to be monitored and collected on local and remote PCs. <---(Main Service File)

Portable Media Serial Number Service

Portable Media Serial Number Service retrieves the serial number of any portable music player connected to your computer.

MsPMSNSv.dll....(Microsoft Media Device Service Provider). <---(Main Service File)

Print Spooler

Print Spooler queues and manages print jobs locally and remotely. The print spooler is the heart of the Windows printing subsystem and controls all printing jobs.

SPOOLSV.EXE.....(Spooler SubSystem App. Print Spooler Service). The spooler service for the print subsystem. <---(Main Service File)

Protected Storage

Allows applications to fetch and retrieve security and other information from a personal storage location, hiding the implementation and details of the storage itself.

pstorec.dll.....(Protected Storage COM interfaces). <---(Main Service File)


QoS (Quality of Service) RSVP (Resource ReSerVation Protocol) provides network signaling and local traffic setup functionality on a network using IPSEC and applications that support QoS. QoS is a measure of the reliability of a computer network. RSVP enables non-QoS technologies such as Ethernet and IP to make QoS requests of the network,

RSVP.EXE........(Resource Reservation Protocol. QoS RSVP Service.). A protocol that sets up a reserved pathway with a specific quality of service for a set of data packets. <---(Main Service File)

Remote Access Auto Connection Manager (Dial-Up Networking Common Libraries).

Remote Access Auto Connection Manager creates a connection to a remote network whenever a program references a remote name or address. The service is activated only when there is no network access.

rasmans.dll.....(Remote Access Connection Manager). <---Main Service File for Remote Access Auto Connection Manager

Remote Access Connection Manager (Terminal Services Remote Assistance Component)

Remote Access Connection Manager creates a network connection. This service manages the actual work of connecting, maintaining, and disconnecting dial-up and VPN (Virtual Private Network) connections from your computer to the Internet or other remote networks.

sessmgr.exe.....(Microsoft® Remote Desktop Help Session Manager). <---Main Service File for both Remote Access Connection Manager and Remote Desktop Help Session Manager

Remote Desktop Help Session Manager (Terminal Services Remote Assistance Component)

Remote Desktop Help Session manages and controls Remote Assistance.

sessmgr.exe.....(Microsoft® Remote Desktop Help Session Manager). <---Main Service File for both Remote Access Connection Manager and Remote Desktop Help Session Manager

Removable Storage

Removable Storage is used for managing removable media.

ntmssvc.dll.....(Removable Storage Manager). <---(Main Service File)

Routing and Remote Access (Dial-up Server for Windows)

Don't rack your brain too much on this because I doubt if very many people thoroughly understand Networking. Networking is a very complex subject.

Basically, Routing and Remote Access offers routing services in local area and wide area network environments. Routing and Remote Access service provides:

• Multiprotocol LAN-to-LAN, LAN-to-WAN, VPN, and NAT routing services

• Dial-up and VPN remote access services.

A Local Area Network (LAN) is a computer network covering a small local area, like a home, office, or small group of buildings such as a college.)

A wide Area Network (WAN) is a computer network covering a wide geographical area, involving a vast array of computers.

The process of Network Address Translation (NAT) involves re-writing the source and/or destination addresses of IP packets as they pass through a router or firewall.

A Virtual Private Network (VPN) is a private communications network usually used within a company, or by several different companies or organizations, to communicate over a public network.

Dial-up access uses a modem connected to the computer and a telephone line to dial the Internet Service Provider's (ISP) node to establish a modem-to-modem link, which is then routed to the Internet.

mprdim.dll......(Dynamic Interface Manager). <---(Main Service File)

Secondary Logon

Secondary Logon enables granting a user account with limited privileges the higher privileges necessary to start an application or process.

To see for yourself exactly what it is. When you right-click on an executable (a file whose contents are meant to be interpreted as a program by a computer -- a file with an .EXE extension), you will see the "Run As" option in the context menu. Selecting it will bring up the "Run As" dialog box, (or you could call it, the "Which user account do you want to run this program?" selection box).

seclogon.dll....(Secondary Logon Service DLL). <---(Main Service File)

Security Accounts Manager

Security Accounts Manager stores profile and security information for local user accounts.

