Windows XP / 2003 System Service Optimization Settings Detailed Huang Rong Appendix article
When Windows XP / 2003 is launched, there will always be quite a number of programs or services being transferred to the system's memory, which is used to control hardware devices, memory, file management, or other important system features of the Windows system. However, a large part of these services is that users are not needed, but in terms of system security, it will cause great hidden dangers. We can properly disable the system services you need according to your needs, which can not only save system resources, but also speed up system operation, but also protect the role of system security.
First, what is system service 1. What is system service in a Windows 2000 / XP / 2003 system, the service refers to the program, routine or process that performs the specified system function, in order to support other programs, especially low-level (proximity hardware) programs. . The service can be released in the Active Directory (Active Directory) through the network, thereby promoting service-centric management and use.
The service is an application type that is running in the background. Service applications can usually provide some features to users locally and over the network, such as client / server applications, web servers, database servers, and other server-based applications.
2. The role of system services (1) Start, stop, pause, restore, or disable remote and local computer services.
(2) Manage services on local and remote computers.
(3) Set the fault recovery operation when the service fails. For example, re-start the service or restart your computer.
(4) Enable or disable services for specific hardware profiles.
(5) View the status and description of each service.
Second, the configuration and management system service passes the above reading, I believe that you have made a understanding of the Windows system service, similar to the system registry, the operation of the system service, we can implement it through the Service Management Console.
1. System Service Console logs in as an administrator or Administrators group, click Start → Run menu item, type "Services.msc" and enter "Services.msc" and enter the service management console in the dialog box, you can open the Service Management Console ",As shown in Figure 1. You can also start the console by clicking Start → Control Panel → Performance and Maintenance → Administration Tools → Services option.
In the service console, double-click any of the services, you can open the property dialog box, as shown in Figure 2. Here, we can configure, manage operations, and set up the startup, shutdown or disable service that meets yours needed by changing the startup type of the service.
In the "General" tab, "Service Name" refers to the "referred to as" referred to as "the name shown in the registry;" Display Name "refers to the name of each service in the service configuration interface;" Description "It is a simple explanation for the service;" The path of executable "is the specific location of the executable file corresponding to the service;" Start Type "is the core of the entire service configuration, for any of the services, usually there are 3 Start type, automatic, manual, and disabled. As long as you select from the drop-down menu, you can change the start type of the service. "Service Status" means that the current state is started or stopped, usually, we can use the "Start", "Stop", "Suspend", "Restore" button to change the status of the service.
Let's take a look at the three different types of startup status:
Auto: This service starts when the system starts, it will extend the time required to start, and some services must be set to auto, such as Remote Procedure Call (RPC). Due to dependence relationships or other impacts, other services must also be set to automatic, such services do not change it, otherwise the system cannot run normally.
Manual: If a service is set to manually, you can run it again when you need it. This saves a lot of system resources and speeds up the system start.
Disabled: Such services cannot be run again. This setting is generally used when improving system security. If you suspect a strange service will bring your system to your system, you can try to stop it, see if the system can run normally, if everything is normal, then you can disable it. If this service is required later, you must set the start type to automatic or manual before starting it. Click the Depending Relationship tab, here we can see that in the top list points to other services required to run the selected service, the bottom list points out the service that needs to run the selected service to run correctly. It explains that some services cannot be run separately and must rely on other services. Before you stop or disable a service, you must look at the dependency of this service. If you have other services that need to be started, you can't stop it. Before stopping or disabling a service, it is essential to understand the dependency of the service.
2. Select the account of the running service in the above dialog box to do one of the following:
(1) To use the local system account, click the Local System Account option.
(2) To use the local desk account, click this Account option and type "NT Authority / LocalService".
(3) To use the network service account, click this Account option, then type "NT Authority / NetworkService".
(4) To specify another account, click this Account option, and then click the "Browse" button, then specify the user account in the Select User dialog box.
Finally, type the password for the user account in the Password and Confirm Password box, click the "OK" button.
Note: You must configure the user account to log in to the service. To verify that the user account has been properly configured, right-click the user account in "Local User and Group". On the General tab of the Properties dialog, confirm that the selected "Password Never Expired" check box is selected, and then click the Member tab to confirm that the user is a member of the appropriate group.
