System.Service.ServiceController#StartupType System.Service.ServiceController#BinaryPathName System.Service.ServiceController#DelayedAutoStart System.Service.ServiceController#Description System.Service.ServiceController#UserName System.ServiceProcess.ServiceController System.ComponentModel.Component System.MarshalByRefObject System.Object AarSvc_9164d false false false Agent Activation Runtime_9164d System.ServiceProcess.ServiceController[] System.Array System.Object . AarSvc_9164d System.ServiceProcess.ServiceStartMode System.Enum System.ValueType System.Object Manual 3 System.ServiceProcess.ServiceControllerStatus System.Enum System.ValueType System.Object Stopped 1 System.ServiceProcess.ServiceType System.Enum System.ValueType System.Object 224 224 Runtime for activating conversational agent applications false C:\WINDOWS\system32\svchost.exe -k AarSvcGroup -p Microsoft.PowerShell.Commands.ServiceStartupType System.Enum System.ValueType System.Object Manual 3 AarSvc_9164d AdobeUpdateService false false true AdobeUpdateService . AdobeUpdateService Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem false "C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe" Automatic 2 AdobeUpdateService AGMService false true true Adobe Genuine Monitor Service . AGMService Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Adobe Genuine Monitor Service false "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe" Automatic 2 AGMService AGSService false true true Adobe Genuine Software Integrity Service . AGSService Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Adobe Genuine Software Integrity Service false "C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe" Automatic 2 AGSService AJRouter false false false AllJoyn Router Service . AJRouter Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Routes AllJoyn messages for the local AllJoyn clients. If this service is stopped the AllJoyn clients that do not have their own bundled routers will be unable to run. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 AJRouter ALG false false false Application Layer Gateway Service . ALG Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\LocalService Provides support for 3rd party protocol plug-ins for Internet Connection Sharing false C:\WINDOWS\System32\alg.exe Manual 3 ALG AppIDSvc false false false Application Identity System.ServiceProcess.ServiceController System.ComponentModel.Component System.MarshalByRefObject System.Object applockerfltr false false false Smartlocker Filter Driver . applockerfltr FltMgr AppID AppIDSvc Manual Stopped KernelDriver applockerfltr . AppIDSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs AppID false false false AppID Driver applockerfltr AppIDSvc . AppID FltMgr Manual Stopped KernelDriver AppID CryptSvc false true true Cryptographic Services applockerfltr AppIDSvc . CryptSvc RpcSs Automatic Running Win32OwnProcess, Win32ShareProcess CryptSvc Manual 3 Stopped 1 Win32ShareProcess 32 NT Authority\LocalService Determines and verifies the identity of an application. Disabling this service will prevent AppLocker from being enforced. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 AppIDSvc Appinfo false false true Application Information . Appinfo RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs ProfSvc false true true User Profile Service XblGameSave TokenBroker UserManager shpamsvc NaturalAuthentication Appinfo . ProfSvc RpcSs Automatic Running Win32OwnProcess, Win32ShareProcess ProfSvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Facilitates the running of interactive applications with additional administrative privileges. If this service is stopped, users will be unable to launch applications with the additional administrative privileges they may require to perform desired user tasks. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 Appinfo AppMgmt false false false Application Management . AppMgmt Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Processes installation, removal and enumeration requests for software deployed through Group Policy. If the service is disabled, users will be unable to install, remove or enumerate software deployed through Group Policy. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 AppMgmt AppReadiness false false false App Readiness . AppReadiness Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Gets apps ready for use the first time a user signs in to this PC and when adding new apps. false C:\WINDOWS\System32\svchost.exe -k AppReadiness -p Manual 3 AppReadiness AppVClient false false false Microsoft App-V Client . AppVClient RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS netprofm false false true Network List Service NcdAutoSetup AppVClient . netprofm RpcSs nlasvc Manual Running Win32OwnProcess, Win32ShareProcess netprofm AppvVfs false false false AppvVfs AppVClient . AppvVfs FltMgr AppvVemgr Manual Stopped FileSystemDriver AppvVfs AppvStrm false false false AppVStrm AppVClient . AppvStrm FltMgr Manual Stopped FileSystemDriver AppvStrm Disabled 4 Stopped 1 Win32OwnProcess 16 LocalSystem Manages App-V users and virtual applications false C:\WINDOWS\system32\AppVClient.exe Disabled 4 AppVClient AppXSvc false true true AppX Deployment Service (AppXSVC) . AppXSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss staterepository false true true State Repository Service LxssManager AppXSvc . staterepository rpcss Manual Running Win32OwnProcess, Win32ShareProcess staterepository Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides infrastructure support for deploying Store applications. This service is started on demand and if disabled Store applications will not be deployed to the system, and may not function properly. false C:\WINDOWS\system32\svchost.exe -k wsappx -p Manual 3 AppXSvc aspnet_state false false false ASP.NET State Service . aspnet_state Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe Manual 3 aspnet_state AssignedAccessManagerSvc false false false AssignedAccessManager Service . AssignedAccessManagerSvc Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem AssignedAccessManager Service supports kiosk experience in Windows. false C:\WINDOWS\system32\svchost.exe -k AssignedAccessManagerSvc Manual 3 AssignedAccessManagerSvc AudioEndpointBuilder false false true Windows Audio Endpoint Builder AarSvc_9164d false false false Agent Activation Runtime_9164d . AarSvc_9164d Manual Stopped 224 AarSvc_9164d AarSvc false false false Agent Activation Runtime . AarSvc Audiosrv Manual Stopped 96 AarSvc Audiosrv false false true Windows Audio AarSvc_9164d AarSvc . Audiosrv AudioEndpointBuilder RpcSs Automatic Running Win32OwnProcess Audiosrv . AudioEndpointBuilder Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Manages audio devices for the Windows Audio service. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Automatic 2 AudioEndpointBuilder Audiosrv false false true Windows Audio AarSvc_9164d false false false Agent Activation Runtime_9164d . AarSvc_9164d Manual Stopped 224 AarSvc_9164d AarSvc false false false Agent Activation Runtime . AarSvc Audiosrv Manual Stopped 96 AarSvc . Audiosrv AudioEndpointBuilder false false true Windows Audio Endpoint Builder AarSvc_9164d AarSvc Audiosrv . AudioEndpointBuilder Automatic Running Win32OwnProcess, Win32ShareProcess AudioEndpointBuilder RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess 16 NT AUTHORITY\LocalService Manages audio for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p Automatic 2 Audiosrv autotimesvc false false false Cellular Time . autotimesvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\LocalService This service sets time based on NITZ messages from a Mobile Network false C:\WINDOWS\system32\svchost.exe -k autoTimeSvc Manual 3 autotimesvc AxInstSV false false false ActiveX Installer (AxInstSV) . AxInstSV rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides User Account Control validation for the installation of ActiveX controls from the Internet and enables management of ActiveX control installation based on Group Policy settings. This service is started on demand and if disabled the installation of ActiveX controls will behave according to default browser settings. false C:\WINDOWS\system32\svchost.exe -k AxInstSVGroup Manual 3 AxInstSV BcastDVRUserService_9164d false false false GameDVR and Broadcast User Service_9164d . BcastDVRUserService_9164d Manual 3 Stopped 1 240 240 This user service is used for Game Recordings and Live Broadcasts false C:\WINDOWS\system32\svchost.exe -k BcastDVRUserService Manual 3 BcastDVRUserService_9164d BDESVC false false true BitLocker Drive Encryption Service . BDESVC Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 localSystem BDESVC hosts the BitLocker Drive Encryption service. BitLocker Drive Encryption provides secure startup for the operating system, as well as full volume encryption for OS, fixed or removable volumes. This service allows BitLocker to prompt users for various actions related to their volumes when mounted, and unlocks volumes automatically without user interaction. Additionally, it stores recovery information to Active Directory, if available, and, if necessary, ensures the most recent recovery certificates are used. Stopping or disabling the service would prevent users from leveraging this functionality. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 BDESVC BFE false false true Base Filtering Engine . BFE RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32ShareProcess 32 NT AUTHORITY\LocalService The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p Automatic 2 BFE BITS false false false Background Intelligent Transfer Service . BITS RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN Explorer, will be unable to automatically download programs and other information. true C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 BITS BluetoothUserService_9164d false false true Bluetooth User Support Service_9164d . BluetoothUserService_9164d Manual 3 Running 4 240 240 The Bluetooth user service supports proper functionality of Bluetooth features relevant to each user session. false C:\WINDOWS\system32\svchost.exe -k BthAppGroup -p Manual 3 BluetoothUserService_9164d BrokerInfrastructure false false false Background Tasks Infrastructure Service . BrokerInfrastructure RpcEptMapper false false false RPC Endpoint Mapper . RpcEptMapper Automatic Running Win32ShareProcess RpcEptMapper DcomLaunch false false false DCOM Server Process Launcher . DcomLaunch Automatic Running Win32ShareProcess DcomLaunch RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem Windows infrastructure service that controls which background tasks can run on the system. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Automatic 2 BrokerInfrastructure BrYNSvc true false true BrYNSvc . BrYNSvc RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Running 4 Win32OwnProcess 16 LocalSystem false "C:\Program Files (x86)\Browny02\BrYNSvc.exe" Manual 3 BrYNSvc BTAGService false false true Bluetooth Audio Gateway Service . BTAGService rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Service supporting the audio gateway role of the Bluetooth Handsfree Profile. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted Manual 3 BTAGService BthAvctpSvc false false true AVCTP service . BthAvctpSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService This is Audio Video Control Transport Protocol service false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 BthAvctpSvc bthserv false true true Bluetooth Support Service BluetoothUserService_9164d false false true Bluetooth User Support Service_9164d . BluetoothUserService_9164d Manual Running 240 BluetoothUserService_9164d BluetoothUserService false false false Bluetooth User Support Service . BluetoothUserService bthserv rpcss Manual Stopped 96 BluetoothUserService . bthserv Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService The Bluetooth service supports discovery and association of remote Bluetooth devices. Stopping or disabling this service may cause already installed Bluetooth devices to fail to operate properly and prevent new devices from being discovered or associated. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 bthserv c2wts false false false Claims to Windows Token Service . c2wts Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Service to convert claims based identities to windows identities false C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe Manual 3 c2wts camsvc false true true Capability Access Manager Service . camsvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides facilities for managing UWP apps access to app capabilities as well as checking an app's access to specific app capabilities false C:\WINDOWS\system32\svchost.exe -k appmodel -p Manual 3 camsvc CaptureService_9164d false false false CaptureService_9164d . CaptureService_9164d Manual 3 Stopped 1 224 224 Enables optional screen capture functionality for applications that call the Windows.Graphics.Capture API. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 CaptureService_9164d cbdhsvc_9164d false false true Clipboard User Service_9164d . cbdhsvc_9164d Manual 3 Running 4 240 240 This user service is used for Clipboard scenarios false C:\WINDOWS\system32\svchost.exe -k ClipboardSvcGroup -p Manual 3 cbdhsvc_9164d CDPSvc false false true Connected Devices Platform Service . CDPSvc ncbservice false false true Network Connection Broker CDPSvc . ncbservice RpcSS tcpip BrokerInfrastructure Manual Running Win32OwnProcess, Win32ShareProcess ncbservice RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS Tcpip false false true TCP/IP Protocol Driver WinNat NetBT tdx tcpipreg Tcpip6 PolicyAgent NcdAutoSetup AppVClient netprofm NlaSvc Ndu CDPSvc NcbService IPNAT NcaSvc iphlpsvc IpFilterDriver debugregsvc . Tcpip Boot Running KernelDriver Tcpip Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService This service is used for Connected Devices Platform scenarios true C:\WINDOWS\system32\svchost.exe -k LocalService -p AutomaticDelayedStart 10 CDPSvc CDPUserSvc_9164d false false true Connected Devices Platform User Service_9164d . CDPUserSvc_9164d Automatic 2 Running 4 240 240 This user service is used for Connected Devices Platform scenarios false C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup Automatic 2 CDPUserSvc_9164d CertPropSvc false true true Certificate Propagation . CertPropSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Copies user certificates and root certificates from smart cards into the current user's certificate store, detects when a smart card is inserted into a smart card reader, and, if needed, installs the smart card Plug and Play minidriver. false C:\WINDOWS\system32\svchost.exe -k netsvcs Manual 3 CertPropSvc ClickToRunSvc false true true Microsoft Office Click-to-Run Service . ClickToRunSvc Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem ‪Manages resource coordination, background streaming, and system integration of Microsoft Office products and their related updates. This service is required to run during the use of any Microsoft Office program, during initial streaming installation and all subsequent updates.‬ false "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service Automatic 2 ClickToRunSvc ClipSVC false true true Client License Service (ClipSVC) . ClipSVC rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled applications bought using Windows Store will not behave correctly. false C:\WINDOWS\System32\svchost.exe -k wsappx -p Manual 3 ClipSVC com.docker.service false true true Docker Desktop Service . com.docker.service LanmanServer false false true Server com.docker.service . LanmanServer SamSS Srv2 Automatic Running Win32OwnProcess, Win32ShareProcess LanmanServer Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem false "C:\Program Files\Docker\Docker\com.docker.service" Automatic 2 com.docker.service COMSysApp false false false COM+ System Application . COMSysApp RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs EventSystem false false true COM+ Event System COMSysApp SENS . EventSystem rpcss Automatic Running Win32OwnProcess, Win32ShareProcess EventSystem SENS false false true System Event Notification Service COMSysApp . SENS EventSystem Automatic Running Win32OwnProcess, Win32ShareProcess SENS Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} Manual 3 COMSysApp ConsentUxUserSvc_9164d false false false ConsentUX_9164d . ConsentUxUserSvc_9164d Manual 3 Stopped 1 224 224 Allows ConnectUX and PC Settings to Connect and Pair with WiFi displays and Bluetooth devices. false C:\WINDOWS\system32\svchost.exe -k DevicesFlow Manual 3 ConsentUxUserSvc_9164d CoreMessagingRegistrar false false false CoreMessaging . CoreMessagingRegistrar rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Automatic 2 Running 4 Win32ShareProcess 32 NT AUTHORITY\LocalService Manages communication between system components. