Microsoft Windows 200X Services

Here you see my progress toward making a list of Microsoft Windows 200X services presented as an XML data island. Please excuse the Javascript errors while I work on this.

See what DLLs are used by each process on your computer

Windows Services Probe from Converse Software detects whether Windows services are running according to its profile and issues instant alerts for intervention or launches pre-defined automated recovery and restart procedures.

Creating System Monitoring Components with VB and C#

Topics this page:

Related Topics:

Site Map  
About this site  

API Monitor displays Windows API calls made by User-Mode applications (not drivers or NT services).

Windows 200X System Services

In the list of services below, the value
“N” under the first column indicates a Native (default) service that comes with Microsoft's operating system.
“S” indicates a Server service.
“A” indicates a Microsoft Add-on application such as SMS.
“U” indicates a third-party Utility application such as Winzip.

The Service Display Name column lists the name of the service. This field is defined in the Display Name value in registry key

HKLM/Services/

Associated in the same registry are the Description and Image Name.

The Image Name column lists the executable file name defined at the end of the registry's Image Path value, which is usually

%windir%/System32/...

The Image Name is also displayed under the Task Manager's Processes tab

Values in this column can be used in batch run script files to manage that service. For example, to shut down the IIS5 World Wide Web service:

net stop w3svc.exe

More on shutting down services

Group policies for each service can be controlled by values in the Startup, Permission, Audit column for each service used by the Service Control Manager.

The Svc column lists the service name used in the Services file -- within %WinDir%\system32\drivers\etc -- which assigns ports to services.

