Services that are automatically started in Windows Server 2003, in Windows XP, and in Windows 2000 (919520)



The information in this article applies to:

  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server

INTRODUCTION

This article describes the services that are automatically started when you start a computer that is running one of the following operating systems:
  • Microsoft Windows Server 2003 with Service Pack 1 (SP1)
  • Microsoft Windows XP with Service Pack 2 (SP2)
  • Microsoft Windows 2000 with Service Pack 4 (SP4)

MORE INFORMATION

Windows Server 2003 with SP1

Application Experience Lookup Service

This service processes application compatibility lookup requests for applications when they are started.

Automatic Updates

This service enables the download and installation of automatic updates. The computer cannot use the Automatic Updates feature or the Windows Update Web site if this service is disabled. For security reasons, we recommend that this service is not stopped.

COM+ Event System

This service supports the System Event Notification Service (SENS) and provides automatic distribution of events to COM+ Event System subscribers. If the service is stopped, SENS closes and cannot provide logon and logoff notifications. If the COM+ Event System service is disabled, any services that explicitly depend on this service do not start.

Computer Browser

This service maintains an updated list of computers on the network and supplies this list to computers that are designated as browsers. If this service is stopped, this list is not updated or maintained. If the Computer Browser service is disabled, any services that explicitly depend on this service do not start. This service depends on the Workstation service and on the Server service.

Cryptographic Services

This service provides information to the following management services:
  • Catalog Database
    This service confirms the signatures of Windows files.
  • Protected Root
    This service adds and removes Trusted Root Certification Authority certificates from the computer.
  • Key
    This service helps enroll the computer for certificates. If this service is stopped, the other management services do not function correctly. If the Key service is disabled, any services that explicitly depend on this service do not start.

DCOM Server Process Launcher

This service provides start functionality for DCOM services.

DHCP Client

This service manages network configuration by registering and updating IP addresses and Domain Name System (DNS) names. If this service is stopped, the computer cannot automatically obtain an IP address.

Distributed Link Tracking Client

This service maintains links between two NTFS file system files on a computer or across computers in a network domain. This service depends on the Remote Procedure Call service to run. If the Distributed Link Tracking Client service is disabled, NTFS files cannot be accessed.

Distributed Transaction Coordinator

This service coordinates transactions that span multiple resource managers. For example, this service coordinates database transactions, message queue transactions, and file system transactions. If the Distributed Transaction Coordinator service is stopped, these transactions do not occur. If the Distributed Transaction Coordinator service is disabled, any services that explicitly depend on the service do not start.

DNS Client

This service resolves and caches DNS names for the computer. If this service is stopped, the computer cannot resolve DNS names and cannot locate Active Directory directory service domain controllers. If the DNS Client service is disabled, any services that explicitly depend on this service do not start. Additionally, the computer cannot resolve DNS names.

Error Reporting

This service enables error reporting services and applications that run in non-standard environments.

Event Log

This service enables event log messages that are issued by Windows-based programs and components and that are viewed in Event Viewer. This service cannot be stopped.

Help and Support

This service enables the Help and Support Center to run on the computer. If this service is stopped, the Help and Support Center is not available. If the Help and Support service is disabled, any services that explicitly depend on this service do not start.

IPSEC Services

This service manages IPsec policy and starts the ISAKMP/Oakley (IKE) driver and the IPsec driver.

Logical Disk Manager

This service detects and monitors new hard disk drives and sends disk volume information to the Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If the Logical Disk Manager service is disabled, any services that depend on this service do not start. The Logical Disk Manager service depends on the Plug and Play service and on the Remote Procedure Call service.

Network Connections

This service manages objects in the Network and Dial-Up Connections folder for local area network connections and for remote connections.

Network Location Awareness (NLA)

This service collects and stores network configuration and location information. This service notifies applications when this information changes.

Plug and Play

This service enables a computer to recognize and to adapt to hardware changes with little or no user input. We recommend that you do not stop this service because the computer may become unstable.

Print Spooler

This service loads files to memory for later printing. You cannot print if this service is not running.

Protected Storage

This service provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, by processes, or by users. For security reasons, we recommend that this service is not stopped.

Remote Procedure Call (RPC)

This service provides the RPC Endpoint Mapper and other miscellaneous Remote Procedure Call services. For security reasons, we recommend that this service is not stopped.

Remote Registry

This service enables remote users to modify registry settings on the computer. If this service is stopped, the registry can be modified only by users on this computer. If the Remote Registry service is disabled, any services that explicitly depend on this service do not start. The remote registry administration features are not available if this service is stopped.