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p Automatic 2 CoreMessagingRegistrar cphs false false true Intel(R) Content Protection HECI Service . cphs RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Running 4 Win32OwnProcess 16 LocalSystem Intel(R) Content Protection HECI Service - enables communication with the Content Protection FW false C:\WINDOWS\System32\DriverStore\FileRepository\64gh6293.inf_amd64_22fd8f9659edd17f\IntelCpHeciSvc.exe Manual 3 cphs cplspcon false false true Intel(R) Content Protection HDCP Service . cplspcon Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Intel(R) Content Protection HDCP Service - enables communication with Content Protection HDCP HW false C:\WINDOWS\System32\DriverStore\FileRepository\64gh6293.inf_amd64_22fd8f9659edd17f\IntelCpHDCPSvc.exe Automatic 2 cplspcon CredentialEnrollmentManagerUserSvc_9164d false false false CredentialEnrollmentManagerUserSvc_9164d . CredentialEnrollmentManagerUserSvc_9164d Manual 3 Stopped 1 208 208 Credential Enrollment Manager false C:\WINDOWS\system32\CredentialEnrollmentManager.exe Manual 3 CredentialEnrollmentManagerUserSvc_9164d CryptSvc false true true Cryptographic Services applockerfltr false false false Smartlocker Filter Driver . applockerfltr FltMgr AppID AppIDSvc Manual Stopped KernelDriver applockerfltr AppIDSvc false false false Application Identity applockerfltr . AppIDSvc RpcSs AppID CryptSvc Manual Stopped Win32ShareProcess AppIDSvc . CryptSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\NetworkService Provides three management services: Catalog Database Service, which confirms the signatures of Windows files and allows new programs to be installed; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Automatic Root Certificate Update Service, which retrieves root certificates from Windows Update and enable scenarios such as SSL. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k NetworkService -p Automatic 2 CryptSvc CscService false false false Offline Files . CscService RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem The Offline Files service performs maintenance activities on the Offline Files cache, responds to user logon and logoff events, implements the internals of the public API, and dispatches interesting events to those interested in Offline Files activities and changes in cache state. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 CscService DcomLaunch false false false DCOM Server Process Launcher . DcomLaunch Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service running. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Automatic 2 DcomLaunch debugregsvc false false false debugregsvc . debugregsvc Dnscache false false false DNS Client RemoteAccess RasMan NcaSvc debugregsvc . Dnscache nsi Afd Automatic Running Win32OwnProcess, Win32ShareProcess Dnscache Tcpip false false true TCP/IP Protocol Driver WinNat NetBT tdx tcpipreg Tcpip6 PolicyAgent NcdAutoSetup AppVClient netprofm NlaSvc Ndu CDPSvc NcbService IPNAT NcaSvc iphlpsvc IpFilterDriver debugregsvc . Tcpip Boot Running KernelDriver Tcpip Automatic 2 Stopped 1 Win32OwnProcess 16 LocalSystem Provides helper APIs to enable device discovery and debugging over the network false C:\WINDOWS\System32\svchost.exe -k DevToolsGroup Automatic 2 debugregsvc defragsvc false false false Optimise drives . defragsvc RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 localSystem Helps the computer run more efficiently by optimising files on storage drives. false C:\WINDOWS\system32\svchost.exe -k defragsvc Manual 3 defragsvc DeveloperToolsService false false false Developer Tools Service . DeveloperToolsService Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Enables scenarios for remote UWP application deployment and debugging false C:\WINDOWS\System32\DeveloperToolsSvc.exe Manual 3 DeveloperToolsService DeviceAssociationBrokerSvc_9164d false false false DeviceAssociationBroker_9164d . DeviceAssociationBrokerSvc_9164d Manual 3 Stopped 1 224 224 Enables apps to pair devices false C:\WINDOWS\system32\svchost.exe -k DevicesFlow -p Manual 3 DeviceAssociationBrokerSvc_9164d DeviceAssociationService false true true Device Association Service . DeviceAssociationService Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables pairing between the system and wired or wireless devices. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Automatic 2 DeviceAssociationService DeviceInstall false false false Device Install Service . DeviceInstall Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Manual 3 DeviceInstall DevicePickerUserSvc_9164d false false false DevicePicker_9164d . DevicePickerUserSvc_9164d Manual 3 Stopped 1 224 224 This user service is used for managing the Miracast, DLNA and DIAL UI false C:\WINDOWS\system32\svchost.exe -k DevicesFlow Manual 3 DevicePickerUserSvc_9164d DevicesFlowUserSvc_9164d false false false DevicesFlow_9164d . DevicesFlowUserSvc_9164d Manual 3 Stopped 1 224 224 Allows ConnectUX and PC Settings to Connect and Pair with WiFi displays and Bluetooth devices. false C:\WINDOWS\system32\svchost.exe -k DevicesFlow Manual 3 DevicesFlowUserSvc_9164d DevQueryBroker false true true DevQuery Background Discovery Broker . DevQueryBroker Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables apps to discover devices with a backgroud task false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 DevQueryBroker Dhcp false true true DHCP Client NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE dnscache NSI iphlpsvc Manual Stopped Win32OwnProcess, Win32ShareProcess NcaSvc iphlpsvc false false true IP Helper NcaSvc . iphlpsvc RpcSS winmgmt tcpip nsi WinHttpAutoProxySvc Automatic Running Win32OwnProcess, Win32ShareProcess iphlpsvc WinHttpAutoProxySvc false true false WinHTTP Web Proxy Auto-Discovery Service NcaSvc iphlpsvc . WinHttpAutoProxySvc Dhcp Manual Running Win32OwnProcess, Win32ShareProcess WinHttpAutoProxySvc NcdAutoSetup false false true Network Connected Devices Auto-Setup . NcdAutoSetup netprofm Manual Running Win32OwnProcess, Win32ShareProcess NcdAutoSetup AppVClient false false false Microsoft App-V Client . AppVClient RpcSS netprofm AppvVfs AppvStrm Disabled Stopped Win32OwnProcess AppVClient netprofm false false true Network List Service NcdAutoSetup AppVClient . netprofm RpcSs nlasvc Manual Running Win32OwnProcess, Win32ShareProcess netprofm NlaSvc false false true Network Location Awareness NcdAutoSetup AppVClient netprofm . NlaSvc NSI RpcSs TcpIp Dhcp Eventlog Automatic Running Win32OwnProcess, Win32ShareProcess NlaSvc . Dhcp NSI false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . NSI rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess NSI Afd false false true Ancillary Function Driver for Winsock lmhosts RemoteAccess RasMan NcaSvc debugregsvc Dnscache iphlpsvc WinHttpAutoProxySvc NcdAutoSetup AppVClient netprofm NlaSvc Dhcp . Afd System Running KernelDriver Afd Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\LocalService Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Automatic 2 Dhcp diagnosticshub.standardcollector.service false false false Microsoft (R) Diagnostics Hub Standard Collector Service . diagnosticshub.standardcollector.service Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Diagnostics Hub Standard Collector Service. When running, this service collects real time ETW events and processes them. false C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe Manual 3 diagnosticshub.standardcollector.service diagsvc false false false Diagnostic Execution Service . diagsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Executes diagnostic actions for troubleshooting support false C:\WINDOWS\System32\svchost.exe -k diagnostics Manual 3 diagsvc DiagTrack false true true Connected User Experiences and Telemetry . DiagTrack RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem The Connected User Experiences and Telemetry service enables features that support in-application and connected user experiences. Additionally, this service manages the event driven collection and transmission of diagnostic and usage information (used to improve the experience and quality of the Windows Platform) when the diagnostics and usage privacy option settings are enabled under Feedback and Diagnostics. false C:\WINDOWS\System32\svchost.exe -k utcsvc -p Automatic 2 DiagTrack DispBrokerDesktopSvc false false true Display Policy Service . DispBrokerDesktopSvc RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Manages the connection and configuration of local and remote displays true C:\WINDOWS\system32\svchost.exe -k LocalService -p AutomaticDelayedStart 10 DispBrokerDesktopSvc DisplayEnhancementService false false true Display Enhancement Service . DisplayEnhancementService Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem A service for managing display enhancement such as brightness control. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 DisplayEnhancementService DmEnrollmentSvc false false false Device Management Enrollment Service . DmEnrollmentSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Performs Device Enrollment Activities for Device Management false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 DmEnrollmentSvc dmwappushservice false false false Device Management Wireless Application Protocol (WAP) Push message Routing Service . dmwappushservice rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Routes Wireless Application Protocol (WAP) Push messages received by the device and synchronizes Device Management sessions true C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 dmwappushservice Dnscache false false false DNS Client RemoteAccess false false false Routing and Remote Access . RemoteAccess RpcSS Bfe RasMan Http Disabled Stopped Win32ShareProcess RemoteAccess RasMan false true true Remote Access Connection Manager RemoteAccess . RasMan SstpSvc DnsCache Automatic Running Win32ShareProcess RasMan NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE dnscache NSI iphlpsvc Manual Stopped Win32OwnProcess, Win32ShareProcess NcaSvc debugregsvc false false false debugregsvc . debugregsvc Dnscache Tcpip Automatic Stopped Win32OwnProcess debugregsvc . Dnscache nsi false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . nsi rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess nsi Afd false false true Ancillary Function Driver for Winsock lmhosts RemoteAccess RasMan NcaSvc debugregsvc Dnscache iphlpsvc WinHttpAutoProxySvc NcdAutoSetup AppVClient netprofm NlaSvc Dhcp . Afd System Running KernelDriver Afd Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\NetworkService The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k NetworkService -p Automatic 2 Dnscache docker false true true Docker Engine . docker Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem false "C:\Program Files\Docker\Docker\resources\dockerd.exe" --run-service --service-name docker -G docker-users --config-file C:\ProgramData\DockerDesktop\tmp-d4w\daemon.json Automatic 2 docker DoSvc false false true Delivery Optimization . DoSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\NetworkService Performs content delivery optimization tasks true C:\WINDOWS\System32\svchost.exe -k NetworkService -p AutomaticDelayedStart 10 DoSvc dot3svc false false false Wired AutoConfig . dot3svc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Ndisuio false false true NDIS Usermode I/O Protocol wlpasvc WwanSvc WlanSvc dot3svc . Ndisuio Manual Running KernelDriver Ndisuio Eaphost false false false Extensible Authentication Protocol dot3svc . Eaphost RPCSS KeyIso Manual Stopped Win32ShareProcess Eaphost Manual 3 Stopped 1 Win32ShareProcess 32 localSystem The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X authentication on Ethernet interfaces. If your current wired network deployment enforces 802.1X authentication, the DOT3SVC service should be configured to run for establishing Layer 2 connectivity and/or providing access to network resources. Wired networks that do not enforce 802.1X authentication are unaffected by the DOT3SVC service. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 dot3svc DPS false true true Diagnostic Policy Service . DPS Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p Automatic 2 DPS DsmSvc false false false Device Setup Manager . DsmSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables the detection, download and installation of device-related software. If this service is disabled, devices may be configured with outdated software, and may not work correctly. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 DsmSvc DsSvc false false true Data Sharing Service . DsSvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides data brokering between applications. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 DsSvc DusmSvc false false true Data Usage . DusmSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess 16 NT Authority\LocalService Network data usage, data limit, restrict background data, metered networks. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p Automatic 2 DusmSvc Eaphost false false false Extensible Authentication Protocol dot3svc false false false Wired AutoConfig . dot3svc RpcSs Ndisuio Eaphost Manual Stopped Win32ShareProcess dot3svc . Eaphost RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS KeyIso false false true CNG Key Isolation XboxNetApiSvc dot3svc Eaphost . KeyIso RpcSs Manual Running Win32ShareProcess KeyIso Manual 3 Stopped 1 Win32ShareProcess 32 localSystem The Extensible Authentication Protocol (EAP) service provides network authentication in such scenarios as 802.1x wired and wireless, VPN, and Network Access Protection (NAP). EAP also provides application programming interfaces (APIs) that are used by network access clients, including wireless and VPN clients, during the authentication process. If you disable this service, this computer is prevented from accessing networks that require EAP authentication. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 Eaphost edgeupdate false false false Microsoft Edge Update Service (edgeupdate) . edgeupdate RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Automatic 2 Stopped 1 Win32OwnProcess 16 LocalSystem Keeps your Microsoft software up to date. If this service is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Microsoft software using it. true "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc AutomaticDelayedStart 10 edgeupdate edgeupdatem false false false Microsoft Edge Update Service (edgeupdatem) . edgeupdatem RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Keeps your Microsoft software up to date. If this service is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Microsoft software using it. true "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc Manual 3 edgeupdatem EFS false false false Encrypting File System (EFS) . EFS RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. If this service is stopped or disabled, applications will be unable to access encrypted files. false C:\WINDOWS\System32\lsass.exe Manual 3 EFS embeddedmode false false false Embedded Mode . embeddedmode BrokerInfrastructure false false false Background Tasks Infrastructure Service . BrokerInfrastructure RpcEptMapper DcomLaunch RpcSs Automatic Running Win32ShareProcess BrokerInfrastructure Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem The Embedded Mode service enables scenarios related to Background Applications. Disabling this service will prevent Background Applications from being activated. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 embeddedmode EntAppSvc false false false Enterprise App Management Service . EntAppSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Enables enterprise application management. false C:\WINDOWS\system32\svchost.exe -k appmodel -p Manual 3 EntAppSvc EventLog false true true Windows Event Log Wecsvc false false false Windows Event Collector . Wecsvc HTTP Eventlog Manual Stopped Win32ShareProcess Wecsvc SurfaceUsbHubFwUpdateService false true true Surface USB Hub Firmware Update Service . SurfaceUsbHubFwUpdateService EventLog Automatic Running Win32ShareProcess SurfaceUsbHubFwUpdateService NcdAutoSetup false false true Network Connected Devices Auto-Setup . NcdAutoSetup netprofm Manual Running Win32OwnProcess, Win32ShareProcess NcdAutoSetup AppVClient false false false Microsoft App-V Client . AppVClient RpcSS netprofm AppvVfs AppvStrm Disabled Stopped Win32OwnProcess AppVClient netprofm false false true Network List Service NcdAutoSetup AppVClient . netprofm RpcSs nlasvc Manual Running Win32OwnProcess, Win32ShareProcess netprofm NlaSvc false false true Network Location Awareness NcdAutoSetup AppVClient netprofm . NlaSvc NSI RpcSs TcpIp Dhcp Eventlog Automatic Running Win32OwnProcess, Win32ShareProcess NlaSvc . EventLog Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p Automatic 2 EventLog EventSystem false false true COM+ Event System COMSysApp false false false COM+ System Application . COMSysApp RpcSs EventSystem SENS Manual Stopped Win32OwnProcess COMSysApp SENS false false true System Event Notification Service COMSysApp . SENS EventSystem Automatic Running Win32OwnProcess, Win32ShareProcess SENS . EventSystem rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Automatic 2 EventSystem Fax false false false Fax . Fax TapiSrv false false false Telephony Fax . TapiSrv RpcSs Manual Stopped Win32ShareProcess TapiSrv RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Spooler false false true Print Spooler Fax . Spooler RPCSS http Automatic Running Win32OwnProcess, InteractiveProcess Spooler Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Enables you to send and receive faxes, using fax resources available on this computer or on the network. false C:\WINDOWS\system32\fxssvc.exe Manual 3 Fax fdPHost false false true Function Discovery Provider Host FDResPub false true true Function Discovery Resource Publication . FDResPub RpcSs http fdphost Manual Running Win32OwnProcess, Win32ShareProcess FDResPub . fdPHost RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs http false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . http MsQuic Manual Running KernelDriver http Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService The FDPHOST service hosts the Function Discovery (FD) network discovery providers. These FD providers supply network discovery services for the Simple Services Discovery Protocol (SSDP) and Web Services – Discovery (WS-D) protocol. Stopping or disabling the FDPHOST service will disable network discovery for these protocols when using FD. When this service is unavailable, network services using FD and relying on these discovery protocols will be unable to find network devices or resources. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 fdPHost FDResPub false true true Function Discovery Resource Publication . FDResPub RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs http false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . http MsQuic Manual Running KernelDriver http fdphost false false true Function Discovery Provider Host FDResPub . fdphost RpcSs http Manual Running Win32OwnProcess, Win32ShareProcess fdphost Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Publishes this computer and resources attached to this computer so they can be discovered over the network. If this service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network. false C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p Manual 3 FDResPub fhsvc false true true File History Service . fhsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Protects user files from accidental loss by copying them to a backup location true C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p AutomaticDelayedStart 10 fhsvc FileSyncHelper false false true FileSyncHelper . FileSyncHelper RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess 16 LocalSystem Helper service for OneDrive false "C:\Program Files (x86)\Microsoft OneDrive\20.169.0823.0008\FileSyncHelper.exe" Manual 3 FileSyncHelper FontCache false true true Windows Font Cache Service . FontCache Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Optimizes performance of applications by caching commonly used font data. Applications will start this service if it is not already running. It can be disabled, though doing so will degrade application performance. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Automatic 2 FontCache FontCache3.0.0.0 false false false Windows Presentation Foundation Font Cache 3.0.0.0 . FontCache3.0.0.0 Manual 3 Stopped 1 Win32OwnProcess 16 NT Authority\LocalService Optimizes performance of Windows Presentation Foundation (WPF) applications by caching commonly used font data. WPF applications will start this service if it is not already running. It can be disabled, though doing so will degrade the performance of WPF applications. false C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe Manual 3 FontCache3.0.0.0 FrameServer false false false Windows Camera Frame Server . FrameServer rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables multiple clients to access video frames from camera devices. false C:\WINDOWS\System32\svchost.exe -k Camera Manual 3 FrameServer gpsvc false false true Group Policy Client . gpsvc RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Mup false false true Mup UmRdpService RDPDR LxssManagerUser_9164d LxssManagerUser P9Rdr SessionEnv Netlogon LanmanWorkstation mrxsmb20 mrxsmb WebClient MRxDAV CSC rdbss gpsvc Dfsc . Mup Boot Running FileSystemDriver Mup Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is disabled. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 gpsvc GraphicsPerfSvc false false false GraphicsPerfSvc . GraphicsPerfSvc Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Graphics performance monitor service false C:\WINDOWS\System32\svchost.exe -k GraphicsPerfSvcGroup Manual 3 GraphicsPerfSvc HgClientService false false false Host Guardian Client Service . HgClientService Winmgmt true true true Windows Management Instrumentation vmms NcaSvc iphlpsvc HgClientService . Winmgmt RPCSS Automatic Running Win32OwnProcess, Win32ShareProcess Winmgmt Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides abstraction of Host Guardian artifacts. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 HgClientService hidserv false true true Human Interface Device Service . hidserv Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Activates and maintains the use of hot buttons on keyboards, remote controls and other multimedia devices. It is recommended that you keep this service running. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 hidserv hns false false true Host Network Service . hns RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs nsi false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . nsi rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess nsi vfpext false false true Microsoft Azure VFP Switch Extension hns . vfpext System Running KernelDriver vfpext Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides support for Windows Virtual Networks. false C:\WINDOWS\system32\svchost.exe -k NetSvcs -p Manual 3 hns HvHost false true true HV Host Service . HvHost hvservice false false true Hypervisor/Virtual Machine Support Driver HvHost . hvservice Manual Running KernelDriver hvservice Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides an interface for the Hyper-V hypervisor to provide per-partition performance counters to the host operating system. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 HvHost icssvc false false false Windows Mobile Hotspot Service . icssvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs wcmsvc false true true Windows Connection Manager WlanSvc icssvc . wcmsvc RpcSs NSI Automatic Running Win32OwnProcess wcmsvc Manual 3 Stopped 1 Win32ShareProcess 32 NT Authority\LocalService Provides the ability to share a mobile data connection with another device. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 icssvc IKEEXT false false false IKE and AuthIP IPsec Keying Modules XboxNetApiSvc false false false Xbox Live Networking Service . XboxNetApiSvc BFE mpssvc IKEEXT KeyIso Manual Stopped Win32ShareProcess XboxNetApiSvc . IKEEXT BFE false false true Base Filtering Engine . BFE RpcSs Automatic Running Win32ShareProcess BFE nsi false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . nsi rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess nsi Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem The IKEEXT service hosts the Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules. These keying modules are used for authentication and key exchange in Internet Protocol security (IPsec). Stopping or disabling the IKEEXT service will disable IKE and AuthIP key exchange with peer computers. IPsec is typically configured to use IKE or AuthIP; therefore, stopping or disabling the IKEEXT service might result in an IPsec failure and might compromise the security of the system. It is strongly recommended that you have the IKEEXT service running. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 IKEEXT InstallService false false true Microsoft Store Install Service . InstallService rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess 16 LocalSystem Provides infrastructure support for the Microsoft Store. This service is started on demand, and if disabled then installations will not function properly. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 InstallService Intel(R) Capability Licensing Service TCP IP Interface false false false Intel(R) Capability Licensing Service TCP IP Interface . Intel(R) Capability Licensing Service TCP IP Interface Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Version: 1.56.87.0 false C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_1244e13de260a91d\lib\SocketHeciServer.exe Manual 3 Intel(R) Capability Licensing Service TCP IP Interface Intel(R) TPM Provisioning Service false false false Intel(R) TPM Provisioning Service . Intel(R) TPM Provisioning Service Automatic 2 Stopped 1 Win32OwnProcess 16 LocalSystem Version: 1.56.87.0 false C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_1244e13de260a91d\lib\TPMProvisioningService.exe Automatic 2 Intel(R) TPM Provisioning Service IntelAudioService false false false Intel(R) Audio Service . IntelAudioService Automatic 2 Stopped 1 Win32OwnProcess 16 LocalSystem false C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe Automatic 2 IntelAudioService iphlpsvc false false true IP Helper NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE dnscache NSI iphlpsvc Manual Stopped Win32OwnProcess, Win32ShareProcess NcaSvc . iphlpsvc RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS winmgmt true true true Windows Management Instrumentation vmms NcaSvc iphlpsvc HgClientService . winmgmt RPCSS Automatic Running Win32OwnProcess, Win32ShareProcess winmgmt tcpip false false true TCP/IP Protocol Driver WinNat NetBT tdx tcpipreg Tcpip6 PolicyAgent NcdAutoSetup AppVClient netprofm NlaSvc Ndu CDPSvc NcbService IPNAT NcaSvc iphlpsvc IpFilterDriver debugregsvc . tcpip Boot Running KernelDriver tcpip nsi false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . nsi rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess nsi WinHttpAutoProxySvc false true false WinHTTP Web Proxy Auto-Discovery Service NcaSvc iphlpsvc . WinHttpAutoProxySvc Dhcp Manual Running Win32OwnProcess, Win32ShareProcess WinHttpAutoProxySvc Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer. false C:\WINDOWS\System32\svchost.exe -k NetSvcs -p Automatic 2 iphlpsvc IpxlatCfgSvc false false false IP Translation Configuration Service . IpxlatCfgSvc nsi false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . nsi rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess nsi Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Configures and enables translation from v4 to v6 and vice versa false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 IpxlatCfgSvc KeyIso false false true CNG Key Isolation XboxNetApiSvc false false false Xbox Live Networking Service . XboxNetApiSvc BFE mpssvc IKEEXT KeyIso Manual Stopped Win32ShareProcess XboxNetApiSvc dot3svc false false false Wired AutoConfig . dot3svc RpcSs Ndisuio Eaphost Manual Stopped Win32ShareProcess dot3svc Eaphost false false false Extensible Authentication Protocol dot3svc . Eaphost RPCSS KeyIso Manual Stopped Win32ShareProcess Eaphost . KeyIso RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32ShareProcess 32 LocalSystem The CNG key isolation service is hosted in the LSA process. The service provides key process isolation to private keys and associated cryptographic operations as required by the Common Criteria. The service stores and uses long-lived keys in a secure process complying with Common Criteria requirements. false C:\WINDOWS\system32\lsass.exe Manual 3 KeyIso KtmRm false false false KtmRm for Distributed Transaction Coordinator . KtmRm RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS SamSS false false false Security Accounts Manager MSDTC com.docker.service LanmanServer KtmRm . SamSS RPCSS Automatic Running Win32ShareProcess SamSS Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\NetworkService Coordinates transactions between the Distributed Transaction Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it is recommended that this service remain stopped. If it is needed, both MSDTC and KTM will start this service automatically. If this service is disabled, any MSDTC transaction interacting with a Kernel Resource Manager will fail and any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k NetworkServiceAndNoImpersonation -p Manual 3 KtmRm LanmanServer false false true Server com.docker.service false true true Docker Desktop Service . com.docker.service LanmanServer Automatic Running Win32OwnProcess com.docker.service . LanmanServer SamSS false false false Security Accounts Manager MSDTC com.docker.service LanmanServer KtmRm . SamSS RPCSS Automatic Running Win32ShareProcess SamSS Srv2 false false true Server SMB 2.xxx Driver com.docker.service LanmanServer . Srv2 srvnet Manual Running FileSystemDriver Srv2 Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 LanmanServer LanmanWorkstation true false true Workstation SessionEnv false false true Remote Desktop Configuration . SessionEnv RPCSS LanmanWorkstation Manual Running Win32OwnProcess, Win32ShareProcess SessionEnv Netlogon false false false Netlogon . Netlogon LanmanWorkstation Manual Stopped Win32ShareProcess Netlogon . LanmanWorkstation Bowser false false true Browser SessionEnv Netlogon LanmanWorkstation . Bowser Manual Running FileSystemDriver Bowser MRxSmb20 false false true SMB 2.0 MiniRedirector SessionEnv Netlogon LanmanWorkstation . MRxSmb20 mrxsmb Manual Running FileSystemDriver MRxSmb20 NSI false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . NSI rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess NSI Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\NetworkService Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k NetworkService -p Automatic 2 LanmanWorkstation lfsvc false false true Geolocation Service . lfsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem This service monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service, applications will be unable to use or receive notifications for geolocation or geofences. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 lfsvc LicenseManager false false true Windows License Manager Service . LicenseManager rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\LocalService Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then content acquired through the Microsoft Store will not function properly. false C:\WINDOWS\System32\svchost.exe -k LocalService -p Manual 3 LicenseManager lltdsvc false false false Link-Layer Topology Discovery Mapper . lltdsvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss lltdio false false true Link-Layer Topology Discovery Mapper I/O Driver QWAVE lltdsvc . lltdio Automatic Running KernelDriver lltdio Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Creates a Network Map, consisting of PC and device topology (connectivity) information, and metadata describing each PC and device. If this service is disabled, the Network Map will not function properly. false C:\WINDOWS\System32\svchost.exe -k LocalService -p Manual 3 lltdsvc lmhosts false false true TCP/IP NetBIOS Helper . lmhosts Afd false false true Ancillary Function Driver for Winsock lmhosts RemoteAccess RasMan NcaSvc debugregsvc Dnscache iphlpsvc WinHttpAutoProxySvc NcdAutoSetup AppVClient netprofm NlaSvc Dhcp . Afd System Running KernelDriver Afd Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and log on to the network. If this service is stopped, these functions might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 lmhosts LSM false false false Local Session Manager . LSM RpcEptMapper false false false RPC Endpoint Mapper . RpcEptMapper Automatic Running Win32ShareProcess RpcEptMapper DcomLaunch false false false DCOM Server Process Launcher . DcomLaunch Automatic Running Win32ShareProcess DcomLaunch RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Core Windows Service that manages local user sessions. Stopping or disabling this service will result in system instability. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Automatic 2 LSM LxpSvc false false false Language Experience Service . LxpSvc Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides infrastructure support for deploying and configuring localized Windows resources. This service is started on demand and, if disabled, additional Windows languages will not be deployed to the system, and Windows may not function properly. false C:\WINDOWS\system32\svchost.exe -k netsvcs Manual 3 LxpSvc LxssManager false false true LxssManager . LxssManager RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS staterepository false true true State Repository Service LxssManager AppXSvc . staterepository rpcss Manual Running Win32OwnProcess, Win32ShareProcess staterepository Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem The LXSS Manager service supports running native ELF binaries. The service provides the infrastructure necessary for ELF binaries to run on Windows. If the service is stopped or disabled, those binaries will no longer run. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 LxssManager LxssManagerUser_9164d false false false LxssManagerUser_9164d . LxssManagerUser_9164d Manual 3 Stopped 1 224 224 The LXSS Manager service supports running native ELF binaries. The service provides the infrastructure necessary for ELF binaries to run on Windows. If the service is stopped or disabled, those binaries will no longer run. false C:\WINDOWS\system32\svchost.exe -k LxssManagerUser -p Manual 3 LxssManagerUser_9164d MapsBroker false false false Downloaded Maps Manager . MapsBroker rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Automatic 2 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Windows service for application access to downloaded maps. This service is started on-demand by applications accessing downloaded maps. Disabling this service will prevent apps from accessing maps. true C:\WINDOWS\System32\svchost.exe -k NetworkService -p AutomaticDelayedStart 10 MapsBroker MessagingService_9164d false false false MessagingService_9164d . MessagingService_9164d Manual 3 Stopped 1 224 224 Service supporting text messaging and related functionality. false C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup Manual 3 MessagingService_9164d MicrosoftEdgeDevElevationService false false false Microsoft Edge Dev Elevation Service . MicrosoftEdgeDevElevationService RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Keeps Microsoft Edge Dev up to update. If this service is disabled, the application will not be kept up to date. false "C:\Program Files (x86)\Microsoft\Edge Dev\Application\88.0.702.0\elevation_service.exe" Manual 3 MicrosoftEdgeDevElevationService MicrosoftEdgeElevationService false false false Microsoft Edge Elevation Service . MicrosoftEdgeElevationService RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Keeps Microsoft Edge up to update. If this service is disabled, the application will not be kept up to date. false "C:\Program Files (x86)\Microsoft\Edge\Application\87.0.664.41\elevation_service.exe" Manual 3 MicrosoftEdgeElevationService MixedRealityOpenXRSvc false false false Windows Mixed Reality OpenXR Service . MixedRealityOpenXRSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Enables Mixed Reality OpenXR runtime functionality false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 MixedRealityOpenXRSvc mpssvc false false false Windows Defender Firewall . mpssvc mpsdrv false false true Windows Defender Firewall Authorization Driver . mpsdrv Manual Running KernelDriver mpsdrv bfe false false true Base Filtering Engine . bfe RpcSs Automatic Running Win32ShareProcess bfe Automatic 2 Running 4 Win32ShareProcess 32 NT Authority\LocalService Windows Defender Firewall helps to protect your computer by preventing unauthorised users from gaining access to your computer through the Internet or a network. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p Automatic 2 mpssvc MSDTC false false false Distributed Transaction Coordinator . MSDTC RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS SamSS false false false Security Accounts Manager MSDTC com.docker.service LanmanServer KtmRm . SamSS RPCSS Automatic Running Win32ShareProcess SamSS Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will fail. If this service is disabled, any services that explicitly depend on it will fail to start. true C:\WINDOWS\System32\msdtc.exe Manual 3 MSDTC MSiSCSI false false false Microsoft iSCSI Initiator Service . MSiSCSI Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Manages Internet SCSI (iSCSI) sessions from this computer to remote iSCSI target devices. If this service is stopped, this computer will not be able to login or access iSCSI targets. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 MSiSCSI msiserver false false false Windows Installer . msiserver rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Adds, modifies and removes applications provided as a Windows Installer or APPX package (*.msi, *.msp, *.appx). If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\msiexec.exe /V Manual 3 msiserver NaturalAuthentication false false false Natural Authentication . NaturalAuthentication RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs ProfSvc false true true User Profile Service XblGameSave TokenBroker UserManager shpamsvc NaturalAuthentication Appinfo . ProfSvc RpcSs Automatic Running Win32OwnProcess, Win32ShareProcess ProfSvc Schedule false true true Task Scheduler NaturalAuthentication . Schedule RPCSS SystemEventsBroker Automatic Running Win32OwnProcess, Win32ShareProcess Schedule Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Signal aggregator service, that evaluates signals based on time, network, geolocation, bluetooth and cdf factors. Supported features are Device Unlock, Dynamic Lock and Dynamo MDM policies false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 NaturalAuthentication NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE false false true Base Filtering Engine . BFE RpcSs Automatic Running Win32ShareProcess BFE dnscache false false false DNS Client RemoteAccess RasMan NcaSvc debugregsvc . dnscache nsi Afd Automatic Running Win32OwnProcess, Win32ShareProcess dnscache NSI false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . NSI rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess NSI iphlpsvc false false true IP Helper NcaSvc . iphlpsvc RpcSS winmgmt tcpip nsi WinHttpAutoProxySvc Automatic Running Win32OwnProcess, Win32ShareProcess iphlpsvc Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides DirectAccess status notification for UI components false C:\WINDOWS\System32\svchost.exe -k NetSvcs -p Manual 3 NcaSvc NcbService false false true Network Connection Broker CDPSvc false false true Connected Devices Platform Service . CDPSvc ncbservice RpcSS Tcpip Automatic Running Win32OwnProcess, Win32ShareProcess CDPSvc . NcbService RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS tcpip false false true TCP/IP Protocol Driver WinNat NetBT tdx tcpipreg Tcpip6 PolicyAgent NcdAutoSetup AppVClient netprofm NlaSvc Ndu CDPSvc NcbService IPNAT NcaSvc iphlpsvc IpFilterDriver debugregsvc . tcpip Boot Running KernelDriver tcpip BrokerInfrastructure false false false Background Tasks Infrastructure Service . BrokerInfrastructure RpcEptMapper DcomLaunch RpcSs Automatic Running Win32ShareProcess BrokerInfrastructure Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Brokers connections that allow Windows Store Apps to receive notifications from the internet. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 NcbService NcdAutoSetup false false true Network Connected Devices Auto-Setup . NcdAutoSetup netprofm false false true Network List Service NcdAutoSetup AppVClient . netprofm RpcSs nlasvc Manual Running Win32OwnProcess, Win32ShareProcess netprofm Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Network Connected Devices Auto-Setup service monitors and installs qualified devices that connect to a qualified network. Stopping or disabling this service will prevent Windows from discovering and installing qualified network connected devices automatically. Users can still manually add network connected devices to a PC through the user interface. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p Manual 3 NcdAutoSetup Netlogon false false false Netlogon . Netlogon LanmanWorkstation true false true Workstation SessionEnv Netlogon . LanmanWorkstation Bowser MRxSmb20 NSI Automatic Running Win32OwnProcess, Win32ShareProcess LanmanWorkstation Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this service is stopped, the computer may not authenticate users and services and the domain controller cannot register DNS records. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\lsass.exe Manual 3 Netlogon Netman false false false Network Connections . Netman RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs nsi false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . nsi rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess nsi Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 Netman netprofm false false true Network List Service NcdAutoSetup false false true Network Connected Devices Auto-Setup . NcdAutoSetup netprofm Manual Running Win32OwnProcess, Win32ShareProcess NcdAutoSetup AppVClient false false false Microsoft App-V Client . AppVClient RpcSS netprofm AppvVfs AppvStrm Disabled Stopped Win32OwnProcess AppVClient . netprofm RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs nlasvc false false true Network Location Awareness NcdAutoSetup AppVClient netprofm . nlasvc NSI RpcSs TcpIp Dhcp Eventlog Automatic Running Win32OwnProcess, Win32ShareProcess nlasvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Identifies the networks the computer has connected to, collects and stores properties for these networks, and notifies applications when these properties change. false C:\WINDOWS\System32\svchost.exe -k LocalService -p Manual 3 netprofm NetSetupSvc false false false Network Setup Service . NetSetupSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem The Network Setup Service manages the installation of network drivers and permits the configuration of low-level network settings. If this service is stopped, any driver installations that are in progress may be cancelled. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 NetSetupSvc NetTcpPortSharing false false false Net.Tcp Port Sharing Service . NetTcpPortSharing Disabled 4 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Provides ability to share TCP ports over the net.tcp protocol. false C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe Disabled 4 NetTcpPortSharing NgcCtnrSvc false false true Microsoft Passport Container . NgcCtnrSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Manages local user identity keys used to authenticate the user to identity providers, as well as TPM virtual smart cards. If this service is disabled, local user identity keys and TPM virtual smart cards will not be accessible. It is recommended that you do not reconfigure this service. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 NgcCtnrSvc NgcSvc false false true Microsoft Passport . NgcSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides process isolation for cryptographic keys used to provide authentication to a user’s associated identity providers. If this service is disabled, all uses and management of these keys will not be available, which includes machine log-on and single sign-on for apps and websites. This service starts and stops automatically. It is recommended that you do not reconfigure this service. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 NgcSvc NlaSvc false false true Network Location Awareness NcdAutoSetup false false true Network Connected Devices Auto-Setup . NcdAutoSetup netprofm Manual Running Win32OwnProcess, Win32ShareProcess NcdAutoSetup AppVClient false false false Microsoft App-V Client . AppVClient RpcSS netprofm AppvVfs AppvStrm Disabled Stopped Win32OwnProcess AppVClient netprofm false false true Network List Service NcdAutoSetup AppVClient . netprofm RpcSs nlasvc Manual Running Win32OwnProcess, Win32ShareProcess netprofm . NlaSvc NSI false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . NSI rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess NSI RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs TcpIp false false true TCP/IP Protocol Driver WinNat NetBT tdx tcpipreg Tcpip6 PolicyAgent NcdAutoSetup AppVClient netprofm NlaSvc Ndu CDPSvc NcbService IPNAT NcaSvc iphlpsvc IpFilterDriver debugregsvc . TcpIp Boot Running KernelDriver TcpIp Dhcp false true true DHCP Client NcaSvc iphlpsvc WinHttpAutoProxySvc NcdAutoSetup AppVClient netprofm NlaSvc . Dhcp NSI Afd Automatic Running Win32OwnProcess, Win32ShareProcess Dhcp Eventlog false true true Windows Event Log Wecsvc SurfaceUsbHubFwUpdateService NcdAutoSetup AppVClient netprofm NlaSvc . Eventlog Automatic Running Win32OwnProcess, Win32ShareProcess Eventlog Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\NetworkService Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k NetworkService -p Automatic 2 NlaSvc nsi false false true Network Store Interface Service WlanSvc false true true WLAN AutoConfig . WlanSvc nativewifip RpcSs Ndisuio wcmsvc Automatic Running Win32OwnProcess WlanSvc icssvc false false false Windows Mobile Hotspot Service . icssvc RpcSs wcmsvc Manual Stopped Win32ShareProcess icssvc Wcmsvc false true true Windows Connection Manager WlanSvc icssvc . Wcmsvc RpcSs NSI Automatic Running Win32OwnProcess Wcmsvc upnphost false false false UPnP Device Host . upnphost SSDPSRV HTTP Manual Stopped Win32ShareProcess upnphost SSDPSRV false true true SSDP Discovery upnphost . SSDPSRV HTTP NSI Manual Running Win32OwnProcess, Win32ShareProcess SSDPSRV NcdAutoSetup false false true Network Connected Devices Auto-Setup . NcdAutoSetup netprofm Manual Running Win32OwnProcess, Win32ShareProcess NcdAutoSetup AppVClient false false false Microsoft App-V Client . AppVClient RpcSS netprofm AppvVfs AppvStrm Disabled Stopped Win32OwnProcess AppVClient netprofm false false true Network List Service NcdAutoSetup AppVClient . netprofm RpcSs nlasvc Manual Running Win32OwnProcess, Win32ShareProcess netprofm NlaSvc false false true Network Location Awareness NcdAutoSetup AppVClient netprofm . NlaSvc NSI RpcSs TcpIp Dhcp Eventlog Automatic Running Win32OwnProcess, Win32ShareProcess NlaSvc Netman false false false Network Connections . Netman RpcSs nsi Manual Stopped Win32ShareProcess Netman NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE dnscache NSI iphlpsvc Manual Stopped Win32OwnProcess, Win32ShareProcess NcaSvc SessionEnv false false true Remote Desktop Configuration . SessionEnv RPCSS LanmanWorkstation Manual Running Win32OwnProcess, Win32ShareProcess SessionEnv Netlogon false false false Netlogon . Netlogon LanmanWorkstation Manual Stopped Win32ShareProcess Netlogon LanmanWorkstation true false true Workstation SessionEnv Netlogon . LanmanWorkstation Bowser MRxSmb20 NSI Automatic Running Win32OwnProcess, Win32ShareProcess LanmanWorkstation IpxlatCfgSvc false false false IP Translation Configuration Service . IpxlatCfgSvc nsi Manual Stopped Win32ShareProcess IpxlatCfgSvc iphlpsvc false false true IP Helper NcaSvc . iphlpsvc RpcSS winmgmt tcpip nsi WinHttpAutoProxySvc Automatic Running Win32OwnProcess, Win32ShareProcess iphlpsvc XboxNetApiSvc false false false Xbox Live Networking Service . XboxNetApiSvc BFE mpssvc IKEEXT KeyIso Manual Stopped Win32ShareProcess XboxNetApiSvc IKEEXT false false false IKE and AuthIP IPsec Keying Modules XboxNetApiSvc . IKEEXT BFE nsi Manual Stopped Win32ShareProcess IKEEXT hns false false true Host Network Service . hns RpcSs nsi vfpext Manual Running Win32OwnProcess, Win32ShareProcess hns RemoteAccess false false false Routing and Remote Access . RemoteAccess RpcSS Bfe RasMan Http Disabled Stopped Win32ShareProcess RemoteAccess RasMan false true true Remote Access Connection Manager RemoteAccess . RasMan SstpSvc DnsCache Automatic Running Win32ShareProcess RasMan debugregsvc false false false debugregsvc . debugregsvc Dnscache Tcpip Automatic Stopped Win32OwnProcess debugregsvc Dnscache false false false DNS Client RemoteAccess RasMan NcaSvc debugregsvc . Dnscache nsi Afd Automatic Running Win32OwnProcess, Win32ShareProcess Dnscache WinHttpAutoProxySvc false true false WinHTTP Web Proxy Auto-Discovery Service NcaSvc iphlpsvc . WinHttpAutoProxySvc Dhcp Manual Running Win32OwnProcess, Win32ShareProcess WinHttpAutoProxySvc Dhcp false true true DHCP Client NcaSvc iphlpsvc WinHttpAutoProxySvc NcdAutoSetup AppVClient netprofm NlaSvc . Dhcp NSI Afd Automatic Running Win32OwnProcess, Win32ShareProcess Dhcp . nsi rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss nsiproxy false false true NSI Proxy Service Driver WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp nsi . nsiproxy System Running KernelDriver nsiproxy Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\LocalService This service delivers network notifications (e.g. interface addition/deleting etc) to user mode clients. Stopping this service will cause loss of network connectivity. If this service is disabled, any other services that explicitly depend on this service will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Automatic 2 nsi nvagent false true true Network Virtualization Service . nvagent Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides network virtualization services. false C:\WINDOWS\system32\svchost.exe -k NetSvcs Manual 3 nvagent NVDisplay.ContainerLocalSystem false true true NVIDIA Display Container LS . NVDisplay.ContainerLocalSystem Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Container service for NVIDIA root features false "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 Automatic 2 NVDisplay.ContainerLocalSystem NvTelemetryContainer false true true NVIDIA Telemetry Container . NvTelemetryContainer Automatic 2 Running 4 Win32OwnProcess 16 NT AUTHORITY\NetworkService Container service for NVIDIA Telemetry false "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r Automatic 2 NvTelemetryContainer OneDrive Updater Service false false false OneDrive Updater Service . OneDrive Updater Service RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Keeps your OneDrive up to date. false "C:\Program Files (x86)\Microsoft OneDrive\20.169.0823.0008\OneDriveUpdaterService.exe" Manual 3 OneDrive Updater Service OneSyncSvc_9164d false false true Sync Host_9164d . OneSyncSvc_9164d Automatic 2 Running 4 224 224 This service synchronizes mail, contacts, calendar and various other user data. Mail and other applications dependent on this functionality will not work properly when this service is not running. true C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup AutomaticDelayedStart 10 OneSyncSvc_9164d ose64 false false false Office 64 Source Engine . ose64 Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports. false "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" Manual 3 ose64 p2pimsvc false false false Peer Networking Identity Manager PNRPAutoReg false false false PNRP Machine Name Publication Service . PNRPAutoReg pnrpsvc Manual Stopped Win32ShareProcess PNRPAutoReg p2psvc false false false Peer Networking Grouping . p2psvc p2pimsvc PNRPSvc Manual Stopped Win32ShareProcess p2psvc PNRPsvc false false false Peer Name Resolution Protocol PNRPAutoReg p2psvc . PNRPsvc p2pimsvc Manual Stopped Win32ShareProcess PNRPsvc . p2pimsvc Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Provides identity services for the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services. If disabled, the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services may not function, and some applications, such as HomeGroup and Remote Assistance, may not function correctly. false C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet Manual 3 p2pimsvc p2psvc false false false Peer Networking Grouping . p2psvc p2pimsvc false false false Peer Networking Identity Manager PNRPAutoReg p2psvc PNRPsvc . p2pimsvc Manual Stopped Win32ShareProcess p2pimsvc PNRPSvc false false false Peer Name Resolution Protocol PNRPAutoReg p2psvc . PNRPSvc p2pimsvc Manual Stopped Win32ShareProcess PNRPSvc Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Enables multi-party communication using Peer-to-Peer Grouping. If disabled, some applications, such as HomeGroup, may not function. false C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet Manual 3 p2psvc PcaSvc false true true Program Compatibility Assistant Service . PcaSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem This service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems. If this service is stopped, PCA will not function properly. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 PcaSvc PeerDistSvc false false false BranchCache . PeerDistSvc http false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . http MsQuic Manual Running KernelDriver http Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\NetworkService This service caches network content from peers on the local subnet. false C:\WINDOWS\System32\svchost.exe -k PeerDist Manual 3 PeerDistSvc perceptionsimulation false false false Windows Perception Simulation Service . perceptionsimulation rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Enables spatial perception simulation, virtual camera management and spatial input simulation. false C:\WINDOWS\system32\PerceptionSimulation\PerceptionSimulationService.exe Manual 3 perceptionsimulation PerfHost false false false Performance Counter DLL Host . PerfHost RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\LocalService Enables remote users and 64-bit processes to query performance counters provided by 32-bit DLLs. If this service is stopped, only local users and 32-bit processes will be able to query performance counters provided by 32-bit DLLs. false C:\WINDOWS\SysWow64\perfhost.exe Manual 3 PerfHost PhoneSvc false false true Phone Service . PhoneSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\LocalService Manages the telephony state on the device false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 PhoneSvc PimIndexMaintenanceSvc_9164d false false true Contact Data_9164d . PimIndexMaintenanceSvc_9164d Manual 3 Running 4 224 224 Indexes contact data for fast contact searching. If you stop or disable this service, contacts might be missing from your search results. false C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup Manual 3 PimIndexMaintenanceSvc_9164d pla false false false Performance Logs & Alerts . pla RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Performance Logs and Alerts Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNoNetwork -p Manual 3 pla PlugPlay false true true Plug and Play . PlugPlay Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Manual 3 PlugPlay PNRPAutoReg false false false PNRP Machine Name Publication Service . PNRPAutoReg pnrpsvc false false false Peer Name Resolution Protocol PNRPAutoReg p2psvc . pnrpsvc p2pimsvc Manual Stopped Win32ShareProcess pnrpsvc Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService This service publishes a machine name using the Peer Name Resolution Protocol. Configuration is managed via the netsh context 'p2p pnrp peer' false C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet Manual 3 PNRPAutoReg PNRPsvc false false false Peer Name Resolution Protocol PNRPAutoReg false false false PNRP Machine Name Publication Service . PNRPAutoReg pnrpsvc Manual Stopped Win32ShareProcess PNRPAutoReg p2psvc false false false Peer Networking Grouping . p2psvc p2pimsvc PNRPSvc Manual Stopped Win32ShareProcess p2psvc . PNRPsvc p2pimsvc false false false Peer Networking Identity Manager PNRPAutoReg p2psvc PNRPsvc . p2pimsvc Manual Stopped Win32ShareProcess p2pimsvc Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Enables serverless peer name resolution over the Internet using the Peer Name Resolution Protocol (PNRP). If disabled, some peer-to-peer and collaborative applications, such as Remote Assistance, may not function. false C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet Manual 3 PNRPsvc PolicyAgent false true true IPsec Policy Agent . PolicyAgent Tcpip false false true TCP/IP Protocol Driver WinNat NetBT tdx tcpipreg Tcpip6 PolicyAgent NcdAutoSetup AppVClient netprofm NlaSvc Ndu CDPSvc NcbService IPNAT NcaSvc iphlpsvc IpFilterDriver debugregsvc . Tcpip Boot Running KernelDriver Tcpip bfe false false true Base Filtering Engine . bfe RpcSs Automatic Running Win32ShareProcess bfe Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\NetworkService Internet Protocol security (IPsec) supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. This service enforces IPsec policies created through the IP Security Policies snap-in or the command-line tool "netsh ipsec". If you stop this service, you may experience network connectivity issues if your policy requires that connections use IPsec. Also,remote management of Windows Defender Firewall is not available when this service is stopped. false C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted -p Manual 3 PolicyAgent Power false false false Power . Power Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem Manages power policy and power policy notification delivery. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Automatic 2 Power PrintNotify false false false Printer Extensions and Notifications . PrintNotify RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess, InteractiveProcess 288 LocalSystem This service opens custom printer dialogue boxes and handles notifications from a remote print server or a printer. If you turn this service off, you won’t be able to see printer extensions or notifications. false C:\WINDOWS\system32\svchost.exe -k print Manual 3 PrintNotify PrintWorkflowUserSvc_9164d false false true PrintWorkflow_9164d . PrintWorkflowUserSvc_9164d Manual 3 Running 4 240 240 Provides support for Print Workflow applications. If you turn off this service, you may not be able to print successfully. false C:\WINDOWS\system32\svchost.exe -k PrintWorkflow Manual 3 PrintWorkflowUserSvc_9164d ProfSvc false true true User Profile Service XblGameSave false false false Xbox Live Game Save . XblGameSave UserManager XblAuthManager Manual Stopped Win32ShareProcess XblGameSave TokenBroker false false true Web Account Manager . TokenBroker UserManager Manual Running Win32OwnProcess, Win32ShareProcess TokenBroker UserManager false false true User Manager XblGameSave TokenBroker . UserManager RpcSs ProfSvc Automatic Running Win32OwnProcess, Win32ShareProcess UserManager shpamsvc false false false Shared PC Account Manager . shpamsvc RpcSs ProfSvc Disabled Stopped Win32ShareProcess shpamsvc NaturalAuthentication false false false Natural Authentication . NaturalAuthentication RpcSs ProfSvc Schedule Manual Stopped Win32ShareProcess NaturalAuthentication Appinfo false false true Application Information . Appinfo RpcSs ProfSvc Manual Running Win32OwnProcess, Win32ShareProcess Appinfo . ProfSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem This service is responsible for loading and unloading user profiles. If this service is stopped or disabled, users will no longer be able to successfully sign in or sign out, apps might have problems getting to users' data, and components registered to receive profile event notifications won't receive them. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 ProfSvc PushToInstall false false false Windows PushToInstall Service . PushToInstall rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides infrastructure support for the Microsoft Store. This service is started automatically and if disabled then remote installations will not function properly. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 PushToInstall QWAVE false false false Quality Windows Audio Video Experience . QWAVE rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss psched false false true QoS Packet Scheduler QWAVE . psched System Running KernelDriver psched QWAVEdrv false false false QWAVE driver QWAVE . QWAVEdrv Manual Stopped KernelDriver QWAVEdrv LLTDIO false false true Link-Layer Topology Discovery Mapper I/O Driver QWAVE lltdsvc . LLTDIO Automatic Running KernelDriver LLTDIO Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Quality Windows Audio Video Experience (qWave) is a networking platform for Audio Video (AV) streaming applications on IP home networks. qWave enhances AV streaming performance and reliability by ensuring network quality-of-service (QoS) for AV applications. It provides mechanisms for admission control, run time monitoring and enforcement, application feedback, and traffic prioritization. false C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p Manual 3 QWAVE RasAuto false false false Remote Access Auto Connection Manager . RasAuto RasAcd false false false Remote Access Auto Connection Driver RasAuto . RasAcd Manual Stopped KernelDriver RasAcd Manual 3 Stopped 1 Win32ShareProcess 32 localSystem Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 RasAuto RasMan false true true Remote Access Connection Manager RemoteAccess false false false Routing and Remote Access . RemoteAccess RpcSS Bfe RasMan Http Disabled Stopped Win32ShareProcess RemoteAccess . RasMan SstpSvc false true true Secure Socket Tunneling Protocol Service RemoteAccess RasMan . SstpSvc Manual Running Win32OwnProcess, Win32ShareProcess SstpSvc DnsCache false false false DNS Client RemoteAccess RasMan NcaSvc debugregsvc . DnsCache nsi Afd Automatic Running Win32OwnProcess, Win32ShareProcess DnsCache Automatic 2 Running 4 Win32ShareProcess 32 localSystem Manages dial-up and virtual private network (VPN) connections from this computer to the Internet or other remote networks. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k netsvcs Automatic 2 RasMan RemoteAccess false false false Routing and Remote Access . RemoteAccess RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS Bfe false false true Base Filtering Engine . Bfe RpcSs Automatic Running Win32ShareProcess Bfe RasMan false true true Remote Access Connection Manager RemoteAccess . RasMan SstpSvc DnsCache Automatic Running Win32ShareProcess RasMan Http false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . Http MsQuic Manual Running KernelDriver Http Disabled 4 Stopped 1 Win32ShareProcess 32 localSystem Offers routing services to businesses in local area and wide area network environments. false C:\WINDOWS\System32\svchost.exe -k netsvcs Disabled 4 RemoteAccess RemoteRegistry false false false Remote Registry . RemoteRegistry RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Disabled 4 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k localService -p Disabled 4 RemoteRegistry RetailDemo false false false Retail Demo Service . RetailDemo Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem The Retail Demo service controls device activity while the device is in retail demo mode. false C:\WINDOWS\System32\svchost.exe -k rdxgroup Manual 3 RetailDemo RmSvc false false true Radio Management Service . RmSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Radio Management and Airplane Mode Service false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted Manual 3 RmSvc rpcapd false false false Remote Packet Capture Protocol v.0 (experimental) . rpcapd Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Allows to capture traffic on this machine from a remote machine. false "C:\Program Files (x86)\WinPcap\rpcapd.exe" -d -f "C:\Program Files (x86)\WinPcap\rpcapd.ini" Manual 3 rpcapd RpcEptMapper false false false RPC Endpoint Mapper . RpcEptMapper Automatic 2 Running 4 Win32ShareProcess 32 NT AUTHORITY\NetworkService Resolves RPC interfaces identifiers to transport endpoints. If this service is stopped or disabled, programs using Remote Procedure Call (RPC) services will not function properly. false C:\WINDOWS\system32\svchost.exe -k RPCSS -p Automatic 2 RpcEptMapper RpcLocator false false false Remote Procedure Call (RPC) Locator . RpcLocator Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService In Windows 2003 and earlier versions of Windows, the Remote Procedure Call (RPC) Locator service manages the RPC name service database. In Windows Vista and later versions of Windows, this service does not provide any functionality and is present for application compatibility. false C:\WINDOWS\system32\locator.exe Manual 3 RpcLocator RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper false false false RPC Endpoint Mapper . RpcEptMapper Automatic Running Win32ShareProcess RpcEptMapper DcomLaunch false false false DCOM Server Process Launcher . DcomLaunch Automatic Running Win32ShareProcess DcomLaunch Automatic 2 Running 4 Win32ShareProcess 32 NT AUTHORITY\NetworkService The RPCSS service is the Service Control Manager for COM and DCOM servers. It performs object activations requests, object exporter resolutions and distributed garbage collection for COM and DCOM servers. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the RPCSS service running. false C:\WINDOWS\system32\svchost.exe -k rpcss -p Automatic 2 RpcSs SamSs false false false Security Accounts Manager MSDTC false false false Distributed Transaction Coordinator . MSDTC RPCSS SamSS Manual Stopped Win32OwnProcess MSDTC com.docker.service false true true Docker Desktop Service . com.docker.service LanmanServer Automatic Running Win32OwnProcess com.docker.service LanmanServer false false true Server com.docker.service . LanmanServer SamSS Srv2 Automatic Running Win32OwnProcess, Win32ShareProcess LanmanServer KtmRm false false false KtmRm for Distributed Transaction Coordinator . KtmRm RPCSS SamSS Manual Stopped Win32ShareProcess KtmRm . SamSs RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests. Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled. false C:\WINDOWS\system32\lsass.exe Automatic 2 SamSs SCardSvr false false false Smart Card . SCardSvr Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation Manual 3 SCardSvr ScDeviceEnum false false false Smart Card Device Enumeration Service . ScDeviceEnum Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Creates software device nodes for all smart card readers accessible to a given session. If this service is disabled, WinRT APIs will not be able to enumerate smart card readers. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted Manual 3 ScDeviceEnum Schedule false true true Task Scheduler NaturalAuthentication false false false Natural Authentication . NaturalAuthentication RpcSs ProfSvc Schedule Manual Stopped Win32ShareProcess NaturalAuthentication . Schedule RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS SystemEventsBroker false false true System Events Broker . SystemEventsBroker RpcEptMapper RpcSs Automatic Running Win32ShareProcess SystemEventsBroker Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables a user to configure and schedule automated tasks on this computer. The service also hosts multiple Windows system-critical tasks. If this service is stopped or disabled, these tasks will not be run at their scheduled times. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 Schedule SCPolicySvc false false false Smart Card Removal Policy . SCPolicySvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Allows the system to be configured to lock the user desktop upon smart card removal. false C:\WINDOWS\system32\svchost.exe -k netsvcs Manual 3 SCPolicySvc SDRSVC false false false Windows Backup . SDRSVC RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 localSystem Provides Windows Backup and Restore capabilities. false C:\WINDOWS\system32\svchost.exe -k SDRSVC Manual 3 SDRSVC seclogon true false true Secondary Log-on . seclogon Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables starting processes under alternate credentials. If this service is stopped, this type of log-on access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 seclogon SecurityHealthService false false false Windows Security Service . SecurityHealthService RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess 16 LocalSystem Windows Security Service handles unified device protection and health information false C:\WINDOWS\system32\SecurityHealthService.exe Manual 3 SecurityHealthService SEMgrSvc false false true Payments and NFC/SE Manager . SEMgrSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess 16 NT AUTHORITY\LocalService Manages payments and Near Field Communication (NFC) based secure elements. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 SEMgrSvc SENS false false true System Event Notification Service COMSysApp false false false COM+ System Application . COMSysApp RpcSs EventSystem SENS Manual Stopped Win32OwnProcess COMSysApp . SENS EventSystem false false true COM+ Event System COMSysApp SENS . EventSystem rpcss Automatic Running Win32OwnProcess, Win32ShareProcess EventSystem Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Monitors system events and notifies subscribers to COM+ Event System of these events. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 SENS Sense false false false Windows Defender Advanced Threat Protection Service . Sense Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Windows Defender Advanced Threat Protection service helps protect against advanced threats by monitoring and reporting security events that happen on the computer. false "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" Manual 3 Sense SensorDataService false false false Sensor Data Service . SensorDataService Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Delivers data from a variety of sensors false C:\WINDOWS\System32\SensorDataService.exe Manual 3 SensorDataService SensorService false false true Sensor Service . SensorService Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem A service for sensors that manages different sensors' functionality. Manages Simple Device Orientation (SDO) and History for sensors. Loads the SDO sensor that reports device orientation changes. If this service is stopped or disabled, the SDO sensor will not be loaded and so auto-rotation will not occur. History collection from Sensors will also be stopped. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 SensorService SensrSvc false true true Sensor Monitoring Service . SensrSvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Monitors various sensors in order to expose data and adapt to system and user state. If this service is stopped or disabled, the display brightness will not adapt to lighting conditions. Stopping this service may affect other system functionality and features as well. false C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p Manual 3 SensrSvc SessionEnv false false true Remote Desktop Configuration . SessionEnv RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS LanmanWorkstation true false true Workstation SessionEnv Netlogon . LanmanWorkstation Bowser MRxSmb20 NSI Automatic Running Win32OwnProcess, Win32ShareProcess LanmanWorkstation Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 localSystem Remote Desktop Configuration service (RDCS) is responsible for all Remote Desktop Services and Remote Desktop related configuration and session maintenance activities that require SYSTEM context. These include per-session temporary folders, RD themes, and RD certificates. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 SessionEnv SgrmBroker false true false System Guard Runtime Monitor Broker . SgrmBroker RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Monitors and attests to the integrity of the Windows platform. true C:\WINDOWS\system32\SgrmBroker.exe AutomaticDelayedStart 10 SgrmBroker SharedAccess false false true Internet Connection Sharing (ICS) . SharedAccess BFE false false true Base Filtering Engine . BFE RpcSs Automatic Running Win32ShareProcess BFE Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 SharedAccess SharedRealitySvc false false false Spatial Data Service . SharedRealitySvc RpcSS false false false Remote Procedure Call (RPC) . RpcSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSS Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService This service is used for Spatial Perception scenarios false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 SharedRealitySvc ShellHWDetection false false true Shell Hardware Detection . ShellHWDetection RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides notifications for AutoPlay hardware events. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Automatic 2 ShellHWDetection shpamsvc false false false Shared PC Account Manager . shpamsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs ProfSvc false true true User Profile Service XblGameSave TokenBroker UserManager shpamsvc NaturalAuthentication Appinfo . ProfSvc RpcSs Automatic Running Win32OwnProcess, Win32ShareProcess ProfSvc Disabled 4 Stopped 1 Win32ShareProcess 32 LocalSystem Manages profiles and accounts on a SharedPC configured device false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Disabled 4 shpamsvc smphost false false false Microsoft Storage Spaces SMP . smphost RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Host service for the Microsoft Storage Spaces management provider. If this service is stopped or disabled, Storage Spaces cannot be managed. false C:\WINDOWS\System32\svchost.exe -k smphost Manual 3 smphost SmsRouter false false false Microsoft Windows SMS Router Service. . SmsRouter RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 NT Authority\LocalService Routes messages based on rules to appropriate clients. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 SmsRouter SNMPTRAP false false false SNMP Trap . SNMPTRAP Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\LocalService Receives trap messages generated by local or remote Simple Network Management Protocol (SNMP) agents and forwards the messages to SNMP management programs running on this computer. If this service is stopped, SNMP-based programs on this computer will not receive SNMP trap messages. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\snmptrap.exe Manual 3 SNMPTRAP spectrum false false false Windows Perception Service . spectrum rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\LocalService Enables spatial perception, spatial input, and holographic rendering. false C:\WINDOWS\system32\spectrum.exe Manual 3 spectrum Spooler false false true Print Spooler Fax false false false Fax . Fax TapiSrv RpcSs Spooler Manual Stopped Win32OwnProcess Fax . Spooler RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS http false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . http MsQuic Manual Running KernelDriver http Automatic 2 Running 4 Win32OwnProcess, InteractiveProcess 272 LocalSystem This service spools print jobs and handles interaction with the printer. If you turn off this service, you won’t be able to print or see your printers. false C:\WINDOWS\System32\spoolsv.exe Automatic 2 Spooler sppsvc false false false Software Protection . sppsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Enables the download, installation and enforcement of digital licenses for Windows and Windows applications. If the service is disabled, the operating system and licensed applications may run in a notification mode. It is strongly recommended that you not disable the Software Protection service. true C:\WINDOWS\system32\sppsvc.exe AutomaticDelayedStart 10 sppsvc SQLWriter false true true SQL Server VSS Writer . SQLWriter Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Provides the interface to backup/restore Microsoft SQL server through the Windows VSS infrastructure. false "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" Automatic 2 SQLWriter SSDPSRV false true true SSDP Discovery upnphost false false false UPnP Device Host . upnphost SSDPSRV HTTP Manual Stopped Win32ShareProcess upnphost . SSDPSRV HTTP false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . HTTP MsQuic Manual Running KernelDriver HTTP NSI false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . NSI rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess NSI Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Discovers networked devices and services that use the SSDP discovery protocol, such as UPnP devices. Also announces SSDP devices and services running on the local computer. If this service is stopped, SSDP-based devices will not be discovered. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p Manual 3 SSDPSRV ssh-agent false false false OpenSSH Authentication Agent . ssh-agent Disabled 4 Stopped 1 Win32OwnProcess 16 LocalSystem Agent to hold private keys used for public key authentication. false C:\WINDOWS\System32\OpenSSH\ssh-agent.exe Disabled 4 ssh-agent sshd false false false OpenSSH SSH Server SshdBroker false false false SshdBroker . SshdBroker Sshd Manual Stopped Win32ShareProcess SshdBroker . sshd Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem SSH protocol based service to provide secure encrypted communications between two untrusted hosts over an insecure network. false C:\WINDOWS\System32\OpenSSH\sshd.exe Manual 3 sshd SshdBroker false false false SshdBroker . SshdBroker Sshd false false false OpenSSH SSH Server SshdBroker . Sshd Manual Stopped Win32OwnProcess Sshd Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem false C:\WINDOWS\system32\svchost.exe -k SshBrokerGroup Manual 3 SshdBroker SstpSvc false true true Secure Socket Tunneling Protocol Service RemoteAccess false false false Routing and Remote Access . RemoteAccess RpcSS Bfe RasMan Http Disabled Stopped Win32ShareProcess RemoteAccess RasMan false true true Remote Access Connection Manager RemoteAccess . RasMan SstpSvc DnsCache Automatic Running Win32ShareProcess RasMan . SstpSvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\LocalService Provides support for the Secure Socket Tunneling Protocol (SSTP) to connect to remote computers using VPN. If this service is disabled, users will not be able to use SSTP to access remote servers. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 SstpSvc StateRepository false true true State Repository Service LxssManager false false true LxssManager . LxssManager RPCSS staterepository Manual Running Win32OwnProcess, Win32ShareProcess LxssManager AppXSvc false true true AppX Deployment Service (AppXSVC) . AppXSvc rpcss staterepository Manual Running Win32OwnProcess, Win32ShareProcess AppXSvc . StateRepository rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides required infrastructure support for the application model. false C:\WINDOWS\system32\svchost.exe -k appmodel -p Manual 3 StateRepository stisvc true true true Windows Image Acquisition (WIA) . stisvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess 16 NT Authority\LocalService Provides image acquisition services for scanners and cameras false C:\WINDOWS\system32\svchost.exe -k imgsvc Automatic 2 stisvc StorSvc false false true Storage Service . StorSvc Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides enabling services for storage settings and external storage expansion true C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p AutomaticDelayedStart 10 StorSvc SurfaceDtxService false true true Surface DTX Service . SurfaceDtxService Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem Provides support specific for Surface Hardware false C:\WINDOWS\system32\SurfaceDtxService.exe Automatic 2 SurfaceDtxService SurfaceService false true true Surface Integration Service . SurfaceService Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem Provides support specific for Surface Hardware true C:\WINDOWS\system32\SurfaceService.exe AutomaticDelayedStart 10 SurfaceService SurfaceUsbHubFwUpdateService false true true Surface USB Hub Firmware Update Service . SurfaceUsbHubFwUpdateService EventLog false true true Windows Event Log Wecsvc SurfaceUsbHubFwUpdateService NcdAutoSetup AppVClient netprofm NlaSvc . EventLog Automatic Running Win32OwnProcess, Win32ShareProcess EventLog Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem Provides support for Surface USB Hub Firmware false C:\WINDOWS\System32\SurfaceUsbHubFwUpdateService.exe Automatic 2 SurfaceUsbHubFwUpdateService svsvc false false false Spot Verifier . svsvc Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Verifies potential file system corruptions. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 svsvc swprv false false false Microsoft Software Shadow Copy Provider . swprv RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\System32\svchost.exe -k swprv Manual 3 swprv SysMain false true true SysMain . SysMain rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss fileinfo false false true File Information FS MiniFilter SysMain . fileinfo FltMgr Boot Running FileSystemDriver fileinfo Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Maintains and improves system performance over time. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Automatic 2 SysMain SystemEventsBroker false false true System Events Broker . SystemEventsBroker RpcEptMapper false false false RPC Endpoint Mapper . RpcEptMapper Automatic Running Win32ShareProcess RpcEptMapper RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32ShareProcess 32 LocalSystem Coordinates execution of background work for WinRT application. If this service is stopped or disabled, then background work might not be triggered. false C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p Automatic 2 SystemEventsBroker TabletInputService false false false Touch Keyboard and Handwriting Panel Service . TabletInputService RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables Touch Keyboard and Handwriting Panel pen and ink functionality false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Automatic 2 TabletInputService TapiSrv false false false Telephony Fax false false false Fax . Fax TapiSrv RpcSs Spooler Manual Stopped Win32OwnProcess Fax . TapiSrv RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\NetworkService Provides Telephony API (TAPI) support for programs that control telephony devices on the local computer and, through the LAN, on servers that are also running the service. false C:\WINDOWS\System32\svchost.exe -k NetworkService -p Manual 3 TapiSrv TermService false true true Remote Desktop Services UmRdpService false true true Remote Desktop Services UserMode Port Redirector . UmRdpService TermService RDPDR Manual Running Win32OwnProcess, Win32ShareProcess UmRdpService . TermService RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT Authority\NetworkService Allows users to connect interactively to a remote computer. Remote Desktop and Remote Desktop Session Host Server depend on this service. To prevent remote use of this computer, clear the checkboxes on the Remote tab of the System properties control panel item. false C:\WINDOWS\System32\svchost.exe -k NetworkService Manual 3 TermService Themes false false true Themes . Themes Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides user experience theme management. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Automatic 2 Themes TieringEngineService false false false Storage Tiers Management . TieringEngineService Manual 3 Stopped 1 Win32OwnProcess 16 localSystem Optimizes the placement of data in storage tiers on all tiered storage spaces in the system. false C:\WINDOWS\system32\TieringEngineService.exe Manual 3 TieringEngineService TimeBrokerSvc false false true Time Broker . TimeBrokerSvc Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Coordinates execution of background work for WinRT application. If this service is stopped or disabled, then background work might not be triggered. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 TimeBrokerSvc TokenBroker false false true Web Account Manager . TokenBroker UserManager false false true User Manager XblGameSave TokenBroker . UserManager RpcSs ProfSvc Automatic Running Win32OwnProcess, Win32ShareProcess UserManager Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem This service is used by Web Account Manager to provide single-sign-on to apps and services. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 TokenBroker TrkWks false true true Distributed Link Tracking Client . TrkWks RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Maintains links between NTFS files within a computer or across computers in a network. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Automatic 2 TrkWks TroubleshootingSvc false false false Recommended Troubleshooting Service . TroubleshootingSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Enables automatic mitigation for known problems by applying recommended troubleshooting. If stopped, your device will not get recommended troubleshooting for problems on your device. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 TroubleshootingSvc TrustedInstaller false false false Windows Modules Installer . TrustedInstaller Manual 3 Stopped 1 Win32OwnProcess 16 localSystem Enables installation, modification, and removal of Windows updates and optional components. If this service is disabled, install or uninstall of Windows updates might fail for this computer. false C:\WINDOWS\servicing\TrustedInstaller.exe Manual 3 TrustedInstaller tzautoupdate false false false Auto Time Zone Updater . tzautoupdate Disabled 4 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Automatically sets the system time zone. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Disabled 4 tzautoupdate UdkUserSvc_9164d false false true Udk User Service_9164d . UdkUserSvc_9164d Manual 3 Running 4 240 240 Shell components service false C:\WINDOWS\system32\svchost.exe -k UdkSvcGroup Manual 3 UdkUserSvc_9164d UevAgentService false false false User Experience Virtualization Service . UevAgentService Disabled 4 Stopped 1 Win32OwnProcess 16 LocalSystem Provides support for application and OS settings roaming false C:\WINDOWS\system32\AgentService.exe Disabled 4 UevAgentService UmRdpService false true true Remote Desktop Services UserMode Port Redirector . UmRdpService TermService false true true Remote Desktop Services UmRdpService . TermService RPCSS Manual Running Win32OwnProcess, Win32ShareProcess TermService RDPDR false false true Remote Desktop Device Redirector Driver UmRdpService . RDPDR RDBSS Manual Running KernelDriver RDPDR Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 localSystem Allows the redirection of Printers/Drives/Ports for RDP connections false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 UmRdpService UnistoreSvc_9164d false false true User Data Storage_9164d UserDataSvc_9164d false false true User Data Access_9164d . UserDataSvc_9164d Manual Running 224 UserDataSvc_9164d PimIndexMaintenanceSvc_9164d false false true Contact Data_9164d . PimIndexMaintenanceSvc_9164d Manual Running 224 PimIndexMaintenanceSvc_9164d . UnistoreSvc_9164d Manual 3 Running 4 224 224 Handles storage of structured user data, including contact info, calendars, messages and other content. If you stop or disable this service, apps that use this data might not work correctly. false C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup Manual 3 UnistoreSvc_9164d upnphost false false false UPnP Device Host . upnphost SSDPSRV false true true SSDP Discovery upnphost . SSDPSRV HTTP NSI Manual Running Win32OwnProcess, Win32ShareProcess SSDPSRV HTTP false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . HTTP MsQuic Manual Running KernelDriver HTTP Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Allows UPnP devices to be hosted on this computer. If this service is stopped, any hosted UPnP devices will stop functioning and no additional hosted devices can be added. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation -p Manual 3 upnphost UserDataSvc_9164d false false true User Data Access_9164d . UserDataSvc_9164d Manual 3 Running 4 224 224 Provides apps with access to structured user data, including contact info, calendars, messages and other content. If you stop or disable this service, apps that use this data might not work correctly. false C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup Manual 3 UserDataSvc_9164d UserManager false false true User Manager XblGameSave false false false Xbox Live Game Save . XblGameSave UserManager XblAuthManager Manual Stopped Win32ShareProcess XblGameSave TokenBroker false false true Web Account Manager . TokenBroker UserManager Manual Running Win32OwnProcess, Win32ShareProcess TokenBroker . UserManager RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs ProfSvc false true true User Profile Service XblGameSave TokenBroker UserManager shpamsvc NaturalAuthentication Appinfo . ProfSvc RpcSs Automatic Running Win32OwnProcess, Win32ShareProcess ProfSvc Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem User Manager provides the runtime components required for multi-user interaction. If this service is stopped, some applications may not operate correctly. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 UserManager UsoSvc false true true Update Orchestrator Service . UsoSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Manages Windows Updates. If stopped, your devices will not be able to download and install the latest updates. true C:\WINDOWS\system32\svchost.exe -k netsvcs -p AutomaticDelayedStart 10 UsoSvc VacSvc false false false Volumetric Audio Compositor Service . VacSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\LocalService Hosts spatial analysis for Mixed Reality audio simulation. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 VacSvc VaultSvc false true true Credential Manager . VaultSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32ShareProcess 32 LocalSystem Provides secure storage and retrieval of credentials to users, applications and security service packages. false C:\WINDOWS\system32\lsass.exe Manual 3 VaultSvc vds false false false Virtual Disk . vds RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Provides management services for disks, volumes, file systems, and storage arrays. false C:\WINDOWS\System32\vds.exe Manual 3 vds vmcompute false false true Hyper-V Host Compute Service . vmcompute rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss wcifs false false true Windows Container Isolation vmcompute . wcifs FltMgr Automatic Running FileSystemDriver wcifs hvsocketcontrol false false true hvsocketcontrol vmcompute . hvsocketcontrol Manual Running KernelDriver hvsocketcontrol condrv false false true Console Driver vmcompute . condrv Manual Running KernelDriver condrv Manual 3 Running 4 Win32OwnProcess 16 LocalSystem Provides support for running Windows Containers and Virtual Machines. false C:\WINDOWS\system32\vmcompute.exe Manual 3 vmcompute vmicguestinterface false false false Hyper-V Guest Service Interface . vmicguestinterface Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides an interface for the Hyper-V host to interact with specific services running inside the virtual machine. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 vmicguestinterface vmicheartbeat false false false Hyper-V Heartbeat Service . vmicheartbeat Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Monitors the state of this virtual machine by reporting a heartbeat at regular intervals. This service helps you identify running virtual machines that have stopped responding. false C:\WINDOWS\system32\svchost.exe -k ICService -p Manual 3 vmicheartbeat vmickvpexchange false false false Hyper-V Data Exchange Service . vmickvpexchange Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides a mechanism to exchange data between the virtual machine and the operating system running on the physical computer. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 vmickvpexchange vmicrdv false false false Hyper-V Remote Desktop Virtualization Service . vmicrdv Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides a platform for communication between the virtual machine and the operating system running on the physical computer. false C:\WINDOWS\system32\svchost.exe -k ICService -p Manual 3 vmicrdv vmicshutdown false false false Hyper-V Guest Shutdown Service . vmicshutdown Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides a mechanism to shut down the operating system of this virtual machine from the management interfaces on the physical computer. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 vmicshutdown vmictimesync false false false Hyper-V Time Synchronization Service . vmictimesync VmGid false false false Microsoft Hyper-V Guest Infrastructure Driver vmictimesync . VmGid Manual Stopped KernelDriver VmGid Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Synchronizes the system time of this virtual machine with the system time of the physical computer. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 vmictimesync vmicvmsession false false false Hyper-V PowerShell Direct Service . vmicvmsession Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Provides a mechanism to manage virtual machine with PowerShell via VM session without a virtual network. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 vmicvmsession vmicvss false false false Hyper-V Volume Shadow Copy Requestor . vmicvss Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Coordinates the communications that are required to use Volume Shadow Copy Service to back up applications and data on this virtual machine from the operating system on the physical computer. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 vmicvss vmms false false true Hyper-V Virtual Machine Management . vmms RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS WINMGMT true true true Windows Management Instrumentation vmms NcaSvc iphlpsvc HgClientService . WINMGMT RPCSS Automatic Running Win32OwnProcess, Win32ShareProcess WINMGMT Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Management service for Hyper-V, provides service to run multiple virtual machines. false C:\WINDOWS\system32\vmms.exe Automatic 2 vmms VSS false false false Volume Shadow Copy . VSS RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\vssvc.exe Manual 3 VSS W32Time false false false Windows Time . W32Time Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalService Manual 3 W32Time WaaSMedicSvc false false false Windows Update Medic Service . WaaSMedicSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables remediation and protection of Windows Update components. false C:\WINDOWS\system32\svchost.exe -k wusvcs -p Manual 3 WaaSMedicSvc WalletService false false false WalletService . WalletService Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Hosts objects used by clients of the wallet false C:\WINDOWS\System32\svchost.exe -k appmodel -p Manual 3 WalletService WarpJITSvc false false false WarpJITSvc . WarpJITSvc Manual 3 Stopped 1 Win32OwnProcess 16 NT Authority\LocalService Provides a JIT out of process service for WARP when running with ACG enabled. false C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted Manual 3 WarpJITSvc wbengine false false false Block Level Backup Engine Service . wbengine Manual 3 Stopped 1 Win32OwnProcess 16 localSystem The WBENGINE service is used by Windows Backup to perform backup and recovery operations. If this service is stopped by a user, it may cause the currently running backup or recovery operation to fail. Disabling this service may disable backup and recovery operations using Windows Backup on this computer. false "C:\WINDOWS\system32\wbengine.exe" Manual 3 wbengine WbioSrvc false false true Windows Biometric Service . WbioSrvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem The Windows biometric service gives client applications the ability to capture, compare, manipulate, and store biometric data without gaining direct access to any biometric hardware or samples. The service is hosted in a privileged SVCHOST process. false C:\WINDOWS\system32\svchost.exe -k WbioSvcGroup Automatic 2 WbioSrvc Wcmsvc false true true Windows Connection Manager WlanSvc false true true WLAN AutoConfig . WlanSvc nativewifip RpcSs Ndisuio wcmsvc Automatic Running Win32OwnProcess WlanSvc icssvc false false false Windows Mobile Hotspot Service . icssvc RpcSs wcmsvc Manual Stopped Win32ShareProcess icssvc . Wcmsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs NSI false false true Network Store Interface Service WlanSvc icssvc Wcmsvc upnphost SSDPSRV NcdAutoSetup AppVClient netprofm NlaSvc Netman NcaSvc SessionEnv Netlogon LanmanWorkstation IpxlatCfgSvc iphlpsvc XboxNetApiSvc IKEEXT hns RemoteAccess RasMan debugregsvc Dnscache WinHttpAutoProxySvc Dhcp . NSI rpcss nsiproxy Automatic Running Win32OwnProcess, Win32ShareProcess NSI Automatic 2 Running 4 Win32OwnProcess 16 NT Authority\LocalService Makes automatic connect/disconnect decisions based on the network connectivity options currently available to the PC and enables management of network connectivity based on Group Policy settings. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Automatic 2 Wcmsvc wcncsvc false false false Windows Connect Now - Config Registrar . wcncsvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService WCNCSVC hosts the Windows Connect Now Configuration, which is Microsoft's Implementation of the Wireless Protected Setup (WPS) protocol. This is used to configure Wireless LAN settings for an Access Point (AP) or a Wireless Device. The service is started programmatically as needed. false C:\WINDOWS\System32\svchost.exe -k LocalServiceAndNoImpersonation -p Manual 3 wcncsvc WdiServiceHost false true true Diagnostic Service Host . WdiServiceHost Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService The Diagnostic Service Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local Service context. If this service is stopped, any diagnostics that depend on it will no longer function. false C:\WINDOWS\System32\svchost.exe -k LocalService -p Manual 3 WdiServiceHost WdiSystemHost false true true Diagnostic System Host . WdiSystemHost Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context. If this service is stopped, any diagnostics that depend on it will no longer function. false C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 WdiSystemHost WdNisSvc false false true Microsoft Defender Antivirus Network Inspection Service . WdNisSvc WdNisDrv false false true Microsoft Defender Antivirus Network Inspection System Driver WdNisSvc . WdNisDrv BFE Manual Running KernelDriver WdNisDrv Manual 3 Running 4 Win32OwnProcess 16 NT AUTHORITY\LocalService Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols false "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2010.7-0\NisSrv.exe" Manual 3 WdNisSvc WebClient false false true WebClient . WebClient MRxDAV false false true WebDav Client Redirector Driver WebClient . MRxDAV rdbss Manual Running FileSystemDriver MRxDAV Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k LocalService -p Manual 3 WebClient WebManagement false false false Web Management . WebManagement rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Disabled 4 Stopped 1 Win32OwnProcess 16 LocalSystem Web-based device management service false C:\WINDOWS\system32\WebManagement.exe Disabled 4 WebManagement Wecsvc false false false Windows Event Collector . Wecsvc HTTP false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . HTTP MsQuic Manual Running KernelDriver HTTP Eventlog false true true Windows Event Log Wecsvc SurfaceUsbHubFwUpdateService NcdAutoSetup AppVClient netprofm NlaSvc . Eventlog Automatic Running Win32OwnProcess, Win32ShareProcess Eventlog Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\NetworkService This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. If this service is stopped or disabled event subscriptions cannot be created and forwarded events cannot be accepted. false C:\WINDOWS\system32\svchost.exe -k NetworkService -p Manual 3 Wecsvc WEPHOSTSVC false false false Windows Encryption Provider Host Service . WEPHOSTSVC rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Windows Encryption Provider Host Service brokers encryption related functionalities from 3rd Party Encryption Providers to processes that need to evaluate and apply EAS policies. Stopping this will compromise EAS compliancy checks that have been established by the connected Mail Accounts false C:\WINDOWS\system32\svchost.exe -k WepHostSvcGroup Manual 3 WEPHOSTSVC wercplsupport false false false Problem Reports Control Panel Support . wercplsupport Manual 3 Stopped 1 Win32ShareProcess 32 localSystem This service provides support for viewing, sending and deletion of system-level problem reports for the Problem Reports control panel. false C:\WINDOWS\System32\svchost.exe -k netsvcs -p Manual 3 wercplsupport WerSvc false false false Windows Error Reporting Service . WerSvc Manual 3 Stopped 1 Win32OwnProcess 16 localSystem Allows errors to be reported when programs stop working or responding and allows existing solutions to be delivered. Also allows logs to be generated for diagnostic and repair services. If this service is stopped, error reporting might not work correctly and results of diagnostic services and repairs might not be displayed. false C:\WINDOWS\System32\svchost.exe -k WerSvcGroup Manual 3 WerSvc WFDSConMgrSvc false false false Wi-Fi Direct Services Connection Manager Service . WFDSConMgrSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService Manages connections to wireless services, including wireless display and docking. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 WFDSConMgrSvc WiaRpc false false false Still Image Acquisition Events . WiaRpc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Launches applications associated with still image acquisition events. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 WiaRpc WinDefend false true true Microsoft Defender Antivirus Service . WinDefend RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Helps protect users from malware and other potentially unwanted software false "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2010.7-0\MsMpEng.exe" Automatic 2 WinDefend WinHttpAutoProxySvc false true false WinHTTP Web Proxy Auto-Discovery Service NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE dnscache NSI iphlpsvc Manual Stopped Win32OwnProcess, Win32ShareProcess NcaSvc iphlpsvc false false true IP Helper NcaSvc . iphlpsvc RpcSS winmgmt tcpip nsi WinHttpAutoProxySvc Automatic Running Win32OwnProcess, Win32ShareProcess iphlpsvc . WinHttpAutoProxySvc Dhcp false true true DHCP Client NcaSvc iphlpsvc WinHttpAutoProxySvc NcdAutoSetup AppVClient netprofm NlaSvc . Dhcp NSI Afd Automatic Running Win32OwnProcess, Win32ShareProcess Dhcp Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol. false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 WinHttpAutoProxySvc Winmgmt true true true Windows Management Instrumentation vmms false false true Hyper-V Virtual Machine Management . vmms RPCSS WINMGMT Automatic Running Win32OwnProcess vmms NcaSvc false false false Network Connectivity Assistant . NcaSvc BFE dnscache NSI iphlpsvc Manual Stopped Win32OwnProcess, Win32ShareProcess NcaSvc iphlpsvc false false true IP Helper NcaSvc . iphlpsvc RpcSS winmgmt tcpip nsi WinHttpAutoProxySvc Automatic Running Win32OwnProcess, Win32ShareProcess iphlpsvc HgClientService false false false Host Guardian Client Service . HgClientService Winmgmt Manual Stopped Win32ShareProcess HgClientService . Winmgmt RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 localSystem Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 Winmgmt WinRM false true true Windows Remote Management (WS-Management) . WinRM RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS HTTP false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . HTTP MsQuic Manual Running KernelDriver HTTP Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\NetworkService Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Management requests and processes them. The WinRM Service needs to be configured with a listener using winrm.cmd command line tool or through Group Policy in order for it to listen over the network. The WinRM service provides access to WMI data and enables event collection. Event collection and subscription to events require that the service is running. WinRM messages use HTTP and HTTPS as transports. The WinRM service does not depend on IIS but is preconfigured to share a port with IIS on the same machine. The WinRM service reserves the /wsman URL prefix. To prevent conflicts with IIS, administrators should ensure that any websites hosted on IIS do not use the /wsman URL prefix. true C:\WINDOWS\System32\svchost.exe -k NetworkService -p AutomaticDelayedStart 10 WinRM wisvc false true true Windows Insider Service . wisvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides infrastructure support for the Windows Insider Programme. This service must remain enabled for the Windows Insider Programme to work. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 wisvc WlanSvc false true true WLAN AutoConfig . WlanSvc nativewifip false false true NativeWiFi Filter WlanSvc . nativewifip Manual Running KernelDriver nativewifip RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Ndisuio false false true NDIS Usermode I/O Protocol wlpasvc WwanSvc WlanSvc dot3svc . Ndisuio Manual Running KernelDriver Ndisuio wcmsvc false true true Windows Connection Manager WlanSvc icssvc . wcmsvc RpcSs NSI Automatic Running Win32OwnProcess wcmsvc Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem The WLANSVC service provides the logic required to configure, discover, connect to and disconnect from a wireless local area network (WLAN) as defined by IEEE 802.11 standards. It also contains the logic to turn your computer into a software access point so that other devices or computers can connect to your computer wirelessly using a WLAN adapter that can support this. Stopping or disabling the WLANSVC service will make all WLAN adapters on your computer inaccessible from the Windows networking UI. It is strongly recommended that you have the WLANSVC service running if your computer has a WLAN adapter. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Automatic 2 WlanSvc wlidsvc false false true Microsoft Account Sign-in Assistant . wlidsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables user sign-in through Microsoft account identity services. If this service is stopped, users will not be able to logon to the computer with their Microsoft account. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 wlidsvc wlpasvc false false false Local Profile Assistant Service . wlpasvc WwanSvc false false false WWAN AutoConfig wlpasvc . WwanSvc RpcSs NdisUio Manual Stopped Win32ShareProcess WwanSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32ShareProcess 32 NT Authority\LocalService This service provides profile management for subscriber identity modules false C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p Manual 3 wlpasvc WManSvc false false false Windows Management Service . WManSvc rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem Performs management including Provisioning and Enrollment activities false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 WManSvc wmiApSrv false false false WMI Performance Adapter . wmiApSrv Manual 3 Stopped 1 Win32OwnProcess 16 localSystem Provides performance library information from Windows Management Instrumentation (WMI) providers to clients on the network. This service only runs when Performance Data Helper is activated. false C:\WINDOWS\system32\wbem\WmiApSrv.exe Manual 3 wmiApSrv WMPNetworkSvc false false false Windows Media Player Network Sharing Service . WMPNetworkSvc http false false true HTTP Service WMPNetworkSvc WinRM Wecsvc upnphost SSDPSRV Fax Spooler RemoteAccess PeerDistSvc FDResPub fdPHost . http MsQuic Manual Running KernelDriver http WSearch false true true Windows Search workfolderssvc WMPNetworkSvc . WSearch RPCSS BrokerInfrastructure Automatic Running Win32OwnProcess WSearch Manual 3 Stopped 1 Win32OwnProcess 16 NT AUTHORITY\NetworkService Shares Windows Media Player libraries with other networked players and media devices using Universal Plug and Play false "C:\Program Files\Windows Media Player\wmpnetwk.exe" Manual 3 WMPNetworkSvc workfolderssvc false false false Work Folders . workfolderssvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs wsearch false true true Windows Search workfolderssvc WMPNetworkSvc . wsearch RPCSS BrokerInfrastructure Automatic Running Win32OwnProcess wsearch Manual 3 Stopped 1 Win32ShareProcess 32 NT AUTHORITY\LocalService This service syncs files with the Work Folders server, enabling you to use the files on any of the PCs and devices on which you've set up Work Folders. false C:\WINDOWS\System32\svchost.exe -k LocalService -p Manual 3 workfolderssvc WpcMonSvc false false false Parental Controls . WpcMonSvc Manual 3 Stopped 1 Win32OwnProcess 16 LocalSystem Enforces parental controls for child accounts in Windows. If this service is stopped or disabled, parental controls may not be enforced. false C:\WINDOWS\system32\svchost.exe -k LocalService Manual 3 WpcMonSvc WPDBusEnum false false false Portable Device Enumerator Service . WPDBusEnum RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Stopped 1 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and Image Import Wizard to transfer and synchronize content using removable mass-storage devices. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted Manual 3 WPDBusEnum WpnService false false true Windows Push Notifications System Service . WpnService rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem This service runs in session 0 and hosts the notification platform and connection provider which handles the connection between the device and WNS server. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Automatic 2 WpnService WpnUserService_9164d false false true Windows Push Notifications User Service_9164d . WpnUserService_9164d Automatic 2 Running 4 240 240 This service hosts the Windows notification platform which provides support for local and push notifications. Supported notifications are tile, toast and raw. false C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup Automatic 2 WpnUserService_9164d wscsvc false true true Security Center . wscsvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Automatic 2 Running 4 Win32OwnProcess, Win32ShareProcess 48 NT AUTHORITY\LocalService The WSCSVC (Windows Security Center) service monitors and reports security health settings on the computer. The health settings include firewall (on/off), antivirus (on/off/out of date), antispyware (on/off/out of date), Windows Update (automatically/manually download and install updates), User Account Control (on/off), and Internet settings (recommended/not recommended). The service provides COM APIs for independent software vendors to register and record the state of their products to the Security Center service. The Security and Maintenance UI uses the service to provide systray alerts and a graphical view of the security health states in the Security and Maintenance control panel. Network Access Protection (NAP) uses the service to report the security health states of clients to the NAP Network Policy Server to make network quarantine decisions. The service also has a public API that allows external consumers to programmatically retrieve the aggregated security health state of the system. true C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p AutomaticDelayedStart 10 wscsvc WSearch false true true Windows Search workfolderssvc false false false Work Folders . workfolderssvc RpcSs wsearch Manual Stopped Win32ShareProcess workfolderssvc WMPNetworkSvc false false false Windows Media Player Network Sharing Service . WMPNetworkSvc http WSearch Manual Stopped Win32OwnProcess WMPNetworkSvc . WSearch RPCSS false false false Remote Procedure Call (RPC) . RPCSS RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RPCSS BrokerInfrastructure false false false Background Tasks Infrastructure Service . BrokerInfrastructure RpcEptMapper DcomLaunch RpcSs Automatic Running Win32ShareProcess BrokerInfrastructure Automatic 2 Running 4 Win32OwnProcess 16 LocalSystem Provides content indexing, property caching, and search results for files, e-mail, and other content. true C:\WINDOWS\system32\SearchIndexer.exe /Embedding AutomaticDelayedStart 10 WSearch wuauserv false false true Windows Update . wuauserv rpcss false false false Remote Procedure Call (RPC) . rpcss RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess rpcss Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Enables the detection, download and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 wuauserv WwanSvc false false false WWAN AutoConfig wlpasvc false false false Local Profile Assistant Service . wlpasvc WwanSvc RpcSs Manual Stopped Win32ShareProcess wlpasvc . WwanSvc RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs NdisUio false false true NDIS Usermode I/O Protocol wlpasvc WwanSvc WlanSvc dot3svc . NdisUio Manual Running KernelDriver NdisUio Manual 3 Stopped 1 Win32ShareProcess 32 localSystem This service manages mobile broadband (GSM & CDMA) data card/embedded module adapters and connections by auto-configuring the networks. It is strongly recommended that this service be kept running for best user experience of mobile broadband devices. false C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted -p Manual 3 WwanSvc XblAuthManager false false true Xbox Live Auth Manager XblGameSave false false false Xbox Live Game Save . XblGameSave UserManager XblAuthManager Manual Stopped Win32ShareProcess XblGameSave . XblAuthManager RpcSs false false false Remote Procedure Call (RPC) . RpcSs RpcEptMapper DcomLaunch Automatic Running Win32ShareProcess RpcSs Manual 3 Running 4 Win32OwnProcess, Win32ShareProcess 48 LocalSystem Provides authentication and authorisation services for interacting with Xbox Live. If this service is stopped, some applications may not operate correctly. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 XblAuthManager XblGameSave false false false Xbox Live Game Save . XblGameSave UserManager false false true User Manager XblGameSave TokenBroker . UserManager RpcSs ProfSvc Automatic Running Win32OwnProcess, Win32ShareProcess UserManager XblAuthManager false false true Xbox Live Auth Manager XblGameSave . XblAuthManager RpcSs Manual Running Win32OwnProcess, Win32ShareProcess XblAuthManager Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem This service syncs save data for Xbox Live save enabled games. If this service is stopped, game save data will not upload to or download from Xbox Live. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 XblGameSave XboxGipSvc false false false Xbox Accessory Management Service . XboxGipSvc Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem This service manages connected Xbox Accessories. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 XboxGipSvc XboxNetApiSvc false false false Xbox Live Networking Service . XboxNetApiSvc BFE false false true Base Filtering Engine . BFE RpcSs Automatic Running Win32ShareProcess BFE mpssvc false false false Windows Defender Firewall . mpssvc mpsdrv bfe Automatic Running Win32ShareProcess mpssvc IKEEXT false false false IKE and AuthIP IPsec Keying Modules XboxNetApiSvc . IKEEXT BFE nsi Manual Stopped Win32ShareProcess IKEEXT KeyIso false false true CNG Key Isolation XboxNetApiSvc dot3svc Eaphost . KeyIso RpcSs Manual Running Win32ShareProcess KeyIso Manual 3 Stopped 1 Win32ShareProcess 32 LocalSystem This service supports the Windows.Networking.XboxLive application programming interface. false C:\WINDOWS\system32\svchost.exe -k netsvcs -p Manual 3 XboxNetApiSvc