What are some Safe to Disable Windows 11 Services?

Read this excellent article, which explains the different W10/11 services and their functions. djdallman provides a PowerShell command list to disable his list of non-essential services on a live system. You can test this setup for an extended period.

https://github.com/djdallmann/GamingPCSetup/blob/master/CONTENT/DOCS/SERVICES/README.md

If testing works for you, use the same list to disable services in NTLite. Unlike removals, a disabled service can always be re-enabled.
 
"Safe" is relative to each persons needs, here is a barebone/minimal services list for w10 1809 ltsc i use, its "safe" for me.
go very careful about disabling services in the image because they may(and have :/ ) broken setup before. put a few basic(that dont break setup) ones into the image and do the rest post setup once all your drivers and software are installed, tweaks wise i say do services as the last thing.
 
Last edited:
Lots of good info here already. Another useful tidbit would be to do a clean install of Windows and export the services list (to have a baseline). Then if you lose track of things or something breaks, you'll know what the originals were. If you also boot into safe mode and export the services there, you can get a big head start by disabling everything except what safe mode needs and then using that as a starting point to work from.

I got this command from Garlin and Clanger, which exports a list of services to the desktop:
wmic service get DisplayName,Status,StartMode | sort > %userprofile%\Desktop\Services.txt

You could paste the text into something like Excel so you can manipulate it easier.
 
Last edited:
I got it from someone else, probably garlin. i also use "get" for Features, Capabilities, something and something, drive is offline, will post when it isnt. users will probably want "safe mode with networking".

wish i had known about using "safe mode" as a services baseline and work from there, i always start from the normal services configuration, sometimes you need an extra pair of eyes with a brain attached :/
 
Last edited:
Hellbovine said:
I got this command from Garlin and Clanger, which exports a list of services to the desktop:
wmic service get DisplayName,Status,StartMode | sort > %userprofile%\Desktop\Services.txt
You could paste the text into something like Excel so you can manipulate it easier.
Click to expand...
or go to services.msc, arrange columns - export, ie
Automatic - Background Tasks Infrastructure Service
Automatic - COM+ Event System
Automatic - CoreMessaging
Automatic - DCOM Server Process Launcher
Automatic - Local Session Manager
Automatic - Power
Automatic - Remote Procedure Call (RPC)
Automatic - RPC Endpoint Mapper
Automatic - Security Accounts Manager
Automatic - User Profile Service
Automatic - Windows Audio
Automatic - Windows Audio Endpoint Builder
Automatic - Software Protection
Automatic - User Manager

Manual - COM+ System Application
Manual - Distributed Transaction Coordinator
Manual - Secondary Log-on
Manual - Windows Management Instrumentation
Manual - Windows Modules Installer
Manual - WMI Performance Adapter
Manual - KtmRm for Distributed Transaction Coordinator
Manual - Local Profile Assistant Service