If the selected account is not permissions for the service login, the service will automatically grant the appropriate permissions of the account on your currently managed computer.
Third, the backup and disaster protection of system services 1. Backup system services are quite important to backups before configuring the system service, once an error can be restored to normal. Here, we introduce the direct backup registry in the registry related to service.
(1) Run the registry editor, select the Registry HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SERVICES.
(2) Click the File → Export menu command, in the dialog box that appears, click the Selected Branch option, export the registry content under this branch and saved as a REG file. If you need to restore the system service, you can double-click the REG file to import the registry.
2. Disaster protection If you accidentally disable an important service, you can't start with Windows, so you can't restart the appropriate service, which causes a vicious circle. In this case, we can only use the system console to make manual recovery. In the system console, we can start the type of service or control service.
Place the Windows XP installation CD into the CD-ROM, and then set the drive boot to priority in the BIOS. When you start your computer Enter the "Welcome to the Installer" interface, press the R key to enter the Windows XP "Fault Recovery Console" interface in accordance with the prompt. Select the system that needs to be repaired and type the system administrator password.
In the command prompt state, we need to use the "Enable" and "Disable" commands. Among them, the enabled command format is "enable [service_name]"; disable command format is "disable [service_name]". Here, [service_name] is desired to enable / disable service or device name, [startup_type] is the type of startup, which shows different start types. The types of available include service_disabled, service_boot_start, service_system_start, service_auto_start, service_demand_start. Below we use the system help in Windows XP as an example, first set the service startup type to disable, and then re-enable it.
(1) Enter the "Fault Recovery Console" interface, run the "listsvc" command to view the running status of various services, here, we can see that the system help is started, enter the "disable helpsvc" command and enter, ie System help services can be disabled.
(2) If you need to restart the service and set the service automatically run with the system, you can enter the "Enable Helpsvc Service_Boot_Start" command to enter.
In the above, we have made detailed explanations for the configuration and management of system services. Let us understand the specific meaning of each service in the system.
Note: The services involved in this article are the default services after the Windows XP installation.
Fourth, the system function service details 1.alerter alerter. The system-related events involved in the system are transmitted to the computer or user specified on the network, for example, when a print error or hard disk is about to write, that is, the service is responsible for collecting and sending. The service process is named services.exe (ie, the process name running after the service is started, you can see the task manager, as shown in Figure 3).
Dependence: Workstation
Recommendation: General household computers do not need to transmit or receive a warning of computer system management, unless your computer is used on a local area network.
2.Application Management Appmgmt (Application Management Service). Provide software installation services such as dispatch, distribution, and delete. The service process is named SVCHOST.EXE.
Dependence: no
Recommendation: Start.
3.automatic Updates Wuauseerv (Automatic Update Service). Enable Windows Update Download and Install from Windows Update. The service process is named SVCHOST.EXE.
Dependence: no
Recommendation: Start.
4.clipbook clipsrv (Scrapbook). Enable the "Scrapbook Viewer" storage information and share it with remote computers. The service process is named clipsrv.exe.
Dependency: Network DDE
Recommendation: This service is not included in the general home computer, and can stop according to the specific situation.
5.com Event System EventSystem (COM Event System Service). Support System Event Notification Services (SENS), this service provides automatic distribution capabilities for the Subscribe Component Object Model (COM) component event. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC) and System Event Notification
Suggestions: Some programs may use COM components, like Bootvis Optimize System applications, start according to specific situations.
6.com System Application COMSYSAPP (COM System Application Service). Manage configuration and tracking based on COM components. The service process is named Dllhost.exe. Dependence: Remote Procedure Call (RPC)
Recommendation: If com event system is a car, COM System Application is the driver, and it is started according to the specific situation.
7. Cryptographic Services CryptsVC (Authentication Service). Provide three management services, catalog database services, it determines the signature of the Windows file; protected root service, it adds and deletes the certificate of the trusted root certificate; the key service, it helps to register this computer to get the certificate . If this service is terminated, these management services will not function properly. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: This service is Windows Hardware Quality Lab (WHQL) authentication if you use Automatic Updates, start.
8. Distributed Transaction Coordinator MSDTC (Distributed Transaction Coordinator). Coordinate transactions across multiple databases, message queues, file systems and other resource managers. The process of the service is named MSDTC.exe.
