Services

Svchost Groups

• netsvcs
• LocalServiceAndNoImpersonation
• LocalSystemNetworkRestricted
• LocalServiceNetworkRestricted
• AxInstSVGroup
• LocalServiceNoNetwork
• bthsvcs
• NetworkService
• DcomLaunch
• defragsvc
• LocalService
• NetSvcs
• NetworkServiceAndNoImpersonation
• LocalServicePeerNet
• PeerDist
• NetworkServiceNetworkRestricted
• regsvc
• RPCSS
• rpcss
• SDRSVC
• imgsvc
• swprv
• WbioSvcGroup
• wcssvc
• WerSvcGroup
• secsvcs
•  

• 
  LocalSystemNetworkRestricted svchost group

  Windows Audio Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\audiosrv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder
  Full Description	Manages audio devices for the Windows Audio service. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start
  CSC Service DLL
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeTcbPrivilege SeImpersonatePrivilege SeIncreaseBasePriorityPrivilege
  Executable File Name	c:\windows\system32\cscsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CscService
  Full Description	The Offline Files service performs maintenance activities on the Offline Files cache, responds to user logon and logoff events, implements the internals of the public API, and dispatches interesting events to those interested in Offline Files activities a
  Wired AutoConfig Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeTcbPrivilege
  Executable File Name	c:\windows\system32\dot3svc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dot3svc
  Full Description	The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X authentication on Ethernet interfaces. If your current wired network deployment enforces 802.1X authentication, the DOT3SVC service should be configured to run for establishi
  HID Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\hidserv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidserv
  Full Description	Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service
  Windows HomeGroup
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege SeTcbPrivilege
  Executable File Name	c:\windows\system32\listsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HomeGroupListener
  Full Description	Makes local computer changes associated with configuration and maintenance of the homegroup-joined computer. If this service is stopped or disabled, your computer will not work properly in a homegroup and your homegroup might not work properly. It is reco
  PnP-X IP Bus Enumerator DLL
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege
  Executable File Name	c:\windows\system32\ipbusenum.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPBusEnum
  Full Description	The PnP-X bus enumerator service manages the virtual network bus. It discovers network connected devices using the SSDP/WS discovery protocols and gives them presence in PnP. If this service is stopped or disabled, presence of NCD devices will not be main
  Network Connections Manager
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeImpersonatePrivilege SeChangeNotifyPrivilege SeLoadDriverPrivilege
  Executable File Name	c:\windows\system32\netman.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
  Full Description	Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.
  Program Compatibility Assistant Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeDebugPrivilege
  Executable File Name	c:\windows\system32\pcasvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PcaSvc
  Full Description	This service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems. If this service is stopped, PCA will not function properly.
  Superfetch Service Host
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeTcbPrivilege SeProfileSingleProcessPrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeIncreaseBasePriorityPrivilege
  Executable File Name	c:\windows\system32\sysmain.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMain
  Full Description	Maintains and improves system performance over time.
  Microsoft Tablet PC Input Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeTcbPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege SeCreateGlobalPrivilege
  Executable File Name	c:\windows\system32\tabsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TabletInputService
  Full Description	Enables Tablet PC pen and ink functionality
  Distributed Link Tracking Client
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeRestorePrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\trkwks.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
  Full Description	Maintains links between NTFS files within a computer or across computers in a network.
  Remote Desktop Services Device Redirector Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeCreatePermanentPrivilege SeLoadDriverPrivilege SeDebugPrivilege
  Executable File Name	c:\windows\system32\umrdp.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmRdpService
  Full Description	Allows the redirection of Printers/Drives/Ports for RDP connections
  Desktop Window Manager
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeAssignPrimaryTokenPrivilege SeCreateGlobalPrivilege SeIncreaseQuotaPrivilege SeSecurityPrivilege SeTcbPrivilege
  Executable File Name	c:\windows\system32\dwm.exe
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxSms
  Full Description	Provides Desktop Window Manager startup and maintenance services
  Windows Diagnostic Infrastructure
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege SeTcbPrivilege SeDebugPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeProfileSingleProcessPrivilege SeSystemEnvironmentPrivilege
  Executable File Name	c:\windows\system32\wdi.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiSystemHost
  Full Description	The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context. If this service is stopped, any diagnostics that depend on it will no longer function.
  Windows WLAN AutoConfig Service DLL
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeTcbPrivilege SeDebugPrivilege
  Executable File Name	c:\windows\system32\wlansvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlansvc
  Full Description	The WLANSVC service provides the logic required to configure, discover, connect to, and disconnect from a wireless local area network (WLAN) as defined by IEEE 802.11 standards. It also contains the logic to turn your computer into a software access point
  Portable Device Enumerator
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wpdbusenum.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPDBusEnum
  Full Description	Enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and Image Import Wizard to transfer and synchronize content using removable mass-storage devices.
  Windows Driver Foundation – User-mode Driver Framework Service
  Svchost Group	LocalSystemNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted	SeChangeNotifyPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege
  Executable File Name	c:\windows\system32\wudfsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wudfsvc
  Full Description	Manages user-mode driver host processes.

