Removing Unnecessary Services
29 Nov 2004 @ 07:46AM

Updated: 29 Jan 2010 @ 11:11AM
This following tweak is a bit messy. Unlike all the previous tweaks, precisely what to enable/disable isn't quite as clear-cut. But before we get into all that, allow me to explain what this tweak is about.

Every time WinXP boots, it loads a large number of 'services'. These include all kinds of things, such as UPS support, Netmeeting Remote desktop sharing, QoS packet scheduler (we'll get into that in the networking section), telnet, themes, and a whole lot of very obscure stuff. As you can imagine, all these services eat up RAM and cpu, probably one of the absolute best tweaks you can do revolves around removing unnecessary services.

However, now comes the hard part. What services are unnecessary? Well, some are very necessary, so you can't just go around arbitrarily shutting off services. I will do my utmost to list as many optional services as I can. I suppose I should tell you how to turn the services off in the first place.
  1. Go to the administrative tools.
  2. Open the services applet.

The Services Window

That wasn't that hard. You should have a LONG list of services in here. These are all the happy puppies that we're going to kill.

What you'll need to do is right-click on the appropriate service, go to properties, and then alter the "startup type" to either automatic (starts at boot), manual (starts if windows needs it) or disabled (never starts). A rule to use here is, if you definetely don't need it, disable it. If you don't know for sure, but think you don't need it, set it to manual. Also...don't do all the services at once. Tweak a couple, then reboot and make sure your computer still functions fully. If it doesn't, go turn the services back on.

If you've ever overclocked a processor or a video card, then you're probably familiar with the process. Only small tweaks at a time, then test, then some more tweaking. That is the only safe way to overclock (or disable system services). You have been warned.

Following is a list of services and their descriptions. If you don't need the service, feel free to kill it. The following table lists the service, its Windows description, and my description. In most cases, there will be a link (or four) on the right which should lead you to additional information. All the links are to Microsoft documents, the proverbial "horse's mouth". Some of the links are focused primarily on a different operating system, such as Windows 2000, but the information still holds true for Windows XP.

For your edification, there are four types of links there. The first start with Q and end in a number. These are Microsoft knowledge base articles avaiable from The Q and number are the knowledge base article ids, even though Microsoft is apparently moving away from that. The second say Technet, and are available from Microsoft TechNet. Technet is an excellent resource focusing primarily on the IT community. The third are MSDN, and are linked to articles from the Microsoft Developer's Network. MSDN is a great resources for software developers and contains a great deal of very in-depth information. The last link (all one of them) links to the Microsoft Component Object Model page.
Comments (0)

