Services Windows 11 Services

A list of the default services in Windows 11 (23H2).

The links above will open a Google search for the service name targeted at Microsoft.com, this will often find a more detailed description of what the service does.

Clicking the headers of the table above will sort by that column.

Per-User Services

Some of the services listed above are per-user services, indicated by ????? at the end of the service name, this represents a locally unique identifier (LUID), a 4 to 7 digit string thats unique to each user of the computer.

Per-user services are created when a user signs into Windows and are stopped and deleted when that user signs out.

List services

To document all the services currently installed:

SC QUERY state= all |findstr "DISPLAY_NAME STATE" >my_services.csv

or

Get-Service | select name,displayname,starttype | Export-csv services.csv -NoTypeInformation

Svchost.exe

Svchost.exe is a generic host process name for services that run from dynamic-link libraries.

Many Windows services run from a .DLL file rather than a .EXE which can be launched directly. Svchost.exe is a reusable shell used to launch a DLL file and startup the relevant service. The task manager in Windows 10 lists these processes under Service Host: Name of Service.

Disabling Services

It is inadvisable to disable a service without being aware of the consequences, always start by setting the service to manual, reboot and test for any problems.

A service set to manual will be automatically restarted if another service is dependent on it.
A service set to disabled will not restart even if it’s required to boot the machine!

If a service crashes the machine at startup, you can DISABLE it using the recovery console.

Stopping or disabling a service will generally save a small amount of memory and will reduce the number of software interrupts (cpu message queue.) The main reason for tinkering with services is to harden the system against security vulnerabilities. Disable everything that you don’t need or use - then any future problems with those services cannot affect the machine.

Many services communicate and send data directly to Microsoft servers, while this is not generally something to lose sleep over. Managing the running of these services might be a consideration if confidentiality or anonymity is highly important to you.

Registry Settings

Data about Services is stored in the registry under:

HKEY_Local_Machine\System\CurrentControlSet\Services\

The Start Subkey determines the startup type:

DWORD	Startup type	Description
0	Boot	Loaded by kernel loader. Components of the driver stack for the boot (startup) volume must be loaded by the kernel loader.
1	System	Loaded by I/O subsystem. Specifies that the driver is loaded at kernel initialization.
2	Automatic	Loaded by Service Control Manager. Specifies that the service is loaded or started automatically.
3	Manual	The service does not start until the user starts it manually, such as by using Services or Devices in Control Panel, or when triggered by another running program or scheduled task.
4	Disabled	Specifies that the service should not be started.

Remove a service completely

To delete a service use the SC DELETE command, or in PowerShell Remove-Service.
SC delete NameofServiceTodelete

Built-in Service Accounts

In addition to other Default User & Group accounts there are 3 built-in accounts, designed for running background services.

Local Service Account (NT AUTHORITY\LOCAL SERVICE) - has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard the system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session without credentials. (This account is not supported for running SQL Server services.)

Network Service Account (NT AUTHORITY\NETWORK SERVICE) - has more access to resources and objects than members of the Users group. Services that run as the Network Service account access network resources by using the credentials of the computer account.

Local System Account (NT AUTHORITY\SYSTEM) - a very high-privileged built-in account. It has extensive privileges on the local system and acts as the computer on the network.

The security group All Services (NT SERVICES\ALL SERVICES) includes all service processes that are configured on the system. Membership of this group is controlled by the OS.

Managed Service Accounts provide automatic password management and simplified service principal name (SPN) management.
(Primarily intended for IIS). Managed Service accounts are created in PowerShell with New-ADServiceAccount

Files:
windows\system32\drivers\etc\services

"The service we render to others is really the rent we pay for our room on this earth. It is obvious that man is himself a traveler; that the purpose of this world is not 'to have and to hold' but ’to give and serve.' There can be no other meaning" ~ Sir Wilfred T. Grenfell

Related commands

SC - Service Control.
TASKLIST - List running tasks and services.
MSINFO32 - Windows System Information.
Services.msc
PORTQRY - Enumerate local services, SQL Server instances, Local ports, and the DLL modules loaded.
How-to: ServiceStatus.ps1 - List all services (PowerShell).
Safe Mode - Press F8 during bootup to start with minimal services running.
WMIC SERVICE - WMI access to services.
DComCnfg - Disable/configure Component Services.
Q137890 - SRVANY - create an NT Service from any executable. Not supported on current OS’s use a Scheduled Task instead.