Depending relationship: Remote Procedure Call (RPC) and Security Accounts Manager
Recommendation: General household computers are not covered unless you enable the Message Queuing service, stop.
9. Error Reporting Service ERSVC (Error Report Service). Error reports are allowed when running in non-standard environments. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: The service is Microsoft's application error report, based on security consideration, stop.
10. Event Log EventLog (System Event Record Service). Enable event log messages issued based on Windows-based programs and components. The service process is called Services.exe.
Dependence: Windows Management Instrumentation
Recommendation: This service is a basic service, please do not adjust its status.
11. Fast User Switching Compatibility FastuserswitchingCompaTibility (Multi-user fast switching service). Manage applications that need assistance in multi-user states. The service process is named SVCHOST.EXE.
Dependency: Terminal Services
Suggestion: Based on security considerations, if multiple user environments are not used, stop.
12.Help and support Helpsvc (Help Service). Enable the Help and Support Center on this computer. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: It can be stopped according to the specific situation.
13.Human Interface Device Access Hidserv (User-friendly Interface Device Service). Enable universal input access to the Smart Interface Device (HID), it activates and saves the keyboard, remote control, and predefined shortcuts on other multimedia devices. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: If you have an ergonomic standard (keyboard, mouse), set this service to automatic. 14.indexing Service CISVC (Index Service). The index content and properties of the files on the local and remote computers provide file quick access by flexible query language. The service process is called CISVC.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: This service allows you to speed up the search speed, but you should make a remote computer search and stop.
15. Internet Connection FireWall (ICF) / Internet Connection Sharing (ICS) SharedAccess (Internet Connection Sharing and Firewall Services). Provide network address conversion, addressing, and name resolution and / or prevention of intrusion services for family or small office networks. The service process is named SVCHOST.EXE.
Dependence: Application Layer Gateway Service, Network Connences, Network Location Awareness (NLA), Remote Access Connection Manager
Recommendation: If you do not use Internet Online Sharing (ICS) or built-in Internet Online Firewall (ICF), stop.
16.Logical Disk Manager Administrative Service Dmadmin (Logical Disk Administrator System Management Service). Configure hard drives and volumes. This service is only run for configuration processing and then terminates. The service process is named Dmadmin.exe.
Dependence: Plug and Play, Remote Procedure Call (RPC), Logical Disk Manager
Recommendation: Using the Microsoft Management Console (MMC) The function of the main control station, it can be set to manually depending on the specific situation.
17.Print Spooler Spooler (Print Background Processing Service). Load the file into the memory, and then send the data to the printer processing after the printer is idle. The service process is named Spoolsv.exe.
Dependence: Remote Procedure Call (RPC)
Recommendation: Set to manual. If there is no printer, you can stop.
18.Remote Registry RemoteRegistry (Remote Registry Service). Make remote users to modify registry settings on this computer. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: Based on security reasons, if there is no special demand, stop.
19. Security Accounts Manager Samss (Security Account Management Service). Store security information for the local user account. The service process is named lsass.exe.
Depending relationship: Remote Procedure Call (RPC), Distributed Transaction Coordinator
Recommendation: Managing Accounts and Group Policy (GPEDIT.MSC) applications, start.
20.SSDP Discovery Service SSDPSRV (Discovery Services of Simple Service Discovery Agreement). Enable searches for generic plug and playing devices on your home network. Universal Plug and Play, UPnP enables the computer to find and use the device on the network, search the device through TCP / IP via TCP / IP via the network. The service process is named SVCHOST.EXE.
Dependence: Universal Plug and Play Device Host
Suggestion: Based on security considerations, stop.
21.System Event Notification SENS (System Event Notification Service). Track system events such as logging in to Windows, networks, and power events. Notify these events to the COM Event System subscriber (SUBSCRIBER). The service process is named SVCHOST.EXE. Dependent relationship: com Event SYSTEM
Suggestion: Based on security considerations, stop.
22. Task Scheduler Schedule. User can configure and develop a schedule for automatic tasks on this computer. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: Set the automatic timing disk scan, viral timing scan, update, etc., depending on the situation.
23.Themes Themes. Provide users with desktop topics management. The service process is named SVCHOST.EXE.
Dependence: no
Recommendation: Many people prefer to use XP desktop topics, start.