Related to the Secondary Logon function and another security information stores. Very similar to Protected Storage.

Startup of Security Accounts Manager signals other services that the Security Accounts Manager is ready to accept requests.

SAMLIB.DLL......(SAM Library DLL). <---(Main Service File)

Security Center

Security Center monitors the status of Automatic Updates, Windows Firewall and virus protection software. Its "shield" icon is displayed in the System Tray.

If you do not want the Security Center to monitor these functions, disabling this service alone is not enough.

While Security Center is in its started state, go to Start > Control Panel > Security Center and select the link on the left-hand side labeled "Change the way Security Center alerts me."

In the resulting dialog box, uncheck Firewall, Automatic Update and Virus Protection.

After that step is complete, you may disable Security Center in your Services window, and it will not start again, and its "shield"icon will not be displayed in the System Tray.

wscsvc.dll......(Windows Security Center Service). <---(Main Service File)

Smart Card

Smart Card manages and controls access to a smart card inserted into a smart card reader attached to the computer.

A smart card, chip card, or integrated circuit(s) card (ICC), is defined as any pocket-sized card with embedded integrated circuits.

Contact smart card readers are used as a communications medium between the smart card and a host, e.g. a computer.

The standard perception of a smart card is a microprocessor card of credit card dimensions with tamper-resistant properties and is capable of providing security services (e.g. confidentiality of information in the memory).

If you don't have either a smart card or a smart card reader for your computer, you don't need this service enabled.

SCARDSVR.EXE....(Smart Card Resource Management Server). Smart Card Server component. <---(Main Service File)

SSDP Discovery Service

Universal Plug and Play (UPnP) is an architecture in Windows XP that supports peer-to-peer Plug and Play functionality for network devices.

A Universal Plug and Play device advertises its presence on the network to other devices and control points by using the Simple Service Discovery Protocol (SSDP).

A new control point uses SSDP to discover Universal Plug and Play devices on the network. The information that is exchanged between the device and the control point is limited to discovery messages that provide basic information about the devices and their services, and a description URL, which can be used to gather additional information about the device.

ssdpsrv.dll.....(SSDP Service DLL). <---(Main Service File)

System Event Notification

System Event Notification (SENS) tracks system events such as Windows logon network and power events. Notifies COM+ Event System subscribers of these events. SENS depends on COM+ Event System service.

sens.dll........System Event Notification Service (SENS) <---(Main Service File)

System Restore Service

The System Restore Application. Performs System Restore functions.

srsvc.dll.......(System Restore Service). <---(Main Service File)

Task Scheduler

Task Scheduler enables a user to configure and schedule automated tasks on a computer. The Task Scheduler monitors whatever criteria you choose and carries out the task at the designated time or interval.

Some third-party software require Task Scheduler to be running in order to carry out and perform scheduled and automated tasks, or maybe even for their automatic update features to work.

Anti-Virus programs generally require Task Scheduler be running. Prefetch requires Task Scheduler be running.

schedsvc.dll....(Task Scheduler Engine). <---(Main Service File)


TCP/IP NetBIOS Helper Service enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.

Sometimes called the TCP/IP Internet Protocol Suite, TCP (Transmission Control Protocol) and the IP (Internet Protocol) is the set of communications protocols that implement the protocol stack on which the Internet and most commercial networks run.

In the Internet Protocol Suite, Transmission Control Protocol is the intermediate layer between the Internet Protocol below it, and an application above it. Applications often need reliable pipe-like connections to each other, whereas the Internet Protocol does not provide such streams, but rather only unreliable packets. TCP does the task of the transport layer in the simplified OSI (Open Systems Interconnection) model of computer networks.

The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite. Using TCP, applications on networked hosts can create connections to one another, over which they can exchange data or packets. The protocol guarantees reliable and in-order delivery of sender to receiver data. TCP also distinguishes data for multiple, concurrent applications (e.g. Web server and email server) running on the same host.

TCP/IP (Transmission Control Protocol/Internet Protocol) NetBIOS (Network Basic Input/Output System) Helper Service enables support for NetBIOS over TCP/IP service and NetBIOS name resolution. (NetBIOS was originated for MS-DOS systems on small networks.)

