awcolley.com | Windows/Dealing with Win2K/XP Services

< Windows Registry Tweaks | Working With Windows | Fixing the MBR >

Dealing with Win2K/XP Services

On this page:

Accessing system services
Default settings for system services
Nonessential services
Dealing with services using the command line or batch files
How to grant (non-admin) users rights to manage services

Also, check these sites for comprehensive and informative lists of services and what they are for:

Accessing system services

One could go through Control Panel + Administrative Tools, but that is a lot of mousing. Simply go to Run… and enter services.msc.

Default settings for system services

Tech-Recipes Tip 236: Manipulating windows services can be fun but can make a system extremely unstable. If you have mucked around and broken Windows by disabling the wrong service or set of services, could you remember what the default Startup Type is for each Windows service? Well, neither could I. Fortunately, M$ actually anticipated this and created a help page that shows all the Windows services and their default settings. From the Services window, select Help + Help Topics. The desired help page is under Services + Concepts + Default settings for services.

Nonessential services

The following is quoted from Tech-Recipes Tip 1036, so the “I” here is not me! (I alphabetized his list):

XP has a ton of services enabled by default. By knowing what these services do (or don’t do), you may be able to speed up your system by disabling the ones you don’t need.

Alerter --- This is so useless SP2 turns this off for you. For the rest of you folks, you should turn it off too.

Clipbook --- This service allows you to cut and paste across your private network. Most programs that actually allow you to do this use their own ways for doing this. Useless. Disable it.

Computer Browser --- If you are on a LAN, keep it enabled. If not, disable it. It allows you to see the other computers on your network.

Error Reporting Service --- A program crashes and M$ wants to know about it. Give up your extra CPU cycles to help Gates polish his OS, or you can just disable it.

FastUser Switching Compatibility --- If you keep multiple users/logins on your current computer, you should leave this enabled. If you always log-in the same way as the same person, you should disable this.

Messenger --- Disable it, disable it. We’ve been saying to disable this forever. (SP2 disables this.)

NetMeeting Remote Desktop Sharing --- If you don’t use NetMeeting, you should disable this service.

Network DDE / Network DDE DSDM --- DDE DSDM was an excellent idea by M$ that flopped. Disable both of these.

Remote Desktop Help Session Manager --- I use remote desktop all the time. However, you should not have it enabled unless you use it.

Remote Registry --- This service allows one to remotely edit the registry through a network connection. If you are editing your registry remotely, then you are too jedi-ninja to be reading this. The rest of us should have this off for security alone.

Smart Card / Smart Card Helper --- If you don’t have a smart card system, you don’t need this service. As smart cards have really never taken off… I doubt you need this. Disable it.

TCP/IP NetBIOS Helper --- Unless you run NetBIOS on your system, you don’t need this service. Disable it.

Telnet --- This allows you to use telnet to log into your system from a remote location. It’s a security risk so don’t keep it enabled unless you use it. SP2 disables it by default now.

Uninterruptible Power Supply --- Although I should have a UPS, I don’t. If you don’t, then disable this service.

Wireless Zero Configuration --- Unless you use wi-fi, you can safely stop this service. If you use wi-fi, this is actually a nice little service.

In addition to the above services, One Computer Guy suggests considering the services listed below. Some of these may be specific to WinXP, and many of them are not automatically started anyway (at least not on the WinXP installations I checked).

Application Management --- Allows software to tap directly into the Add/Remove Programs feature via the Windows Installer technology. [Ed. this sounds useful to me, perhaps I don't understand.]

Background Intelligent Transfer Service --- The Background Intelligent Transfer service is used by programs (such as Windows AutoUpdate) to download files by using spare bandwidth. [Ed. this also sounds useful to me; though, perhaps setting it to manual might be a good thing if you update infrequently.]

Help and Support --- Allows the XP Built-in Help and Support Center to run.

IMAPI CD-Burning COM Service - You don't need this if you have other software to create CDs.

Indexing Service --- Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.