24. UPLOAD Manager UploadMgr (Upload Management Service). Manage synchronization and asynchronous file transfer between clients and servers on the network. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: Depending on the situation, stop.
25. Volume Shadow Copy VSS (Upload Management Service). Manage and execute a shadow copy for backup and other purposes. The service process is named vssvc.exe.
Dependence: Remote Procedure Call (RPC)
Recommendation: Depending on the situation, stop.
26.WebClient WebClient (Web Client Service). Make Windows-based programs can create, access, and modify Internet-based files. The service process is named SVCHOST.EXE.
Dependence: WebDav Client Redirector
Recommendation: Using WebDAV to upload files to all web services, stop based on security considerations.
27.Windows Installer MSIServer (Windows Installation Service). Install, fix, or delete the software based on the instructions contained in the MSI file. It is a system service that assists users to properly install, set, track, upgrade, and remove software programs, manage applications, standard formats, and track, such as archive groups, login projects, and shortcuts. . The service process is named msiexec.exe.
Dependence: Remote Procedure Call (RPC)
Recommendation: Depending on the specific situation.
28.Windows Management Instrumentation (WMI) Winmgmt (Windows Management Specification Service). Provide common interfaces and object patterns to access management information about operating systems, devices, applications, and services. The service process is named SVCHOST.EXE.
Dependent relationship: Event log, Remote Procedure Call (RPC)
Recommendation: It is a service that provides standard infrastructure to monitor and manage system resources, start.
V. Detailed Function Extended Services 1. IMAPI CD-Burning COM Service IMAPISERVICE (IMAPI CD Burn Service). Manage CD burn with Image Mastering Applications Programming Interface (IMAPI). If the service is stopped, this computer will not record the CD. The service process is named IMAPI.exe.
Dependence: no
Suggestion: Windows XP integrated CD burn is a single one, depending on the specific situation, stop.
2. IPsec Services DMServer (IP Security Service). Monitor and monitor new hard drives and send volume information to the logical disk manager management service to configure. The service process is named SVCHOST.EXE. Dependency: IPsec Driver, Remote Procedure Call (RPC), TCP / IP Protocol Driver
Recommendation: Assistance to protect data transmitted via network, IPsec is an important part, providing security in the virtual private network (VPN), while VPN allows organizations to secure data via the Internet. General users do not involve, stop.
3.Logical Disk Manager DMServer (Logical Disk Administrator Service). Monitor and monitor new hard drives and send volume information to the logical disk manager management service for configuration. The service process is named SVCHOST.EXE.
Dependence: Plug and Play, Remote Procedure Call (RPC), Logical Disk Manager Administrative Service
Recommendation: This service must not be available for users who often use mobile hard drives, flash drives, etc., according to specific situations, start.
4.ms Software Shadow Copy Provider SWPRV (Managing Disk Area Volume Copy Service). If the service is stopped, the software shadow copy will not be managed, and any service that relies on its will not be able to start, such as MS Backup. The service process is named Dllhost.exe.
Dependence: Remote Procedure Call (RPC)
Recommendation: Start according to the specific situation.
5.Performance logs and alerts sysmonlog (Vigor Record Logs & Warning Services). Collect local or remote computers based on performance data for pre-configured schedule parameters, then write this data to logs or trigger alerts. The service process is named SMLogsvc.exe.
Dependence: no
Recommendation: Stop.
6.plug and play plugplay (Plug and Play Service). Enable the computer to identify and adapt to hardware changes without user input. The service process is called Services.exe.
Relationship: Logical Disk Manager, Logical Disk Manager Administrative Service, Messenger, Smart Card, Telephony, Windows Audio
Recommendation: Termination or disabling this service will cause system unstable and start.
7.Portable Media Serial Number Service WMDMPMSN (portable media serial number service). Get the serial number of the media player in the system to control pirated music files to replicate to portable players, such as MP3, MD, etc. The service process is named SVCHOST.EXE.
Dependence: no
Recommendation: Start.
8.Protected Storage Protected Storage (protected storage area service). Provides protective storage for sensitive data (such as passwords) to prevent unauthorized services, procedures or users from illegal access. The service process is named lsass.exe.
Dependence: Remote Procedure Call (RPC)
Recommendation: Depending on the specific use environment, it is recommended to stop in an insecure environment.