Secondary Logon

This service lets you start processes by using alternative credentials. If this service is stopped, you cannot start processes by using alternative credentials. If the Secondary Logon service is disabled, any services that explicitly depend on this service do not start.

Security Accounts Manager

This service stores security information for local user accounts. For security reasons, we recommend that this service is not stopped.

Server

This service supports file sharing, print sharing, and named pipe sharing over the network for the computer. If the Server service is stopped, these functions are not available. If the Server service is disabled, any services that explicitly depend on this service do not start.

Shell Hardware detection

This service provides notifications for AutoPlay hardware events.

System Event Notification

This service tracks system events, such as Windows logon, network, and power events. This service notifies COM+ Event System subscribers of these events.

Task Scheduler

This service enables a user to configure and to schedule automated tasks on the computer. If this service is stopped, these tasks do not run at their scheduled times. If the Task Scheduler service is disabled, any services that explicitly depend on this service do not start.

TCP/IP NetBIOS Helper

This service enables support for the NetBIOS over TCP/IP (NetBT) service and for the NetBIOS name resolution. These features do not work if this service is stopped.

Terminal Services

This service lets multiple users connect interactively to a computer. This service sends the computer display and applications to remote computers. The following features depend on this service:
  • Remote Desktop
  • Fast User Switching
  • Remote Assistance
  • Terminal Server

Windows Installer

This service adds, modifies, and removes applications that are provided as a Microsoft Windows Installer package. If the Windows Installer service is disabled, any services that explicitly depend on this service do not start.

Windows Management Instrumentation

This service provides a common interface and object model to access management information about operating system, devices, applications, and services. If this service is stopped, most Windows-based applications do not function correctly. If the Windows Management Instrumentation service is disabled, any services that explicitly depend on this service do not start.

Windows Time

This service maintains date and time synchronization for all clients and servers in the network. If this service is stopped, date and time synchronization is not available. If the Windows Time service is disabled, any services that explicitly depend on this service do not start.

Wireless Configuration

This service provides automatic configuration for 802.11 network adapters.

Workstation

This service creates and maintains client network connections to remote servers. If this service is stopped, client connections are not available. If the Workstation service is disabled, any services that explicitly depend on this service do not start.

Windows XP with SP2

Application Layer Gateway Service

This service provides support for third-party protocol plug-ins for Internet Connection Sharing and for the Windows Firewall.

Automatic Updates

This service enables the download and installation of automatic updates. The computer cannot use the Automatic Updates feature or the Windows Update Web site if this service is disabled. For security reasons, we recommend that this service is not stopped.

COM+ Event System

This service supports the System Event Notification Service (SENS) and provides automatic distribution of events to COM+ Event System subscribers. If the service is stopped, SENS closes and cannot provide logon and logoff notifications. If the COM+ Event System service is disabled, any services that explicitly depend on this service do not start.

Cryptographic Services

This service provides information to the following management services:
  • Catalog Database
    This service confirms the signatures of Windows files.
  • Protected Root
    This service adds and removes Trusted Root Certification Authority certificates from the computer.
  • Key
    This service helps enroll the computer for certificates. If this service is stopped, the other management services do not function correctly. If the Key service is disabled, any services that explicitly depend on this service do not start.

DCOM Server Process Launcher

This service provides start functionality for DCOM services.

DHCP Client

This service manages network configuration by registering and updating IP addresses and Domain Name System (DNS) names. If this service is stopped, the computer cannot automatically obtain an IP address.

Distributed Link Tracking Client

This service maintains links between two NTFS files on a computer or across computers in a network domain. This service depends on the Remote Procedure Call service to run. If this service is disabled, NTFS files cannot be accessed.

DNS Client

This service resolves and caches DNS names for the computer. If this service is stopped, the computer cannot resolve DNS names and cannot locate Active Directory directory service domain controllers. If the DNS Client service is disabled, any services that explicitly depend on the service do not start. Additionally, the computer cannot resolve DNS names.

Error Reporting Service

This service enables error reporting services and applications that are running in non-standard environments.

Event Log

This service enables event log messages that are issued by Windows-based programs and components and that are viewed in Event Viewer. This service cannot be stopped.

Fast User Switching Compatibility

This service provides management for applications that require assistance in a multiuser environment.

Help and Support

This service enables the Help and Support Center to run on the computer. If this service is stopped, the Help and Support Center is not available. If the Help and Support service is disabled, any services that explicitly depend on this service do not start.

IPSEC Services

This service manages IPsec policy and starts the IKE driver and the IPsec driver.

Logical Disk Manager

This service detects and monitors new hard disk drives and sends disk volume information to the Logical Disk Manager Administrative service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If the Logical Disk Manager service is disabled, any services that depend on this service do not start. The Logical Disk Manager service depends on the Plug and Play service and on the Remote Procedure Call service.

