Windows XP Services Removal Guide

Windows Services List

I have made a complete list of the default System Services and some services that are not default. The "recommended" settings will not work on every computer configuration in the world, that would just make it all to easy :) However, they will work on most home computer configurations. Before using the recommended setting, I would recommend that you read the note beside each service. Some services may need to be left alone, after you have read the notes. Please do not forget to backup (See the backup section at the top of our guide).

Updates
I got an email from Jeroen Tulp, one of our oversea's viewers, and he said I should make this guide a little more newbie friendly, by replacing ENABLE with what it actually should be, like Automatic or Manual. Jeroen, has also been kind enough to send me a complete list of the services, and what "he" thinks each service should be set at. I didn't use all of his suggestions on them, but I did use the majority. Thanks for your input Jeroen! I have also updated a couple descriptions. A few users have emailed me telling me why a certain service should be enabled. I have included what they said, about the service, in the description. The emails just keep flowing in :) I was notified by Crystal Christensen, a Research Engineer for Microsoft, and she informed me about a few things about a certain service. The service she was explaining to me, was BITS, or Background Intelligent Transfer Service. I have included an update under the description of BITS. Crystal also states that by setting services to manual will not allow them to load, allowing the system to run faster, but also allows those services to be called upon and started when needed. (Windows will turn them on if they are needed). I already knew that, but just forgot to mention that in the guide. I have updated a few of the services "I think", should be set to manual.

Service Name	Recommended Setting	Notes
Alerter	Disable	Notifies users of administrative alerts. You can use the Alerter service to have Performance Monitor send you a network pop-up message and/or run a program when one of the counters exceeds a preset threshold. You really should not have a need for this service. If you know what it is and what it does, then you will know to leave it on.
Application Layer Gateway Service	Manual	Used for Assign Publish and Remove software services. Some users have emailed me and have told me that their computer needs this service. I have it disabled, and I'm doing fine. You should set this to manual, and if an application needs this service, it will start, otherwise it will not.
Automatic Updates	Disable	Contacts Microsoft's web site to see if there are any updates available for your computer. Honestly, I would rather go to windowsupdate.microsoft.com and update my computer rather than having it automatically update. Disabling this service will stop automatic windows updates. If you disable this service, don't forget to check for updates often!
Background Intelligent Transfer Service	Manual	Transfers files asynchronously between a client and an HTTP server. BITS only supports the HTTP 1.1 protocol. BITS continues to transfer the files after the application exits, as long as the user who initiated the transfer remains logged on, and a network connection is established-BITS will not force a connection. I got an email from Crystal, the person I told you about a few mins ago, and she say's disabling the Background Intelligent Transfer Service is not necessarily wise as more programs than you realize actually use this service. As well, RPC Locator that is important. More information: HTTP Requirements MSDN Whitepaper
ClipBook	Disable	Used to store information (cut/paste) and share it with other computers on the network.
COM+ Event System	Disable	I could not find a lot of information about COM+ Event System but here is what I found at Microsoft's site: The COM+ Events service uses an event class object to manage the connection between publisher and subscriber. The event class object is a COM+ component that is managed and stored by the COM+ Events system and contains the interfaces and methods used by a publisher to fire events. It is a persistent object that indicates the events that can occur and, optionally, identifies the publisher. You specify the interfaces and methods you want an event class to contain by providing a type library.
COM+ System Application	Disable	(See Com+ Event System Notes)
Computer Browser	Manual/Disable*	The Computer Browser Service component implements computer browsing functionality exposed by Windows through Microsoft Networking. It allows a client machine to browse its network neighborhood for available computers exposing file and print sharing services. This service is not needed on a standalone system. If you go to a lan party or you share files on your home network you might want to turn this on manual. Otherwise you can Disable it.
Cryptographic Services	Automatic	Basically it confirms signatures of Windows files You may always get a dialog box complaining about uncertified drivers if this is disabled. Keep it enabled in order to download updates from windowsupdate.microsoft.com
DHCP Client	Manual/Disable*	Receives a Dynamic IP address from your DHCP server. If you have a static ip (An ip that doesn't change) then you could turn this service off. If your on 56k or have a dynamic ip on your network, leave it as it is. I believe if you're running PPPoE software for your DSL, you must leave this on. Disable it only if you know that you have a static IP address.