Windows XP Services Tweaks
ServiceWindows DescriptionClankiller DescriptionReferences
AlerterNotifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them.This service allows administrative alert to be broadcast to specific users or computer. This is only useful if you're on a LAN with mission-critical applications/servers that you want to monitor. This is useless to the vast majority of usersQ310490
Application Layer Gateway ServiceProvides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Internet Connection FirewallThis actually provides services for the XP firewall. Only enable this if you're using the XP firewall. Personally, I'd suggest you use another firewall instead.Q320855
Application ManagementProvides software installation services such as Assign, Publish, and RemoveThis service assists with software installation. This should be set to manual. If you're having problems uninstalling/modifying a program's installation, reenable this service.
Background Intelligent Transfer ServiceEnables the download and installation of critical Windows updates. If the service is disabled, the operating system can be manually updated at the Windows Update Web site.What this is used for is to allow you to transfer data from WindowsUpdate and other services using spare bandwidth ... and to continue it even after a reboot (if the prior transfer wasn't complete). This is pointless, so disable it.Q314862
ClipBookEnables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers.This services allows copying and pasting of information from Clipbook Viewer across computers on a network. Since this is rarely if ever needed, disable it.
COM+ System ApplicationManages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly.This allows COM+ applications to function. However, there are decidely few of these, and chances are you don't need it. Check "C:Program FilesComPlus Applications" to see if you have any apps. If not, disable it.COM
Computer BrowserMaintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained.Maintains an up-to-date list of computers on your network and supplies the list to programs that request it. This is meant primarily for networks to resolve NetBIOS names, so if you're not on one, disable. If you are on a network ... well ... everything networking related will still work with this turned off. Honestly, I see no reason to run it at all, unless you have a really large network. In that case, leave it enabled on one computer, and disable it on the rest.Q188001
Distributed Link Tracking ClientMaintains links between NTFS files within a computer or across computers in a network domain.Sends notification of files moving between NTFS volumes in a network domain. If you're not in a domain, disable this. If you are, but don't run NTFS, disable this.Q312403
Distributed Transaction CoordinatorCoordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur.Very long way of saying multiple connections to different places. Basically this service is supposed to coordinate movement of information between a large number of databases, message queues and file systems. This won't happen in a home user environment, so disable it.Technet
Error Reporting ServiceAllows error reporting for services and applictions running in non-standard environments.This service will report error messages and such back to Microsoft. Personally, I don't want them knowing any more about me than they already do. I would definetely recommend disabling this.Q310414
Fast User Switching CompatibilityProvides management for applications that require assistance in a multiple user environment. Unless you use fast user switching, this service is pointless. Most people run XP with only one user, for instance. Disable it.Q294855
Help and SupportEnables Help and Support Center to run on this computer. This allows you to use the Help and Support center, which in turn gives access to MS and possibly other support resources. Since I (and probably you) never use this, it's pointless. Disable.Q283372
IMAPI CD-Burning COM ServiceManages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs.This service allows the XP burn-cd feature. By setting this to manual, this service will automatically load and unload itself when needed. If you still have problems burning CD's, enable it. No burner at all, disable it.Q324129
Indexing ServiceIndexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.This service allows the computer to index the contents of drives for speedier searches. However, it's an incredible resource hog and tends to start and very inopportune times. To get rid of this, go to the control panel, add/remove programs, the windows setup tab, and remove it from there.TechNet
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network.This is basically for if you're using ICS to share out your connection to multiple computers. Honestly, buying an actual router is a better idea. Disable this unless you use ICS and/or ICF.Q320855
IPSEC ServicesManages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.What this does is enable IP security features. 99% of us don't use this (we just get firewalls) so disable it.TechNet
Logical Disk Manager Administrative ServiceDetects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date.Administrative service for disk management requests. This is used to run the Disk Management MMC console, which is under administrative tools. If you use this, leave it manual. Otherwise, turn it off.Q307309
MS Software Shadow Copy ProviderManages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed.This is a service for MS Backup. If you don't use it (who does?) then disable it.MSDN
Net LogonSupports pass-through authentication of account logon events for computers in a domain.This service is used to log in to a domain. If you don't have a domain, disable it. If you don't know what a domain is, disable it.Technet