IP SEC - Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. If you are not on a domain, you likely don't need this running.

Net Logon --- Supports pass-through authentication of account logon events for computers in a domain. If you are not on a domain, you don't need this running.

NT LM Security Support Provider --- Provides security to remote procedure call (RPC) programs that use transports other than named pipes.

Performance Logs and Alerts --- Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If you don't need to monitor your performance logs, then you don't need this service.

Portable Media Serial Number --- Retrieves the serial number of any portable music player connected to your computer

QOS RSVP --- Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.

Routing & Remote Access --- Offers routing services to businesses in local area and wide area network environments. Allows dial-in access.

Secondary Login --- Enables starting processes under alternate credentials. This is what allows you to run an application as another user.

Upload Manager --- Manages synchronous and asynchronous file transfers between clients and servers on the network.

Volume Shadow Copy Service --- Manages and implements Volume Shadow Copies used for backup and other purposes.

Web Client --- Enables Windows-based programs to create, access, and modify non-local files across the Internet [Ed. I could not get this service to stop.]

WMI Performance Adapter --- Provides performance library information from WMI HiPerf providers.

Dealing with services using the command line or batch files

From ss64.com: The NET Command is used to manage services as follows:

Syntax

   NET START service
   NET STOP service
   NET PAUSE service
   NET CONTINUE service

Key

   service : The service name as shown in Control Panel, Services

To list the basic NT Services:

   NET HELP SERVICES

To list the running NT Services:

   NET START

If you try to start a service that is already running you will get this error message:

   The requested service has already been started.
   More help is available by typing NET HELPMSG 2182

If you need to change the properties of a service (e.g. change the Startup Type to Automatic), you can use the sc command (also documented at ss64.com). You can also use sc to start and stop services.

My motivation for finding a way to change the Startup Type is that Windows Update requires that the Automatic Updates service not only be running, but that it’s Startup Type is set to Automatic. Thing is, I want to control when updates are done, and I don’t want the Automatic Updates service running the 99.99% of the time that I am not updating Windows.

So, I wrote a script that does this for the Automatic Updates service, starts the Background Intelligent Transfer Service, and then starts Windows Update. It looks like this:

    sc config wuauserv start= auto
    sc start wuauserv
    sc start BITS
    %SystemRoot%\system32\wupdmgr.exe

The first two lines set the Automatic Updates service (wuauserv) Startup Type to Automatic and then start the service. The third line starts the Background Intelligent Transfer Service (BITS). The final line starts Windows Update.

NOTE: In the sc config command, there must be a space after the = and there must not be a space before it.

I had another script that I ran after the Windows Update process is complete, which sometimes means after a reboot. This script looks like this:

    sc stop BITS
    sc stop wuauserv
    sc config wuauserv start= demand

The first two lines stop the two services. The final line sets the Startup Type for Automatic Updates back to Manual.

By the way, unless you want to search through the Registry to figure out the “service_name” of a service, there is an sc command for getting that name given the “Name” shown in the Services window. For example:

    C:> sc GetKeyName "Automatic Updates"
   [SC] GetServiceKeyName SUCCESS
   Name = wuauserv

How to grant (non-admin) users rights to manage services

I wanted to create a script that Limited Users could use to start and stop the services necessary to support remote access (VPN) to our corporate intranet. The above item solved the script part, but Limited Users don't have permission to start/stop windows services.

After much googling, I finally came across this thread in the microsoft.public.windows.server.general group, which led me to search for information on something called subinacl.exe. This led me to Knowledge Base Article 288129. After a little more searching, I made it to the download page for subinacl.exe.

To enable the account SomeUser to start and stop the CVPND service, do:

   subinacl /service CVPND /grant=SomeUser=STOP

This also gives SomeUser status query and pause/resume rights on the service. NOTE: If the account name has spaces in it, be sure to wrap it in double quotes in the above command.

Now, SomeUser can use my script to start/stop the CVPND service, without granting SomeUser computer administrator status!

< Windows Registry Tweaks | Working With Windows | Fixing the MBR >