Services

Svchost Groups

• netsvcs
• LocalServiceAndNoImpersonation
• LocalSystemNetworkRestricted
• LocalServiceNetworkRestricted
• AxInstSVGroup
• LocalServiceNoNetwork
• bthsvcs
• NetworkService
• DcomLaunch
• defragsvc
• LocalService
• NetSvcs
• NetworkServiceAndNoImpersonation
• LocalServicePeerNet
• PeerDist
• NetworkServiceNetworkRestricted
• regsvc
• RPCSS
• rpcss
• SDRSVC
• imgsvc
• swprv
• WbioSvcGroup
• wcssvc
• WerSvcGroup
• secsvcs
•  

• 
  defragsvc svchost group

  Microsoft\Disk Defragmenter
  Svchost Group	defragsvc	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k defragsvc	SeChangeNotifyPrivilege SeImpersonatePrivilege SeIncreaseWorkingSetPrivilege SeTcbPrivilege SeSystemProfilePrivilege SeAuditPrivilege SeCreateGlobalPrivilege SeBackupPrivilege SeManageVolumePrivilege
  Executable File Name	c:\windows\system32\defragsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\defragsvc
  Full Description	Provides Disk Defragmentation Capabilities.

  
  LocalService svchost group

  COM+ Resources
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\comres.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
  Full Description	Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifica
  Function Discovery Provider host service
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\fdphost.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdPHost
  Full Description	The FDPHOST service hosts the Function Discovery (FD) network discovery providers. These FD providers supply network discovery services for the Simple Services Discovery Protocol (SSDP) and Web Services â_” Discovery (WS-D) protocol. Stopping or disabling t
  Link-Layer Topology Discovery Resources
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalService	SeImpersonatePrivilege SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\lltdres.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdsvc
  Full Description	Creates a Network Map, consisting of PC and device topology (connectivity) information, and metadata describing each PC and device. If this service is disabled, the Network Map will not function properly.
  Network List Manager
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalService	SeImpersonatePrivilege SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\netprofm.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netprofm
  Full Description	Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.
  Network Store Interface RPC server
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\nsisvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsi
  Full Description	This service delivers network notifications (e.g. interface addition/deleting etc) to user mode clients. Stopping this service will cause loss of network connectivity. If this service is disabled, any other services that explicitly depend on this service
  SPP Notification Service
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\sppuinotify.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify
  Full Description	Provides Software Licensing activation and notification
  Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN).
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\sstpsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SstpSvc
  Full Description	Provides support for the Secure Socket Tunneling Protocol (SSTP) to connect to remote computers using VPN. If this service is disabled, users will not be able to use SSTP to access remote servers.
  Multimedia Class Scheduler Service
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\mmcss.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\THREADORDER
  Full Description	Provides ordered execution for a group of threads within a specific period of time.
  Windows Time Service
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeSystemTimePrivilege
  Executable File Name	c:\windows\system32\w32time.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time
  Full Description	Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
  Windows Diagnostic Infrastructure
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalService	SeChangeNotifyPrivilege SeImpersonatePrivilege SeSystemProfilePrivilege
  Executable File Name	c:\windows\system32\wdi.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiServiceHost
  Full Description	The Diagnostic Service Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local Service context. If this service is stopped, any diagnostics that depend on it will no longer function.
  Web DAV Service DLL
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeImpersonatePrivilege SeCreateGlobalPrivilege
  Executable File Name	c:\windows\system32\webclnt.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient
  Full Description	Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start.
  Windows HTTP Services
  Svchost Group	LocalService	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k LocalService	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\winhttp.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
  Full Description	WinHTTP implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its impl

  
  NetSvcs svchost group

  Service that offers IPv6 connectivity over an IPv4 network.
  Svchost Group	NetSvcs	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetSvcs	SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege
  Executable File Name	c:\windows\system32\iphlpsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc
  Full Description	Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer.

  
  NetworkServiceAndNoImpersonation svchost group

  COM+ Resources
  Svchost Group	NetworkServiceAndNoImpersonation	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k NetworkServiceAndNoImpersonation	SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\comres.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KtmRm
  Full Description	Coordinates transactions between the Distributed Transaction Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it is recommended that this service remain stopped. If it is needed, both MSDTC and KTM will start this service

  
  LocalServicePeerNet svchost group

  PNRP Service Dll
  Svchost Group	LocalServicePeerNet	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServicePeerNet	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\pnrpsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pimsvc
  Full Description	Provides identity services for the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services. If disabled, the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services may not function, and some applications, such as HomeGrou
  Peer-to-Peer Services
  Svchost Group	LocalServicePeerNet	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServicePeerNet	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\p2psvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2psvc
  Full Description	Enables multi-party communication using Peer-to-Peer Grouping. If disabled, some applications, such as HomeGroup, may not function.
  PNRP Auto Service Dll
  Svchost Group	LocalServicePeerNet	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServicePeerNet	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\pnrpauto.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPAutoReg
  Full Description	This service publishes a machine name using the Peer Name Resolution Protocol. Configuration is managed via the netsh context p2p pnrp peer
  PNRP Service Dll
  Svchost Group	LocalServicePeerNet	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k LocalServicePeerNet	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\pnrpsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPsvc
  Full Description	Enables serverless peer name resolution over the Internet using the Peer Name Resolution Protocol (PNRP). If disabled, some peer-to-peer and collaborative applications, such as Remote Assistance, may not function.