Distributed Link Tracking Client	Disable	Maintains links with NTFS files within your computer or across a domain. I don't think many people would have a use for this unless you are on a corporate network. What Microsoft has to say: "The distributed link-tracking service enables client applications to track link sources that have been moved. Clients that subscribe to the link-tracking service can maintain the integrity of their references, and the objects can be tracked in a manner that is transparent to the user."
Distributed Transaction Coordinator	Disable	Microsoft says: "A transaction manager that coordinates transactions that span multiple resource managers. Work can be committed as an atomic transaction even if it spans multiple resource managers, potentially on separate computers." I don't exactly understand what all it does but I know when I have it disabled, it does no harm. Note: This service is used by Microsoft Message Queueing (MSMQ) for doing development using message queueing or running applications that uses it. If this applies to you, then you should not touch this service.
DNS Client	Automatic	Used to resolves hostnames on the Internet and Network. You should leave this on, for optimal Internet surfing performance.
Error Reporting Service	Disable	When a serious error occurs on your machine this service will phone home to Microsoft. I think it's a security and privacy breach. I recommend disabling this service.
Event Log	Automatic	This allows Event Log messages from applications to be viewed in Event Viewer. I have gotten an email from a user saying this: "Service is need for diskeeper defrag and remote access, auto connection manager plus remote access connection manager is needed for Pal a compuserve connection to work". I recommend leaving it enabled (automatic).
Fast User Switching Compatibility	Manual/Disable	This service allows you to quickly change the user that is logged in Windows. If you're the only user that users your computer then you can disable this service.
Help and Support	Disable	The dreaded Help and Support Service! This is the one I hate. It will automatically start and will automatically change itself to "Automatic" mode when you click the Help option on the start menu even if you have disabled the service! So if you ever bring up the Windows Help, always go back to the services and disable it again.
Human Interface Device Access	Manual/Disable	Some peripherals may stop working if you disable this service. I recommend setting it to manual so it may start if it needs to. You can disable it and find out if it affects any of your peripherals.
IMAPI CD-Burning COM Service	Manual/Disable*	This service is required for the built-in windows xp CD burning capability to operate. If you do not have a CD writer or do not use the Windows built-in burning software, you can disable this service.
Indexing Service	Disable	This service is a big resource hog, mostly for the CPU and I/O operations of your hard drive(s). The "Indexing" service is suppose to speed up searches when you are trying to locate a file on your hard drive. I have found that it does more harm than good. I would disable it.
Internet Connection Firewall and Internet Connection Sharing	Manual/Disable*	If your sharing your Internet access with other users on your network, leave this alone. Also, if you are using the Built-in Windows Firewall you should leave this alone. Otherwise if you are not using the built-in firewall (..but you are using another firewall I hope?) and you do not share your Internet access then you may disable this service.
IPSEC Services	Disable	This service controls many security restrictions on your computer. The average joe does not need this enabled.
Logical Disk Manager	Manual/Disable*	The Logical Disk Manager Configuration Library component is the configuration engine for dynamic disks. The component consists of a dynamic library that can be used to convert disks to dynamic and back to basic, and manage the volumes residing on dynamic disks. Management operations include create, delete, extend, mirror, repair, and others. You may need to keep this service on manual. If you do not plan to add hard drives or modify your partitions then you can disable this.
Logical Disk Manager Administrative Service	Manual/Disable*	Same as above.
Messenger	Disable	Disable this one! This is the dreaded Windows Messenger service, not to be confused with MSN Messenger. This service was originally made for administrators to send you messages over the network. This service is now being exploited by spammers to send you popup messages from over the Internet! Disable it. Disable it. Disable it.
MS Software Shadow Copy Provider	Manual	Used in conjunction with the Volume Shadow Copy Service. I would leave this service on manual since it will not automatically start with windows and can be started if it needs to be.