TCP/IP is an extension of the kernel mode NetBT. The NetBT.sys driver is a kernel-mode component that supports the Transport Driver Interface (TDI) interface.

(A kernel is the core of an operating system, responsible for providing secure access to the machine's hardware and to various computer processes. A process is a computer program in a state of execution. A mode is a distinct setting within a computer program or any physical machine interface.)

Kernel mode drivers handle all I/O (Input/Output) devices. It is not even possible for user-mode code to access I/O hardware without the aid of a kernel mode driver.

The NetBIOS API (Network Basic Input/Output System Application Programming Interface) allows applications on separate computers to communicate over a local area network. It provides services related to the session layer of the OSI (Open Systems Interconnection) model. (OSI was eventually eclipsed by the Internet's TCP/IP protocol suite.)

(An Application Programming Interface (API) is the interface that a computer system, library or application provides in order to allow requests for service to be made of it by other computer programs, and/or to allow data to be exchanged between them.)

TCP/IP NetBIOS Helper should be considered an integral part of NetBT, not a normal service. It does two things for NetBT, which cannot be done in kernel mode:

• It performs DNS (Domain Name Server) name resolution.

• It pings a set of IP address and returns a list of reachable IP addresses.

(The Domain Name System, or Server (DNS) is a system that stores information associated with domain names in a distributed database on networks, such as the Internet. The Domain Name System associates many types of information with domain names, but most importantly, it provides the IP address (Internet Protocol address) associated with the domain name.)

(An Internet Protocol address is a unique number that devices use in order to identify and communicate with each other on a network utilizing the Internet Protocol standard.)

lmhsvc.dll......(TCPIP NetBios Transport Services DLL). <---(Main Service File)


Controls telephony devices on the local computer. This service is required for dial-up modem connectivity.

tapisrv.dll.....(Microsoft® Windows™ Telephony Server). <---(Main Service File)

Terminal Services

Terminal Services allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server.

termsrv.dll.....(Terminal Server Service). <---(Main Service File)

Uninterruptible Power Supply (Information forthcoming)

UPS.EXE.........(UPS Service). <---(Main Service File)

Universal Plug and Play Device Host

Universal Plug and Play (UPnP) is an architecture in Windows XP that supports peer-to-peer Plug and Play functionality for network devices.

UPnP isn't PnP (Plug and Play). UPnP is for connectivity to devices on networks. A UPnP device is external (not inside the computer case) and a part of the local network.

upnphost.dll.....(UPnP Device Host). <---Main Service File

Volume Shadow Copy

Volume Shadow Copy manages and implements Volume Shadow Copies used for backup and other purposes. Volume Shadow Copy is used in conjunction with the MS Software Shadow Copy Provider service. Microsoft Backup uses these services.

VSSVC.EXE.......(Microsoft® Volume Shadow Copy Service). Manages and implements a volume shadow copy for backup purposes. <---(Main Service File)


It's all about setting up a WebDAV publishing directory on your server.

WebClient enables Windows-based programs to create, access, and modify Internet-based files.

WebDAV (Web-based Distributed Authoring and Versioning) extends the HTTP/1.1 protocol to allow clients to publish, lock, and manage resources on the Web.

HyperText Transfer Protocol (HTTP) is the primary method used to transfer or convey information on the World Wide Web.)

You can disable the WebClient service as long as you do not have to modify or write files on Web Distributed Authoring and Versioning (WebDAV) servers.

webclnt.dll.....(Web DAV Service DLL). <---(Main Service File)

Windows Driver Foundation - User-mode Driver Framework (Installed by Windows Media Player 11.)

Per Microsoft: Windows Driver Foundation (WDF) defines a single driver model that supports the creation of object-oriented, event-driven drivers for either kernel mode or user mode. It simplifies driver development and maintenance by:

• Implementing common features.

• Providing intelligent defaults.

• Managing most interactions with the operating system.

With WDF, driver writers can focus on their device hardware, rather than on the operating system.

WDF includes frameworks for the development of kernel-mode and user-mode drivers along with several driver verification tools.