Network Connections

This service manages objects in the Network and Dial-Up Connections folder for local area network connections and for remote connections.

Network Location Awareness (NLA)

This service collects and stores network configuration and location information. This service notifies applications when this information changes.

Plug and Play

This service enables a computer to recognize and to adapt to hardware changes with little or no user input. We recommend that you do not stop this service because the computer may become unstable.

Print Spooler

This service loads files to memory for later printing. You cannot print if this service is not running.

Protected Storage

This service provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, by processes, or by users. For security reasons, we recommend that this service is not stopped.

Remote Access Connection Manager

This service creates a network connection for remote access. This service can be stopped if it is not required.

Remote Procedure Call (RPC)

This service provides the RPC Endpoint Mapper and other miscellaneous Remote Procedure Call services. For security reasons, we recommend that this service is not stopped.

Remote Registry

This service enables remote users to modify registry settings on the computer. If this service is stopped, the registry can be modified only by users on this computer. If the Remote Registry service is disabled, any services that explicitly depend on this service do not start. The remote registry administration features are not available if this service is stopped.

Secondary Logon

This service lets you start processes by using alternative credentials. If this service is stopped, you cannot start processes by using alternative credentials. If the Secondary Logon service is disabled, any services that explicitly depend on this service do not start.

Security Accounts Manager

This service stores security information for local user accounts. For security reasons, we recommend that this service is not stopped.

Security Center

This service monitors system security settings and configurations.

Server

This service supports file sharing, print sharing, and named pipe sharing over the network for the computer. If the Server service is stopped, these functions are not available. If the Server service is disabled, any services that explicitly depend on this service do not start.

Shell Hardware detection

This service provides notifications for AutoPlay hardware events.

SSDP Discovery Service

This service enables the discovery of UPnP devices on a local network.

System Event Notification

This service tracks system events, such as Windows logon events, network events, and power events. This service notifies COM+ Event System subscribers of these events.

System Restore Service

This service performs system restore functions. To stop this service, turn off the System Restore option.

Task Scheduler

This service enables a user to configure and to schedule automated tasks on the computer. If this service is stopped, these tasks do not run at their scheduled times. If the Task Scheduler service is disabled, any services that explicitly depend on this service do not start.

TCP/IP NetBIOS Helper

This service enables support for the NetBIOS over TCP/IP (NetBT) service and for the NetBIOS name resolution. These features do not work if this service is stopped.

Telephony

This service provides Telephony API (TAPI) support for programs that control telephony devices and IP-based voice connections on the local computer. This service lets the computer communicate with other computers that are also running the Telephony service.

Terminal Services

This service lets multiple users connect interactively to a computer. This service sends the computer display and applications to remote computers. The following features depend on this service:
  • Remote Desktop
  • Fast User Switching
  • Remote Assistance
  • Terminal Server

Themes

This service provides user experience theme management.

WebClient

This service enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions are not available. If the WebClient service is disabled, any services that explicitly depend on this service do not start.

Windows Audio

This service manages audio devices for Windows-based programs. If this service is stopped, audio devices and audio effects do not function correctly. If the Windows Audio service is disabled, any services that explicitly depend on this service do not start.

Windows Firewall/Internet Connection Sharing (ICS)

This service provides network address translation, addressing, name resolution, and intrusion prevention services for a home network or for a small office network.

Windows Management Instrumentation

This service provides a common interface and object model to access management information about operating system, devices, applications, and services. If this service is stopped, most Windows-based applications do not function correctly. If the Windows Management Instrumentation service is disabled, any services that explicitly depend on this service do not start.

Windows Time

This service maintains date and time synchronization for all clients and servers in the network. If this service is stopped, date and time synchronization is not available. If the Windows Time service is disabled, any services that explicitly depend on this service do not start.

Wireless Zero Configuration

This service provides automatic configuration for 802.11 network adapters.

Workstation

This service creates and maintains client network connections to remote servers. If this service is stopped, client connections are not available. If the Workstation service is disabled, any services that explicitly depend on this service do not start.

Windows 2000 with SP4

Automatic Updates

This service enables the download and installation of automatic updates. The computer cannot use the Automatic Updates feature or the Windows Update Web site if this service is disabled. For security reasons, we recommend that this service is not stopped.

COM+ Event System

This service supports the System Event Notification Service (SENS) and provides automatic distribution of events to COM+ Event System subscribers. If the service is stopped, SENS closes and cannot provide logon and logoff notifications. If the COM+ Event System service is disabled, any services that explicitly depend on this service do not start.