Net Login	Manual/Disable*	This service allows your machine to logon a domain controller. If you are not in a networked environment you can disable this service, otherwise leave it on manual.
NetMeeting Remote Desktop Sharing	Disable	Very bad idea to leave this on manual or automatic. Net meeting users can view your desktop with this service.
Network Connections	Automatic	Turning this off will probably prevent your Internet from working. Leave it alone.
Network DDE	Disable	Microsoft says: "Network DDE is used to initiate and maintain the network connections needed for DDE conversations between applications running on different computers in a network. A DDE conversation is the interaction between client and server applications. You use network DDE along with DDE and the DDE management library (DDEML) in your application." You can disable this.
Network DDE DSDM	Disable	See above.
Network Location Awareness (NLA)	Manual/Disable*	The Network Location Awareness Service component supports the Network Location Service. This component provides the infrastructure that informs applications and the operating system of the network connections on a specific computer and to adapt to that computer's connectivity. You can disable this only if you are NOT using Internet Connection Sharing.
NT LM Security Support Provider	Disable	As far as I know, you only need this service if you are running a telnet server. If anyone has any other information about this service, please email me and let me know. Thanks! Note: This service is used by Microsoft Message Queueing (MSMQ) for doing development using message queueing or running applications that uses it. If this applies to you, then you should not touch this service.
Performance Logs and Alerts	Disable	Collects performance data on a schedule and sends the information to a log or triggers an alert.
Plug and Play	Automatic/Disable*	This service will automatically detect and install new hardware you add to your computer. If you are not planning on adding new hardware anytime soon, you can disable this service. However, don't forget to enable it again before installing new hardware!
Portable Media Serial Number	Disable	Retrieves serial numbers from portable music players connected to your computer. Disable it unless something of yours ceases to function properly afterwards. I consider this a privacy risk, as it will be contacting a server on the Internet and telling them what music you listen to.
Print Spooler	Automatic/Disable*	I usually have this disabled until I use my printer. If you don't ever use a printer, you can disable it.
Protected Storage	Automatic/Disable*	Allows for the saving of local passwords or even web sites information (AutoComplete.) Don't disable if you use Autocomplete, otherwise for increase performance and extra security disable it! Had a guy name Kevin email me and told me that if you have MSN you will need to set this to auto.
QoS RSVP	Disable	Resource Reservation Protocol (RSVP) is an IETF-draft networking protocol dedicated to being the facilitator and carrier of standardized QOS information and parameters. RSVP carries generic (industry-defined) QOS parameters from end nodes (inclusive) to each QOS-aware network device included in the path between RSVP session members. That is, RSVP is a means by which end nodes and network devices can communicate and negotiate QOS parameters and network usage admission. I recommend disabling this service as it uses resources and it is also a known fact that is can cut your bandwidth speed by 20% for it's own use.
Remote Access Auto Connection Manager	Manual/Disable*	Creates a connection to a network when a program requests a remote address. If things cease to function after disabling this service, put it to manual. (UPDATE) I have gotten word that this service along with the service below, are needed for 56k and dailup connections. If you have a dialup connection set this to manual. If you have problems, set it to automatic.
Remote Access Connection Manager	Manual/Disable*	See above.
Remote Desktop Help Session Manager	Disable	Yet another useless security risk in Windows. Disable it.
Remote Procedure Call (RPC)	Automatic	Leave this on unless you want to wreak havoc on your system! Almost every service requires this service to be on.
Remote Procedure Call (RPC) Locator	Disable	Microsoft Locator is the default name service that ships with Microsoft® Windows NT®/Windows 2000. The RPC run-time library uses it to find server programs on server host systems. Prior to Windows 2000, Microsoft Locator did not provide persistent name service entries. All entries in the name service were stored in a memory cache on the server program's host computer. The locator used a broadcast mechanism to discover the location of servers as requested by clients. Whenever the host system shut down, all name service entries were lost.
Remote Registry Service	Disable	Turn this off! This allows remote users access to your registry!