9. Removable Storage NTMSSVC (Removal Storage Device Service). Management of special removable memory, such as ZIP floppy drive and tape drive. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: The average person rarely involves such special equipment and stops.
10. SHELL HARDWARE Detection ShellHwdetection (Case Hardware Probe). Provide notifications for automatic play hardware events. The service process is named SVCHOST.EXE. Dependence: Remote Procedure Call (RPC)
Recommendation: Generally, it is usually used on a memory card or CD, a DVD device.
11.Smart Card SCARDSVR (Smart Card Service). Manage this computer to access your smart card. If this service is terminated, this computer will not be able to read smart cards. The service process is named Scardsvr.exe.
Dependent relationship: Plug and play
Suggest: If you don't use a smart card, stop.
12.Smart Card Helper ScardDRV (Smart Card Assistance Service). Enable the support of the old unsettled smart card reader for this computer. The service process is named Scardsvr.exe.
Dependence: no
Suggest: If you don't use a smart card, stop.
13.System Restore Service SRService. Execute the system restore function. To stop the service, please restore the system restored from the system of "My Computer" properties. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
It is recommended that the computer will be replied to the previous state, depending on the specific situation.
14.Telephony TapsRV (phone speech). Provide support for TAPI to control the telephone devices on the local computer, server, and LANs and IP-based voice connections. The service process is named SVCHOST.EXE.
Dependence: Plug and Play, Remote Procedure Call (RPC), Remote Accept Connection Manager, Remote Access AUTO Connection Manager
Recommendation: General dial-up modem or some DSL / Cable may be used depending on the situation.
15.unInterruptible Power Supply UPS (UPS Power Management Service). Manage Uninterruptible Power Supply (UPS) connected to your computer. The service process is named UPS.exe.
Dependence: no
Recommendation: The average person does not use UPS, stop.
16. Eniversal Plug and Play Device Host UpNphost (Unified Plug and Play Drive Host Service). Support for universal plug and play devices. Mainly used to detect installing universal plug-and-play service devices such as digital cameras or printers. The service process is named SVCHOST.EXE.
Dependency: SSDP Discovery Service
Recommendation: Depending on the situation, stop.
17.Windows Audio Audiosrv (Windows Audio Services). Manage an audio device based on a Windows program. The service process is named SVCHOST.EXE.
Dependent relationship: Plug and Play, Remote Procedure Call (RPC)
Suggest: If you don't have a sound card, you can stop it.
18.Windows Image Acquisition (WIA) Stisvc (Windows Image Get Service). Provide image capture services for scanners and cameras. If the scanner and digital camera have support WIA function, you can see the image file directly, and other drivers are required. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: Users without scanners and digital cameras, stop.
19.Windows Management Instrumentation Driver Extensions WMI (Windows Management Specification Drive Extended). Switching system management information between driver. The service process is named SVCHOST.EXE. Dependence: no
Recommendation: The extension of the WMI service provides information, start.
20.Windows Time W32Time (Windows Time Setting). Maintain all clients and servers on the network and the time and date synchronization. The service process is named SVCHOST.EXE.
Dependence: no
Recommendation: Depending on the situation, start.
21.Wireless Zero Configuration WZCSVC (Wireless Configuration Service). Automatic configuration for your 802.11 adapter. The service process is named SVCHOST.EXE.
Dependency: NDIS Usermode I / O Protocol, Remote Procedure Call (RPC)
Recommendation: Depending on the situation, start.
22. WMI Performance Adapter WMIAPSRV (WMI Performance Adapter Service). Provider performance library information from WMI HiPERF. The service process is called WMIAPSRV.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: Depending on the situation, stop.
6. Detailed web services 1.application Layer Gateway Service ALG (Application Layer Gateway). Support for Internet Connection Sharing and Internet Connection Firewalls. The service process is named alg.exe.
Dependence: Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
Recommendation: If you don't use Internet Online Sharing (ICS) to provide multiple computers Internet access and Internet online firewall (ICF) software, stop.
2. Background Intelligent Transfer Service Bits (Background Intelligent Transfer Service). Use idle network bandwidth to transfer data. When the network cut or computer needs to restart, the service will automatically transfer file transfer. When the network is reconnected, the service will continue to transfer files from the stop. The service process is named SVCHOST.EXE.