NetMeeting Remote Desktop SharingEnables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable.This allows remote desktop sharing for netmeeting (duh). I don't even use netmeeting, and would definetely not share out my desktop. Disable it.Q233175
Network DDEProvides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable.Provides network transport and security for dynamic data exchange. In simple terms, besides clipbook I have no idea what uses this. Disable it unless you use some sort of network DDE programs (unlikely).MSDN
Network DDE DSDMManages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable.Manages shared dynamic data exchange and is used by network DDE. If you disabled Network DDE, disable this.MSDN
Network Location Awareness (NLA)Collects and stores network configuration and location information, and notifies applications when this information changes.This is a service that allows Windows to determine which logical network it is communicating with. More specifically, if connected to multiple networks (ie, through the use of multiple network cards). Windows uses this to figure out which is which. The primary use for this is Internet Connection Sharing. If you don't use ICS (I highly recommend you not use it), and/or you only have one network card, then get rid of this service.
NT LM Security Support ProviderProvides security to remote procedure call (RPC) programs that use transports other than named pipes.This allows secure RPC communications, specifically across transports "other than named pipes". The typical uses seem to be IIS servers, SQL, Exchange, and various other servers. Useless to most of us.MSDN
Performance Logs and AlertsCollects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected.Configures performance logs and alerts. This service gathers performance data and logs it. Pretty useless unless you're a megadork and enjoy this sort of thing, or if you want an alert to let you know if you're running low on disk space or something.Q310490
Portable Media Serial NumberRetrieves the serial number of any portable music player connected to your computerWhy? Who knows. Disable it, and if any of your music devices cease to function, reenable it. There is a suprising lack of information about this service anywhere on Microsoft's support pages.
Print SpoolerLoads files to memory for later printing.If you have a printer attached to your computer, keep this on. If not, disable it.TechNet
Protected StorageProvides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.This basically allows autocomplete to work. By disabling this service, you won't be able to store passwords, either locally, for shares, or for websites, as well as disabling autocomplete. Personally, I don't think that's a bad thing. Autocomplete is a major security problem.MSDN
QoS RSVPProvides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.This provides traffic control for apps that support QOS. This is really pointless, just disable it. In case you're curious, it stands for Quality of Service (QoS) Resource Reservation Protocol.Q227261
Remote Desktop Help Session ManagerManages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.This manages and controls remote assistance, which is a new Microsoft toy to allow their techs to directly mess with your computer. I fix everything myself (or reinstall the O/S if it comes to that), so this is completely and totally useless. It's also a potential security hole.Q300692
Remote Procedure Call (RPC) LocatorManages the RPC name service database.The service appears to compile a database of RPC applications and bindings for use by the the O/S and programs. This service should be either disabled or set to manual. Do NOT set it to automatic, as this can cause issues. I would suggest disabling it and seeing if anything breaks. If it does, set it to manual. NOTE: I tried installing a USB printer, and got RPC errors until I reenabled this service AND rebooted. Even manually starting the service didn't work, I actually had to restart the machine. You have been warned.Q103738
Remote Registry ServiceEnables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer Allows remote registry manipulation. Totally and completely useless, and a potential security hole to boot. Disable it.Q141460
Removable StorageNo Description.Manages removable media, drives, and libraries. This is meant for removeable hard drives and tape backups. Disable it, but if your CD-ROM starts acting funny, set it back to automatic. Disabling this doesn't appear to affect digital cameras which are read by XP as removable storage.MSDN
Routing and Remote AccessOffers routing services to businesses in local area and wide area network environments.Totally useless on home machines. This service is basically used for setting up a RAS server, though it can also be used for VPN, ip filtering and routing. Honestly, except maybe for the RAS, most of these services are better handled by a router.MSDN
Secondary LogonEnables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable.This allows the user to start processes (programs) under a different logon. For instance, you could be logged in as a user or poweruser, but still execute administrator functions without having to log out and back in again. Personally, all I can see here is a possible security hole. Disable it.Technet
ServerSupports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable.This allows the sharing of files and printers to other computers. If you have a home network and share stuff out, leave this enabled. Note that this won't affect your ability to connect to another computer's shares.TechNet
Smart CardManages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards.This one is pretty self-explanatory. If you don't have a smart card reader, disable it.MSDN