List of System Services

F	Service Display Name	Service Name	Image Name	Description	Start	Svc	Ports
SN	Alerter	Alerter	svchost.exe -k LocalService	Notifies selected users and computers of administrative alerts.	S A
N	Application Layer Gateway Service	ALG	Alg.exe
SN	Application Management	AppMgmt	Svchost.exe	Provides software installation services such as Assign, Publish, and Remove.	S M
	Application Updates	Wuauserv	Svchost.exe
	Background Intelligent Transfer Service	BITS	Svchost.exe
SN	ClipBook	ClipSrv	clipsrv.exe	Supports ClipBook Viewer, which allows pages to be seen by remote ClipBooks.	- M
SN	COM+ Event System	EventSystem	Svchost.exe	Provides automatic distribution of events to subscribing COM components.	S M
N	COM+ System Application	COMSysApp	Dllhost.exe
SN	Computer Browser	Browser	Svchost.exe	Maintains an up-to-date list of computers on your network and supplies the list to programs that request it.	S A
	Cryptographic Services	CryptSvc	Svchost.exe
SN	DHCP Client	Dhcp		Manages network configuration by registering and updating IP addresses and DNS names.	S A
SN	Distributed File System	?	Dfssvcs.exe	Manages logical volumes distributed across a local or wide area network.	S A
SN	Distributed Link Tracking Client	TrkWks	Services.exe	Sends notifications of files moving between NTFS volumes in a network domain.	S A
SN	Distributed Link Tracking Server		services.exe	Stores information so that files moved between volumes can be tracked for each volume in the domain.	- M
SN	Distributed Transaction Coordinator		msdtc.exe	Coordinates transactions that are distributed across two or more databases, message queues, file systems, or other transaction protected resource managers.	S A
SN	DNS Client			Resolves and caches Domain Name System (DNS) names.	S A
	Event Reporting	ERSvc	Svchost.exe
SN	Event Log	Eventlog		Logs event messages issued by programs and Windows. Event Log reports contain information that can be useful in diagnosing problems. Reports are viewed in Event Viewer.	S A
N	Fast User Switching Compatibility	FastUserSwitchingCompatibility	Svchost.exe
SN	Fax Service	Fax	Fxssvc.exe	Helps you send and receive faxes
S	File Replication	-	Ntfrs.exe	Maintains file synchronization of file directory contents among multiple servers.	- M
N	FTP Publishing Service		Ftp.exe	(Installed with IIS)
	Help and Support	Helpsvc	Svchost.exe
	HID Input Service	HidServ	Svchost.exe
	IMAP CD-Burning COM Service	ImapService	Imapi.exe
N	IIS Admin Service	piiserviceO		Network connector to sync Palms to the desktop.
N	IIS Admin Service			(Installed with IIS)
SN	Indexing Service	cisvc	cisvc.exe	Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language.	- M
SN	Internet Connection Firewall /Sharing	SharedAccess	Svchost.exe	Provides network address translation, addressing, and name resolution services for all computers on your home network through a dial-up connection.	- M
S	Intersite Messaging	-	Ismserv.exe	Allows sending and receiving messages between Windows Advanced Server sites.	- D
SN	IPSEC Policy Agent	PolicyAgent	Lsass.exe	Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver.	- D
S	Kerberos Key Distribution Center	-	Lsass.exe	Generates session keys and grants service tickets for mutual client/server authentication.	- D
S	License Logging Service	-	Llssrv.exe	-	S A
N	Logical Disk Manager	dmserver	Services.exe	Logical Disk Manager Watchdog Service.	S A
SN	Logical Disk Manager Administrative Service	dmadmin	Dmadmin.exe	Administrative service for disk management requests.	- M
SN	Messenger	Messenger	Svchost.exe	Sends and receives messages transmitted by administrators or by the Alerter service.	S A
	MS Software Shadow Copy Provider	SwPrv	Dllhost.exe
SN	Net Logon	NetLogon	Lsass.exe	Supports pass-through authentication of account logon events for computers in a domain.	S A
SN	NetMeeting Remote Desktop Sharing	mnmsrvc	mnmsrvc.exe	Allows authorized people to remotely access your Windows desktop using NetMeeting.	- M
SN	Network Connections	Netman	Svchost.exe -k netsvcs	Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.	S M
SN	Network DDE	NetDDE	netdde.exe	Provides network transport and security for dynamic data exchange (DDE).	- M
SN	Network DDE DSDM	NetDDEdsdm	netdde.exe	Manages shared dynamic data exchange and is used by Network DDE	- M
	Network Location Awareness	Nla	Svchost.exe
SN	NT LM Security Support Provider	NtLmSsp	Lsass.exe	Provides security to remote procedure call (RPC) programs that use transports other than named pipes.	- M
SN	Performance Logs and Alerts	SysmonLog	smlogsvc.exe	Configures performance logs and alerts.	- M
SN	Plug and Play	PlugPlay	services.exe	Manages device installation and configuration and notifies programs of device changes.	S A
	Portable Media Serial Number	WmdmPmSp	Svchost.exe
N	PPPoE Service
SN	Print Spooler	Spooler	spoolsv.exe	Loads files to memory for later printing.	S A
SN	Protected Storage	ProtectedStorage	Services.exe	Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users.	S A
SN	QoS RSVP	RSVP	rsvp.exe	Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets.	- M
SN	Remote Access Auto Connection Manager	RasAuto	Svchost.exe	Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.	- M
SN	Remote Access Connection Manager	RasMan	Svchost.exe	Creates a network connection.	S M
N	Remote Desktop Help Session Manager	RDSessMgr	sessmgr.exe	Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box.
SN	Remote Procedure Call (RPC)	RpcSs	Svchost.exe	Provides the endpoint mapper and other miscellaneous RPC services.	S A
SN	Remote Procedure Call (RPC) Locator	RpcLocator	locator.exe	Manages the RPC name service database.	- M
SN	Remote Registry Service	RemoteRegistry	Svchost.exe	Allows remote registry manipulation.	S A
SN	Removable Storage	NtmsSvc	Svchost.exe	Manages removable media, drives, and libraries.	S A
SN	Routing and Remote Access	RemoteAccess	Svchost.exe	Offers routing services to businesses in local area and wide area network environments.	S A
SN	RunAs Service			Enables starting processes under alternate credentials.	S A
SN	Security Accounts Manager	SamSs	lsass.exe	Stores security information for local user accounts.	S A
N	Security Logon	seclogon	Svchost.exe
SN	Server	lanmanserver	Svchost.exe	Provides RPC support and file, print, and named pipe sharing.	S A
N	Shell Hardware Detection	ShellHWDetection	Svchost.exe
SN	Smart Card	SCardSvr	SCardSvr.exe	Manages and controls access to a smart card inserted into a smart card reader attached to the computer.	- M
SN	Smart Card Helper	SCardDrv	Scardsvr.exe	Provides support for legacy smart card readers attached to the computer.	- M
S	SOE Admin Service	-	sysexec.exe	-	S A
S	SOE Send Service	-	SndServ.exe	-	S A
N	SMTP Service			(Installed with IIS)
N	SSDP Discovery Servicer	SSDPSRV	Svchost.exe
SN	System Event Notification	SENS	Svchost.exe	Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events.	S A
N	System Restore Service	Srservice	Svchost.exe
SN	Task Scheduler	Schedule	MSTask.exe	Enables a program to run at a designated time.	S A
SN	TCP/IP NetBIOS Helper Service	LmHosts	Services.exe	Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution.	S A
SN	Telephony	TapiSrv	Svchost.exe -k tapisrv	Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service.	S M
SN	Telnet	TlntSvr	tlntsvr.exe	Allows a remote user to log on to the system and run console programs using the command line.	- M
S	Terminal Services	Termserv	Ternserv.exe	Provides a multisession environment that allows client devices to access a virtual Windows 2000 Professional desktop session and Windows-based programs running on the server.	- D
N	Themes	Themes	Svchost.exe
N	TrueVector Basic Logging Client			Writes alert text to a log file.
N	TrueVector Internet Monitor			Monitors internet traffic and generates alerts for disallowed access.
SN	Uninterruptible Power Supply		ups.exe	Manages an uninterruptible power supply (UPS) connected to the computer.	- M
N	Universal Plug and Play Device Host	upnphost	Svchost.exe
N	Upload Manager	uploadmgr	Svchost.exe
SN	Utility Manager		UtilMan.exe	Starts and configures accessibility tools from one window.	- M
N	Volume Shadow Copy	VSS	Vssvc.exe
N	WebClient	WebClient	Svchost.exe
N	Windows Audio	AudioSrv	Svchost.exe
N	Windows Image Acquisition (IWIA)	Stisvc	Svchost.exe
SN	Windows Installer	MSIServer	msiexec.exe	Installs, repairs and removes software according to instructions contained in .MSI files.	- M
SN	Windows Management Instrumentation	winmgmt	Winmgmt.exe	Provides system management information.	S A
SN	Windows Management Instrumentation Driver Extensions	Wmi	Services.exe	Provides systems management information to and from drivers.	S M
SN	Windows Time	W32Time	Svchost.exe	Sets the computer clock.	S A
N	Windows Zero Configuration	W2CSVC	Svchost.exe
	WMI Performance Adapter	WmiApSrv	Wmiapsrv.exe
SN	Workstation	lanmanworkstation	Svchost.exe	Provides network connections and communications.	S A
N	World Wild Web Publishing Service		w3svc.exe	(Installed with IIS)
A	AutoUpdate for WindowsME		wuauclt.exe	-
-	Microsoft Office XP Alternative User Input monitor		ctfmon.exe	-