Computer Browser

This service maintains an updated list of computers on the network and supplies this list to computers that are designated as browsers. If this service is stopped, this list is not updated or maintained. If the Computer Browser service is disabled, any services that explicitly depend on this service do not start. This service depends on the Workstation service and on the Server service.

DHCP Client

This service manages network configuration by registering and updating IP addresses and Domain Name System (DNS) names. If this service is stopped, the computer cannot automatically obtain an IP address.

Distributed Link Tracking Client

This service maintains links between two NTFS file system files on a computer or across computers in a network domain. This service depends on the Remote Procedure Call service to run. If the Distributed Link Tracking Client service is disabled, NTFS files cannot be accessed.

Distributed Transaction Coordinator

This service coordinates transactions that span multiple resource managers. For example, this service coordinates database transactions, message queue transactions, and file system transactions. If the Distributed Transaction Coordinator service is stopped, these transactions do not occur. If the Distributed Transaction Coordinator service is disabled, any services that explicitly depend on the service do not start.

DNS Client

This service resolves and caches DNS names for the computer. If this service is stopped, the computer cannot resolve DNS names and cannot locate Active Directory directory service domain controllers. If the DNS Client service is disabled, any services that explicitly depend on the service do not start. Additionally, the computer cannot resolve DNS names.

Event Log

This service enables event log messages that are issued by Windows-based programs and components and that are viewed in Event Viewer. This service cannot be stopped.

Logical Disk Manager

This service detects and monitors new hard disk drives and sends disk volume information to the Logical Disk Manager Administrative service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If the Logical Disk Manager service is disabled, any services that depend on this service do not start. The Logical Disk Manager service depends on the Plug and Play service and on the Remote Procedure Call service.

Messenger

This service transmits net send messages and Alerter service messages between a client and a server. This service is not related to Windows Messenger. If this service is stopped, Alerter service messages are not transmitted. If the Messenger service is disabled, any services that depend on this service do not start.

Net Logon

This service supports pass-through authentication of account logon events for computers in a domain. The Net Logon service requires the Workstation service to run. Users cannot log on to network servers if this service is disabled.

Plug and Play

This service enables a computer to recognize and to adapt to hardware changes with little or no user input. The computer may become unstable if you stop or disable this service.

Print Spooler

This service loads files to memory for later printing. You cannot print if this service is not running.

Protected Storage

This service provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, by processes, or by users. For security reasons, we recommend that this service is not stopped.

Remote Access Connection Manager

This service creates a remote network connection. This service can be stopped if it is not required.

Remote Procedure Call (RPC)

This service provides the RPC Endpoint Mapper and other miscellaneous Remote Procedure Call services. For security reasons, we recommend that this service is not stopped.

Remote Registry

This service enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If the Remote Registry service is disabled, any services that explicitly depend on this service do not start. The remote registry administration features are not available if this service is stopped.

Removable Storage

This service manages removable media.

Secondary Logon

This service enables you to start processes by using alternative credentials. If this service is stopped, this kind of logon access is not available. If the Secondary Logon service is disabled, any services that explicitly depend on this service do not start.

Security Accounts Manager

This service stores security information for local user accounts. For security reasons, we recommend that this service is not stopped.

Server

This service supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions are not available. If this service is disabled, any services that explicitly depend on this service do not start.

System Event Notification

This service tracks system events such as Windows logon, network, and power events. This service notifies COM+ Event System subscribers of these events.

Task Scheduler

This service enables a user to configure and to schedule automated tasks on the computer. If this service is stopped, these tasks do not run at their scheduled times. If the Task Scheduler service is disabled, any services that explicitly depend on this service does not start.

TCP/IP NetBIOS Helper

This service enables support for the NetBIOS over TCP/IP (NetBT) service and for NetBIOS name resolution. These features do not work if this service is stopped.

Telephony

This service provides Telephony API (TAPI) support for programs that control telephony devices and IP-based voice connections on the local computer. This service lets the computer communicate with other computers that are also running the Telephony service.

Windows Management Instrumentation

This service provides a common interface and object model to access management information about operating system, devices, applications, and services. If this service is stopped, most Windows-based applications do not function correctly. If the Windows Management Instrumentation service is disabled, any services that explicitly depend on this service do not start.

Windows Management Instrumentation Driver Extensions

This service tracks system management information to and from drivers. We recommend that you do not stop this service.

Workstation

This service creates and maintains client network connections to remote servers. If this service is stopped, client connections are not available. If this service is disabled, any services that explicitly depend on the service do not start.

Modification Type:MajorLast Reviewed:6/7/2006
Keywords:kbwinservnetwork kbnetwork kbService kbtshoot kbinfo KB919520 kbAudITPRO kbAudEndUser