Relationship: Remote Procedure Call (RPC) and Workstation
Recommendation: The application of the service is to implement the breakpoint resume transmission when Windows automatic update, start according to the specific situation of Automatic Updates service.
3.Computer Browser Browser (Computer Browser Service). Maintain the list of updates on your network and provide the list to your computer to specify browsing. The service process is named SVCHOST.EXE.
Dependence: Server and Workstation
Recommendation: General household computers are not covered unless your computer is within the local area network, stop.
4.DHCP Client DHCP (DHCP Client Service). Manage network configurations by registering and changing the IP address and the DNS name. Simply put, DHCP is a host that automatically assigns all network parameters to any computer in the network, while the DHCP client is an object computer assigned network parameters in the network. The service process is named SVCHOST.EXE.
Dependency: AFD network support environment, Symtdi, TCP / IP Protocol Driver and NetBIOS over TCP / IP
Suggest: If your machine can automatically assign parameters such as IP addresses in the network, stop. For home users, as long as you use DSL / Cable Internet, enable ICS and IPSec services, this service needs this service to specify static IP, start. 5.Distributed Link Tracking Client Trkwks (Distributed Connection Tracking Client Service). Keep link between NTFS files within a computer or keep a link between the computer in the network domain. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC)
Recommendation: For users who are not in the local area, stop.
6.DNS Client DNSCACHE (DNS Client Service). For this purpose, the Name System (DNS) name for this computer. The service process is named SVCHOST.EXE.
Dependency: TCP / IP Protocol Driver
Suggestions: In fact, a website is not only one server work, based on security consideration, stop.
7.Messenger Messenger. Transport Net Send and Alerter service messages between clients and servers. This service is independent of Windows Messenger. The service process is named SVCHOST.EXE.
Dependency: Netbios Interface, Plug and Play, Remote Procedure Call (RPC), Workstation
Suggestion: Based on security considerations, stop.
8.NET Logon Net Logon (domain login service). Support network computer PASS-THROUGH account login authentication event. The service process is named lsass.exe.
Dependence: Workstation
Recommendation: When you want to log in to the domain server using the network server, start.
9.Netmeeting Remote Desktop Sharing MnMsrvc (Netmeeting Remote Desktop Sharing). Allows authorized users to use NetMeeting to remotely access this computer on the company Intranet. The service process is named mnmsrvc.exe
Dependence: Remote Procedure Call (RPC)
Recommendation: The remote desktop sharing function will not be used depending on the specific situation, stop, but after turning it off.
10.Network Connections Netman. To manage the object in the Network and Dial-up folders, you can view the LAN and remote connection. The service process is named SVCHOST.EXE.
Relationship: Remote Procedure Call (RPC), Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)
Recommendation: After it is closed, you will not see what you can't see in the Network and Dial-up dialog. Don't say new connections and dial-up online, so unless your machine is an absolute stand-alone environment, start.
11.Network DDE NetDDE (Network Dynamic Data Exchange Service). Network transmission and security for dynamic data exchange (DDE) for programs running on different computers. The service process is named NetDe.exe.
Dependency: Network DDE DSDM, Clipbook
Recommendation: If you don't have a CLIPBOOK service, stop.
12.Network DDE DSDM NetDDE DSDM (Network Dynamic Data Exchange Network Sharing Service). Manage Dynamic Data Exchange (DDE) network sharing. The service process is named NetDe.exe.
Dependency: Network DDE
Recommendation: If you don't have a NetWork DDE service, stop.
13.Network Location Awareness NLA (Network Location Identification Service). Collect and save network configuration information, and notify the application when information changes. The service process is named SVCHOST.EXE. Dependency: AFD Network Support Environment, TCP / IP Procotol Driver, Internet Connection FireWall (ICF) / Internet Connection Sharing (ICS)
Recommendation: Launched for mobile office users.
14.NT LM Security Support Provider NTLMSSP (NT LM Security Support Provider). Provide security mechanisms for remote procedure calls (RPC) programs that use transport protocols rather than named pipes. The service process is named lsass.exe.
Dependent relationship: telnet
Recommendation: If you don't use the Message Queuing or Telnet Server service, stop.
15. QoS RSVP RSVP (QoS License Control Service). Provide network signals and local communication control installation capabilities for programs and control applications that rely on quality service (QoS). The service process is named RSVP.exe.