F	Service Display Name	Service Name	Image Name	Description	Start
-	Epson Printer Status Monitor		E_S10IC2.exe	-
-	Epson Printer Bidirectional Service		eEBSvc.exe	-
-	Epson ECP/EPP Printer Detection		SAgent2.exe	-
-	Symantec Event Manager Service		CCEVTMGR.exe	-
-	Symantec Norton AntiVirus Common CLient App		ccApp.exe	-
-	Symantec Norton AntiVirus Auto-Protect		NAVAPSVC.exe	-
-	Creative sound plug-in manager		CTHELPER.exe	-

Tools for Managing Services

To list the state of services on your machine using WMI/WBEM root class, run this from the Resource Kit:
Cscript “service.vbs”

NAME                STATE     DISPLAY NAME   
Alerter             Stopped   Alerter        
ALG                 Running   Application Layer Gateway Service 
AppMgmt             Stopped   Application Management 
...

To get this same list from within the Recovery Console, run:
listsvc

To create / delete, start / stop, or pause / continue services, use the Service Controller from the Resource Kit CD. This queries all:
sc query state= all

Make Any Application Into a Service

Download from Microsoft their Windows Server 2003 Resource Kit Tools (rktools.exe) which contains InstSrv.exe (Install Service) and SrvAny in default folder C:\Program Files\Windows Resource Kits\Tools (or C:\PROGRA~1\WI8DE7~1\Tools\).

Open a command prompt and run

InstSrv, which yields:

Installs and removes system services from NT

INSTSRV  ( | REMOVE)
  [-a ] [-p ]

  Install service example:

    INSTSRV MyService C:\MyDir\DiskService.Exe
    -OR-
    INSTSRV MyService C:\mailsrv\mailsrv.exe -a MYDOMAIN\joebob -p foo

  Remove service example:

    INSTSRV MyService REMOVE

Examples of products using this include:

INSTSRV FaxMailSrv C:\FAXMAILN\SRVANY.EXE

InstSrv iOpusService c:\iOpus\srvany.exe

After running one of the above, run REGEDT32.EXE and look for the service just added in the Windows Registry key:

\HKLM\SYSTEM\CurrentControlSet\Services\OpusService

Notice that the image path is the location of srvany.exe.

Add a key "Parameters" with a name of "Application" with a data value of your app's file path.

Articles about this:

http://www.winnetmag.com/Windows/Article/ArticleID/8148/8148.html [subscription]

http://www.winnetmag.com/Article/ArticleID/7959/7959.html

Shutting Down Services

Norton AntiVirus Corporate Edition services keeps itself from being stopped or removed —even with administrator rights — if that option has been disabled via the Symantec System Center (SSC).

So you need to use the SSC to allow/deny users the ability to stop/start the service. In the SSC, highlight the specific system then click > All Tasks > Norton AntiVirus > Client Administrator Only Options > Security > and check/uncheck the “Lock the ability of users to unload Norton AntiVirus Services”.

To change the “Ask for password to allow uninstall of Norton AntiVirus client”, SSC requests the password used to set up the specific group.

RPC Ports

To lock down ports used for RPC communications, run Regedit.

Key: HKLM\SOFTWARE\Microsoft\RPC\Internet
Named Value: Ports
Type: REG_MULTI_SZ
Setting: Range of port. This can be multiple lines.
64975-64995

Named Value: PortsInternetAvailable
Type: REG_SZ
Setting: Y

Named Value: UseInternetPorts
Type: REG_SZ
Setting: Y

Turbo Tax CDAC11BA.EXE

Disabling the C_DILLA service associated with this file has no effect because Turbo Tax recreates the file. So you need "Tiny Personal Firewall 3.0" to deny the file CDAC11BA.EXE of any resource access rights and disallowing Turbot Tax to install/start any services.