Removable Storage	Automatic/Disable*	Used for managing removable media. Disable this service if you do not have items like tape backup devices, etc. If your CD ROM/DVD Drive starts acting funny, place this service into Automatic. I also believe removable flash memory will need this service left on. It's your call.
Routing and Remote Access	Disable	The average joe does not need this service on. Turn it off unless you're in a corporate network environment.
Secondary Logon	Disable	The only information I have found about this is: "Enables starting processes under alternate credentials." I have mine disabled and have found no problems.
Security Accounts Manager	Disable	This is like Protected Storage, it's a security risk and needs to be turned off.
Server	Automatic/Disable*	If you share files, internet, or printers across a network, leave this alone. Otherwise disable it.
Shell Hardware Detection	Automatic	Used for the auto play of devices like memory cards, etc. Some laptops need this, for their docking station.. This also disable Autoplay tab for CD/DVD tabs.
Smart Card	Disable	If you do not have a "Smart Card," or you do not know what a Smart Card is, you do not need this service running.
Smart Card Helper	Disable	See above.
SSDP Discovery Service	Disable	Disable this, even Microsoft says it's a security risk.
System Event Notification	Disable	Used in conjunction with COM+ Event System, this service notifies particular services when system events, such as logon and power events occurs.
System Restore Service	Automatic/Disable*	This service is required for the Windows Restore to function. If you have no use for the system restore, then you can disable this service. I'll leave it up to you :)
Task Scheduler	Disable	Disable this, it uses resources.. If you have some Anti-virus software like Norton, it may depend on this service to run auto virus scans, every week or something.. So the choice is yours.
TCP/IP NetBIOS Helper Service	Disable	If your network does not use NetBios, disable this function. (This is a security risk, disable it)
Telephony	Automatic/Disable*	If you're on dialup leave this alone. However if you got Cable, DSL with router, LAN connection disable it. A guy named Craig, emailed me and told me that if your dsl is PPPoE, then you need to turn this service on. However, if your DSL goes thru your router, like myself, you can disable this service.
Telnet	Disable	Big security risk! Disable this as it can allow users access to your system remotely.
Terminal Services	Automatic/Disable*	Allows remote login to the local computer. This service is Required for Fast User Switching, Remote Desktop and Remote Assistance. If you have those services disabled, then you may disable this service.
Themes	Automatic/Disable*	Used to display the graphical operations in Windows XP like the "Green Start Button" and other graphical things. If you would rather go back to the old "Classic" graphical user interface like Windows 2000 and Windows 98 then you can disable this service and get a nice performance boost.
Uninterruptible Power Supply	Disable	Unless you have a UPS connected to your computer by a "serial or USB port" then you can disable this service.
Universal Plug and Play Device Host	Disable	Used in conjunction with SSDP Discovery Service, it detects and configures UPnP devices on your home network. Disable it for security reasons!
Upload Manager	Manual/Disable*	This service is needed for the Internet Connection Sharing. If you have Internet Connection Sharing disabled, you may disable this service.
Volume Shadow Copy	Disable	Shadow Copy Provider service requires this service. If you have it enabled, leave this service alone, otherwise you may disable it.
WebClient	Disable	I have never found a use for this service. I have it disabled. If anyone knows more information about this service, please let me know.
Windows Audio	Automatic	This service is required if you want audio on your computer. If you're computer is a service, then you could disable this service.
Windows Image Acquisition (WIA)	Manual/Disable*	This is used by cameras, scanners, and digital video cameras. You can disable it and see if your devices still work.
Windows Installer	Manual	Required to install programs that use the .MSI Setup Installer.
Windows Management Instrumentation	Automatic	Do NOT touch this service.
Windows Management Instrumentation Driver Extension	Automatic	Read above.
Windows Time	Disable	Contacts time servers on the Internet to set your clocks time. I would disable this privacy risk!
Wireless Zero Configuration	Manual/Disable*	You may disable this service if you do not have any wireless (802.11a/b/g) devices.
WMI Performance Adapter	Disable	Yet another service we know little about. I have it disabled.
Workstation	Automatic	Leave this on, as Windows will need it to operate.