Dependency: AFD network support environment, TCP / IP Protocol Driver, Remote Procedure Call (RPC)
Recommendation: Used to retain 20% of services, if your network card does not support 802.1p or not ACS Server in your computer, stop.
16. Remote Access Auto Connection Manager Rasauto (Remote Access Auto Online Administrator Service). Whenever a program creating a remote DNS, a NetBIOS name or address, a connection to a remote network is created. The service process is named SVCHOST.EXE.
Relationship: Remote Access Connection Manager, Telephony
Recommendation: If your machine provides network sharing, start it to avoid manual connection after the network is disconnected, otherwise stop.
17. Remote Access Connection Manager Rasman (Remote Access Online Administrator Service). Create a network connection. The service process is named SVCHOST.EXE.
Dependence: Telephony, Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS), Remote Access Auto Connection Manager
Recommendation: Depending on the specific situation.
18. Remote Desktop Help Session Manager Rdsessmgr (Remote Desktop Assistance). Manage and control remote assistance. If this service is terminated, remote assistance will not be available. See the "Depending" tab on the Properties dialog before terminating this service. The service process is called sessmgr.exe.
Dependence: Remote Procedure Call (RPC)
Recommendation: Used to manage and control remote assistance, if you do not use it, you can stop.
19.Remote Procedure Call (RPC) RPCSS (Remote Process Call). Provides endpoint mappers and other RPC services. The service process is named SVCHOST.EXE.
Relationship: quite a number of services rely on its operation
Recommendation: Many services need to be run, start.
20. Remote Procedure Call (RPC) Locator RpClocator (Remote Procedure Call Location Service). Manage RPC Name Service Database. Through its name management of RPC, the caller can find the location of the caller. The service process is named locator.exe.
Dependence: Workstation
Recommendation: Due to the existence of the system registry, use naming management without the actual meaning, stop. 21. ROUTING AND Remote Access RemoteAccess (Routing and Remote Access Service). Routing services are provided in the local area network and a wide area network environment. The service process is named SVCHOST.EXE.
Dependence: Remote Procedure Call (RPC), NetBiosGroup
Recommendation: Provide a dial-up online to a wide area network or a VPN service, the general user is not used, stopped.
22. Secondary Logon Seclogon (Second Login Service). On the computer used by multiple users, some users have causing certain programs that cannot be executed because of non-administrator privileges. In order to let the logged in user without administrator privileges can use this program, Windows XP is designed to assign temporary administrator privileges. The service process is named SVCHOST.EXE.
Dependence: no
Suggestion: Based on security considerations, stop.
23. Server LanmanServer (Server Service). This computer is supported through the network file, print, and named pipe sharing. These features are not available if the service is stopped. The service process is named SVCHOST.EXE.
Dependency: Computer Browser
Recommendation: If there is no need to share with other computers, stop.
24.TCP / IP NetBIOS Helper LMHOSTS (TCP / IP NetBIOS Assistant Service). Allow support for "NetBios (NetBT)" services on TCP / IP and NetBIOS names. The service process is named SVCHOST.EXE.
Dependent relationship: AFD network support environment, NetBIOS over TCP / IP
Recommendation: If your network does not use NetBIOS or WINS, stop.
25.Telnet TLNTSVR (Remote Login Service). Allow remote users to log in to this computer and run the program and support a variety of TCP / IP Telnet customers, including UNIX and Windows computers. The service process is called TLNTSVR.EXE.
Dependency: NT LM Security Support Provider, Remote Procedure Call (RPC), TCP / IP Protocol Driver
Suggestion: Based on security consideration, there is no special demand, stop.
26.Terminal Services TermService. Allow multiple users to connect and control a computer, and display desktops and applications on remote computers. The service process is named SVCHOST.EXE.
Depending relationship: Remote Procedure Call (RPC), Fast User Switch Compatibility, InteractiveLogon
Recommendation: Remote desktops or remote assistance features, such as no special needs, stop.
27.WorkStation Lanmanworkstation. Create and maintain client network connections to remote services. The service process is named SVCHOST.EXE.
Dependence: Alerter, Background Intelligent Transfer Service, Computer Browser, Messenger, Remote Procedure Call (RPC) Locator
Suggestion: Some features necessary to connect the Internet network, start.