  
  LocalServiceNetworkRestricted svchost group

  Windows Audio Service
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege SeIncreaseWorkingSetPrivilege
  Executable File Name	c:\windows\system32\audiosrv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv
  Full Description	Manages audio for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start
  DHCP Client Service
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted	SeChangeNotifyPrivilege SeCreateGlobalPrivilege
  Executable File Name	c:\windows\system32\dhcpcore.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
  Full Description	Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to star
  Event Logging Service
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wevtsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog
  Full Description	This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromis
  Windows HomeGroup
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\provsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HomeGroupProvider
  Full Description	Performs networking tasks associated with configuration and maintenance of homegroups. If this service is stopped or disabled, your computer will be unable to detect other homegroups and your homegroup might not work properly. It is recommended that you k
  TCPIP NetBios Transport Services DLL
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted	SeCreateGlobalPrivilege
  Executable File Name	c:\windows\system32\lmhsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lmhosts
  Full Description	Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and log on to the network. If this service is stopped, these functions might be unavailabl
  WPC Filtering Service
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted	SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wpcsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPCSvc
  Full Description	This service is a stub for Windows Parental Control functionality that existed in Vista. It is provided for backward compatibility only.
  Windows Security Center Service
  Svchost Group	LocalServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wscsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
  Full Description	The WSCSVC (Windows Security Center) service monitors and reports security health settings on the computer. The health settings include firewall (on/off), antivirus (on/off/out of date), antispyware (on/off/out of date), Windows Update (automatically/man

  
  AxInstSVGroup svchost group

  ActiveX Installer Service
  Svchost Group	AxInstSVGroup	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k AxInstSVGroup	SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\axinstsv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AxInstSV
  Full Description	Provides User Account Control validation for the installation of ActiveX controls from the Internet and enables management of ActiveX control installation based on Group Policy settings. This service is started on demand and if disabled the installation o

  
  LocalServiceNoNetwork svchost group

  Base Filtering Engine
  Svchost Group	LocalServiceNoNetwork	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork	SeAuditPrivilege
  Executable File Name	c:\windows\system32\bfe.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
  Full Description	The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also
  WDI Diagnostic Policy Service
  Svchost Group	LocalServiceNoNetwork	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\dps.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS
  Full Description	The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function.
  Windows Firewall API
  Svchost Group	LocalServiceNoNetwork	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork	SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege
  Executable File Name	c:\windows\system32\firewallapi.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc
  Full Description	Windows Firewall helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network.
  Performance Logs & Alerts
  Svchost Group	LocalServiceNoNetwork	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork	SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\pla.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pla
  Full Description	Performance Logs and Alerts Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected.
  WWAN Auto Config Service
  Svchost Group	LocalServiceNoNetwork	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork	SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege
  Executable File Name	c:\windows\system32\wwansvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WwanSvc
  Full Description	This service manages mobile broadband (GSM & CDMA) data card/embedded module adapters and connections by auto-configuring the networks. It is strongly recommended that this service be kept running for best user experience of mobile broadband devices.

  
  bthsvcs svchost group

  Bluetooth Support Service
  Svchost Group	bthsvcs	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k bthsvcs	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\bthserv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bthserv
  Full Description	The Bluetooth service supports discovery and association of remote Bluetooth devices. Stopping or disabling this service may cause already installed Bluetooth devices to fail to operate properly and prevent new devices from being discovered or associated

  
  NetworkService svchost group

  Cryptographic Services
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k NetworkService	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\cryptsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
  Full Description	Provides four management services: Catalog Database Service, which confirms the signatures of Windows files and allows new programs to be installed; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this
  DNS Client API DLL
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k NetworkService	SeChangeNotifyPrivilege SeCreateGlobalPrivilege
  Executable File Name	c:\windows\system32\dnsapi.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache
  Full Description	The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached
  Workstation Service DLL
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkService	SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege
  Executable File Name	c:\windows\system32\wkssvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
  Full Description	Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
  Quarantine Agent Service Run-Time
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkService	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\qagentrt.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent
  Full Description	The Network Access Protection (NAP) agent service collects and manages health information for client computers on a network. Information collected by NAP agent is used to make sure that the client computer has the required software and settings. If a clie
  Network Location Awareness 2
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkService	SeCreateGlobalPrivilege SeImpersonatePrivilege SeAuditPrivilege
  Executable File Name	c:\windows\system32\nlasvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc
  Full Description	Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable. If this service is disabled, any services that explicitly de
  MicrosoftAr Windows(TM) Telephony Server
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkService	SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege
  Executable File Name	c:\windows\system32\tapisrv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
  Full Description	Provides Telephony API (TAPI) support for programs that control telephony devices on the local computer and, through the LAN, on servers that are also running the service.
  Remote Desktop Session Host Server Remote Connections Manager
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkService	SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege
  Executable File Name	c:\windows\system32\termsrv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
  Full Description	Allows users to connect interactively to a remote computer. Remote Desktop and Remote Desktop Session Host Server depend on this service. To prevent remote use of this computer, clear the checkboxes on the Remote tab of the System properties control pane
  Event Collector Service
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k NetworkService	SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wecsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wecsvc
  Full Description	This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. If
  WSMan Service
  Svchost Group	NetworkService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkService	SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wsmsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM
  Full Description	Windows Remote Management (WinRM) service implements the WS-Management protocol for remote management. WS-Management is a standard web services protocol used for remote software and hardware management. The WinRM service listens on the network for WS-Mana

  
  DcomLaunch svchost group

  Ole resource dll
  Svchost Group	DcomLaunch	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k DcomLaunch	SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeDebugPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege
  Executable File Name	c:\windows\system32\oleres.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch
  Full Description	The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service
  User-mode Plug-and-Play Service
  Svchost Group	DcomLaunch	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k DcomLaunch	SeTcbPrivilege SeSecurityPrivilege SeAssignPrimaryTokenPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImpersonatePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeUndockPrivilege SeDebugPrivilege SeShutdownPrivilege
  Executable File Name	c:\windows\system32\umpnpmgr.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
  Full Description	Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
  User-mode Power Service
  Svchost Group	DcomLaunch	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k DcomLaunch	SeTcbPrivilege SeSecurityPrivilege SeAssignPrimaryTokenPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImpersonatePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeUndockPrivilege SeDebugPrivilege
  Executable File Name	c:\windows\system32\umpo.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Power
  Full Description	Manages power policy and power policy notification delivery.

   
•