User-Mode Driver Framework (UMDF) supports the creation of user-mode drivers that support protocol-based or serial-bus-based devices. Such drivers handle the same types of I/O requests as kernel-mode drivers and are installed by INF files, just as kernel-mode drivers are.

WudfSvc.dll...........(Windows Driver Foundation - User-mode Driver Framework Service). <---(Main Service File)

Windows Firewall/Internet Connection Sharing (ICS)

Windows Firewall/Internet Connection Sharing (ICS) provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.

fwcfg.dll.......(Windows Firewall Configuration Helper). <---(Main Service File)

Windows Image Acquisition (WIA)

Windows Image Acquisition (WIA) provides image acquisition services for scanners and cameras. It enables a user to interface (interact) with scanners and still-image digital cameras when you plug these devices into your computer.

wiaservc.dll....(Still Image Devices Service). <---(Main Service File)

Windows Management Instrumentation

I know you have been told that Windows Management Instrumentation is very important to the operation of your system. I have never found it so. Maybe it is necessary for a couple of Services; e.g. Security Center and Windows Firewall, (services a lot of us disable anyway). But for the overall performance of your system it isn't important at all.

Most people don't know what Windows Management Instrumentation is. Yet, you will see things like this all the time, whenever you see a list of Windows XP Services:

"If you want everything to go smoothly, don't disable it."

Or, "If you don't want your computer to work, set this to Disabled."

Windows Management Instrumentation (WMI) provides system management information.

Windows Management Instrumentation provides accessible information about applications and services, including management events those applications and services may generate.

Now how vital does that sound?

Some people will tell you that System Restore will not work without Windows Management Instrumentation. This is untrue. System Restore will not work without the "framedyn.dll" file that is in the wbem folder.

When you go to disable WMI in Services, you will also be disabling Security Center and Windows Firewall/Internet Connection Sharing (ICS). Windows will give you a popup message up telling you that.

The main Service File for Windows Management Instrumentation is wmisvc.dll located in C:\WINDOWS\system32\wbem.

Windows Time

Windows Time sets the computer clock. It maintains date and time synchronization on your computer.

Synchronization can occur only when your computer is connected to the Internet. Windows Time automatically sets your clock by contacting a server (Microsoft's server by default) on the Internet. After it is successful with its time and date synchronizing duties, it will not attempt to do it again for seven days.

If this service is stopped, Windows Date and Time Synchronization will be unavailable.

If Task Scheduler is disabled, Windows Date and Time Synchronization will be unavailable.

You may choose to set your clock manually. Place the service in Manual mode. Open Date and Time Properties, (either through the Control Panel, or by double clicking on the time displayed in the System Tray). Select the Internet Time tab, and put a check in the empty box next to "Automatically synchronize with an Internet time server." Then click Update Now.

When Windows Time Automatic Synchronization is unsuccessful, the Event Viewer will display Event Log error messages telling you it was unsuccessful.

W32TIME.DLL.....(Windows Time Service). <---(Main Service File)

Windows User Mode Driver Framework (Information forthcoming)

wdfmgr.exe......(Windows User Mode Driver Manager). <---(Main Service File)

Wireless Zero Configuration

I wish I could say Wireless Zero Configuration means that we can finally get rid of all those wires under our desks. Alas, Wireless Zero Configuration provides automatic configuration for wireless network devices.

WZCSVC.DLL......(Wireless Zero Configuration Service). <---(Main Service File)

WMI Performance Adapter

WMI Performance Adapter Service provides performance library information from WMI HiPerf providers. As with Windows Management Instrumentation, this service all about system information retrieval. Only it makes that retrieval faster.

The Windows Management Instrumentation (WMI) high performance API (Application Program Interface) is a series of interfaces that increases the speed at which WMI client applications and scripts can obtain information from high performance WMI providers.

The Performance Counter provider is a High-Performance Provider (HiPerf provider) that provides raw counter data. The data is considered raw because it has been provided in an uncalculated form that must have formulas applied to be meaningful to users. (From here it gets really technical.)

The main Service File for WMI Performance Adapter is wmiapsrv.exe (WMI Performance Adapter Service) located in C:\WINDOWS\system32\wbem.
  • OnePiece and AZAdrion like this

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users