Smart Card HelperEnables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy readers. Once more, totally unnecessary unless you have a smart card reader (and a legacy one, in this case).MSDN
SSDP Discovery ServiceEnables discovery of UPnP devices on your home network.This basically boils down to devices that are installed on a network as a device on the computer, such as some scanners, routers and printers. If you don't have any of these (probably not) then disable it. Note, this service has NOTHING to do with regular PnP, or scanners/printers hooked up via the parallel port, serial port or USB/firewire ports.Q323713
System Restore ServicePerforms system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->PropertiesThis is used to automatically make "restore points' so that you can roll back your computer a day, a week, etc. I would never use this functionality, but if you do, then leave it automatic. If you're like me, kill it. Note that this has been credited as a major resource hog, though Microsoft would say otherwise.TechNet
Task SchedulerEnables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times. Enables a program to run at a designated time. How many of us use this? Not me. Disable it.Q308671
TCP/IP NetBIOS HelperEnables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.Basically, unless you have a WINS or NETBIOS server on your network, disable this service.MSDN
TelnetEnables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable.Telnet allows another computer to remotely 'telnet' into your computer and do things to it. Obviously this is a security hole, and not of any real use to the vast majority of us. Disable it.Technet
ThemesProvides user experience theme management.This service controls the pretty GUI that is XP. By disabling this service, you disable all the prettiness (the O/S still functions fine), and, in the process, free up RAM. This is personal taste. I like that phrase, though... "user experience theme management"TechNet
Uninterruptible Power SupplyManages an uninterruptible power supply (UPS) connected to the computer.This allows XP to control any UPS you may have attached to the computer. I have a UPS, but the software that came with it does everything I need it to do ... no need for this service at all.
Universal Plug and Play Device HostProvides support to host Universal Plug and Play devices.Like the SSDP discovery service, this is for UPnP devices, which you probably have none of. Disable it unless you happen to have a UPnP device.Q323713
Volume Shadow CopyManages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail.Another service for MS Backup. Disable it unless you use that program.MSDN
Windows Image Acquisition (WIA)Provides image acquisition services for scanners and cameras.Disable this service, but if your scanner or camera fail to work, reenable it.Q293356
Windows InstallerInstalls, repairs and removes software according to instructions contained in .MSI files.This is used by some programs to install themselves (program with msi files). I would set this to manual once you've finished installing all your basic applications. If you have any issues afterward, set it back to automatic.MSDN
Windows TimeMaintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. This allows windows to grab the time from an internet server and apparently synchronize time across a network. Personally, I set the time on my computer myself, and having a perfectly synchronized network is really a nonissue. Disable this service to save some RAM and clock cycles.Q307897
Wireless Zero ConfigurationProvides automatic configuration for 802.11 adapters.This service allows wireless networking devices to work without you having to do any manual configuration. If you don't use a wireless network, disable it.Q313242
WMI Performance AdapterProvides performance library information from WMI HiPerf providers.Windows Management Instrumentation Performance Adapter. This provides an interface for 3rd party hardware and software, specifically for accessing and sharing management information in an enterprise network. I have no idea what (if any) software uses this service, especially in a home environment, so I would disable it.technet
Comments (0)
Congratulations...that concludes the services tweak portion. Of all the tweaks available in this tweak guide, tweaking out the services will probably take the longest, but also result in the biggest change in performance.

Below follows a list of resources and additional information. The Microsoft links are things related to services which I found interesting, but didn't really have a place in the table above. The "additional information" links are to pages not affiliated with Microsoft which offer either services tweaks similar to mine, or more in-depth information.

How to disable a service that prevents Windows from startingThis article explains how to use the recovery console to get into windows and then disable services manually (in DOS). Quite an interesting read.
How to do advanced clean-boot troubleshooting.Among other things, it has a list of core XP services. This is only a partial list, but is still quite lengthy.
Default Services Settings for Windows XPIn case you break something, you can always refer here.
Top Security BlundersA listing of the top security messups in networked environments. Not exactly services related, but interesting none-the-less.
Additional information:
InternetTrashXP tweak guide. A pretty thorough listing of system services
TechspotXP services tweak guide
SubDiv.netServices and XP tweak guide.
David Lechnyr'sServices guide including registry keys. Very nice.
ActiveWinXP tweak and services guide.
XPMania XP tweaks. Click on "services" in their menu... since they're framed, I won't do them the disservice of linking directly.
OverClockersClubXP services tweak guide.
Comments (0)