  
  PeerDist svchost group

  BranchCache Service
  Svchost Group	PeerDist	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k PeerDist	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeAuditPrivilege
  Executable File Name	c:\windows\system32\peerdistsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PeerDistSvc
  Full Description	This service caches network content from peers on the local subnet.

  
  NetworkServiceNetworkRestricted svchost group

  Policy Storage dll
  Svchost Group	NetworkServiceNetworkRestricted	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted	SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\polstore.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
  Full Description	Internet Protocol security (IPsec) supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. This service enforces IPsec policies created through the IP Security Poli

  
  regsvc svchost group

  Remote Registry Service
  Svchost Group	regsvc	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k regsvc	SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\regsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
  Full Description	Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start.

  
  RPCSS svchost group

  RPC Endpoint Mapper
  Svchost Group	RPCSS	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k RPCSS	SeChangeNotifyPrivilege SeImpersonatePrivilege SeCreateGlobalPrivilege
  Executable File Name	c:\windows\system32\rpcepmap.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcEptMapper
  Full Description	Resolves RPC interfaces identifiers to transport endpoints. If this service is stopped or disabled, programs using Remote Procedure Call (RPC) services will not function properly.

  
  rpcss svchost group

  Ole resource dll
  Svchost Group	rpcss	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k rpcss	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\oleres.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
  Full Description	The RPCSS service is the Service Control Manager for COM and DCOM servers. It performs object activations requests, object exporter resolutions and distributed garbage collection for COM and DCOM servers. If this service is stopped or disabled, programs u

  
  SDRSVC svchost group

  MicrosoftAr Windows Backup Service
  Svchost Group	SDRSVC	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k SDRSVC	SeBackupPrivilege SeRestorePrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeCreateSymbolicLinkPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeSystemEnvironmentPrivilege
  Executable File Name	c:\windows\system32\sdrsvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC
  Full Description	Provides Windows Backup and Restore capabilities.

  
  imgsvc svchost group

  Still Image Devices Service
  Svchost Group	imgsvc	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k imgsvc	SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wiaservc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc
  Full Description	Provides image acquisition services for scanners and cameras

  
  swprv svchost group

  MicrosoftAr Volume Shadow Copy Service software provider
  Svchost Group	swprv	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k swprv	SeBackupPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege SeManageVolumePrivilege SeRestorePrivilege SeIncreaseBasePriorityPrivilege SeManageVolumePrivilege SeRestorePrivilege SeTcbPrivilege
  Executable File Name	c:\windows\system32\swprv.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv
  Full Description	Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to sta

  
  WbioSvcGroup svchost group

  Windows Biometric Service
  Svchost Group	WbioSvcGroup	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k WbioSvcGroup	SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege
  Executable File Name	c:\windows\system32\wbiosrvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WbioSrvc
  Full Description	The Windows biometric service gives client applications the ability to capture, compare, manipulate, and store biometric data without gaining direct access to any biometric hardware or samples. The service is hosted in a privileged SVCHOST process.

  
  wcssvc svchost group

  WcsPlugInService DLL
  Svchost Group	wcssvc	Privileges
  Svchost Command	C:\Windows\system32\svchost.exe -k wcssvc	SeChangeNotifyPrivilege
  Executable File Name	c:\windows\system32\wcspluginservice.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcsPlugInService
  Full Description	The WcsPlugInService service hosts third-party Windows Color System color device model and gamut map model plug-in modules. These plug-in modules are vendor-specific extensions to the Windows Color System baseline color device and gamut map models. Stoppi

  
  WerSvcGroup svchost group

  Windows Error Reporting Service
  Svchost Group	WerSvcGroup	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k WerSvcGroup	SeDebugPrivilege SeTcbPrivilege SeImpersonatePrivilege SeAssignPrimaryTokenPrivilege
  Executable File Name	c:\windows\system32\wersvc.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc
  Full Description	Allows errors to be reported when programs stop working or responding and allows existing solutions to be delivered. Also allows logs to be generated for diagnostic and repair services. If this service is stopped, error reporting might not work correctly

  
  secsvcs svchost group

  Windows Defender Resource Module
  Svchost Group	secsvcs	Privileges
  Svchost Command	C:\Windows\System32\svchost.exe -k secsvcs	SeImpersonatePrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeChangeNotifyPrivilege SeSecurityPrivilege SeShutdownPrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege
  Executable File Name	c:\program files\windows defender\msmpres.dll
  Registry Key	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
  Full Description	Protection against spyware and potentially unwanted software

•