Disabled - ActiveX Installer (AxInstSV)
Disabled - AllJoyn Router Service
Disabled - App Readiness
Disabled - Application Identity
Disabled - Application Information
Disabled - Application Layer Gateway Service
Disabled - Application Management
Disabled - AppX Deployment Service (AppXSVC)
Disabled - AssignedAccessManager Service
Disabled - Auto Time Zone Updater
Disabled - AVCTP service
Disabled - Background Intelligent Transfer Service
Disabled - Base Filtering Engine
Disabled - BitLocker Drive Encryption Service - Note, must leave driver enabled, will brick system if driver disabled.
Disabled - Block Level Backup Engine Service
Disabled - Bluetooth Audio Gateway Service
Disabled - Bluetooth Support Service
Disabled - BranchCache
Disabled - Capability Access Manager Service
Disabled - CaptureService_16431
Disabled - Certificate Propagation
Disabled - Client License Service (ClipSVC)
Disabled - Clipboard User Service_16431
Disabled - CNG Key Isolation
Disabled - Connected Devices Platform Service
Disabled - Connected Devices Platform User Service_16431
Disabled - Connected User Experiences and Telemetry
Disabled - Contact Data_16431
Disabled - Credential Manager
Disabled - Cryptographic Services
Disabled - Data Sharing Service
Disabled - Data Usage
Disabled - Delivery Optimization
Disabled - Device Association Service
Disabled - Device Install Service
Disabled - Device Management Enrollment Service
Disabled - Device Management Wireless Application Protocol (WAP) Push message Routing Service
Disabled - Device Setup Manager
Disabled - DevicePicker_16431
Disabled - DevicesFlow_16431
Disabled - DevQuery Background Discovery Broker
Disabled - DHCP Client
Disabled - Diagnostic Execution Service
Disabled - Diagnostic Policy Service
Disabled - Diagnostic Service Host
Disabled - Diagnostic System Host
Disabled - Display Enhancement Service
Disabled - Distributed Link Tracking Client
Disabled - DNS Client
Disabled - Downloaded Maps Manager
Disabled - Embedded Mode
Disabled - Encrypting File System (EFS)
Disabled - Enterprise App Management Service
Disabled - Extensible Authentication Protocol
Disabled - Fax
Disabled - File History Service
Disabled - Function Discovery Provider Host
Disabled - Function Discovery Resource Publication
Disabled - GameDVR and Broadcast User Service_16431
Disabled - Geolocation Service
Disabled - GraphicsPerfSvc
Disabled - Group Policy Client
Disabled - Human Interface Device Service
Disabled - HV Host Service
Disabled - Hyper-V Data Exchange Service
Disabled - Hyper-V Guest Service Interface
Disabled - Hyper-V Guest Shutdown Service
Disabled - Hyper-V Heartbeat Service
Disabled - Hyper-V PowerShell Direct Service
Disabled - Hyper-V Remote Desktop Virtualization Service
Disabled - Hyper-V Time Synchronization Service
Disabled - Hyper-V Volume Shadow Copy Requestor
Disabled - IKE and AuthIP IPsec Keying Modules
Disabled - Infrared monitor service
Disabled - Internet Connection Sharing (ICS)
Disabled - IP Helper
Disabled - IP Translation Configuration Service
Disabled - IPsec Policy Agent
Disabled - Language Experience Service
Disabled - Link-Layer Topology Discovery Mapper
Disabled - Microsoft (R) Diagnostics Hub Standard Collector Service
Disabled - Microsoft Account Sign-in Assistant
Disabled - Microsoft App-V Client
Disabled - Microsoft iSCSI Initiator Service
Disabled - Microsoft Passport
Disabled - Microsoft Passport Container
Disabled - Microsoft Software Shadow Copy Provider
Disabled - Microsoft Storage Spaces SMP
Disabled - Microsoft Store Install Service
Disabled - Microsoft Windows SMS Router Service.
Disabled - Multimedia Class Scheduler Service - hidden service.
Disabled - Natural Authentication
Disabled - Net.Tcp Port Sharing Service
Disabled - Netlogon
Disabled - Network Connected Devices Auto-Setup
Disabled - Network Connection Broker
Disabled - Network Connections
Disabled - Network Connectivity Assistant
Disabled - Network List Service
Disabled - Network Location Awareness
Disabled - Network Setup Service
Disabled - Network Store Interface Service
Disabled - Offline Files
Disabled - OpenSSH Authentication Agent
Disabled - Optimise drives
Disabled - Parental Controls
Disabled - Payments and NFC/SE Manager
Disabled - Peer Name Resolution Protocol
Disabled - Peer Networking Grouping
Disabled - Peer Networking Identity Manager
Disabled - Performance Counter DLL Host
Disabled - Performance Logs & Alerts
Disabled - Phone Service
Disabled - Plug and Play
Disabled - PNRP Machine Name Publication Service
Disabled - Portable Device Enumerator Service
Disabled - Print Spooler
Disabled - Printer Extensions and Notifications
Disabled - PrintWorkflow_16431
Disabled - Problem Reports and Solutions Control Panel Support
Disabled - Program Compatibility Assistant Service
Disabled - Quality Windows Audio Video Experience
Disabled - Radio Management Service
Disabled - Remote Access Auto Connection Manager
Disabled - Remote Access Connection Manager
Disabled - Remote Desktop Configuration
Disabled - Remote Desktop Services
Disabled - Remote Desktop Services UserMode Port Redirector
Disabled - Remote Procedure Call (RPC) Locator
Disabled - Remote Registry
Disabled - Retail Demo Service
Disabled - Routing and Remote Access
Disabled - Secure Socket Tunneling Protocol Service
Disabled - Security Center
Disabled - Sensor Data Service
Disabled - Sensor Monitoring Service
Disabled - Sensor Service
Disabled - Server
Disabled - Shared PC Account Manager
Disabled - Shell Hardware Detection
Disabled - Smart Card
Disabled - Smart Card Device Enumeration Service
Disabled - Smart Card Removal Policy
Disabled - SNMP Trap
Disabled - Spatial Data Service
Disabled - Spot Verifier
Disabled - SSDP Discovery
Disabled - State Repository Service
Disabled - Still Image Acquisition Events
Disabled - Storage Service
Disabled - Storage Tiers Management
Disabled - Sync Host_16431
Disabled - SysMain
Disabled - System Event Notification Service
Disabled - System Events Broker
Disabled - System Guard Runtime Monitor Broker
Disabled - Task Scheduler
Disabled - TCP/IP NetBIOS Helper
Disabled - Telephony
Disabled - Themes
Disabled - Time Broker
Disabled - Touch Keyboard and Handwriting Panel Service
Disabled - Update Orchestrator Service
Disabled - UPnP Device Host
Disabled - User Data Access_16431
Disabled - User Data Storage_16431
Disabled - User Experience Virtualization Service
Disabled - Virtual Disk
Disabled - Volume Shadow Copy
Disabled - Volumetric Audio Compositor Service
Disabled - WalletService
Disabled - WarpJITSvc
Disabled - Web Account Manager
Disabled - WebClient
Disabled - Wi-Fi Direct Services Connection Manager Service
Disabled - Windows Backup
Disabled - Windows Biometric Service
Disabled - Windows Camera Frame Server
Disabled - Windows Connect Now - Config Registrar
Disabled - Windows Connection Manager
Disabled - Windows Defender Advanced Threat Protection Service
Disabled - Windows Defender Antivirus Network Inspection Service
Disabled - Windows Defender Antivirus Service
Disabled - Windows Defender Firewall
Disabled - Windows Encryption Provider Host Service
Disabled - Windows Error Reporting Service
Disabled - Windows Event Collector
Disabled - Windows Event Log
Disabled - Windows Font Cache Service
Disabled - Windows Image Acquisition (WIA)
Disabled - Windows Insider Service
Disabled - Windows Installer
Disabled - Windows License Manager Service
Disabled - Windows Management Service
Disabled - Windows Media Player Network Sharing Service
Disabled - Windows Mobile Hotspot Service
Disabled - Windows Perception Service
Disabled - Windows Perception Simulation Service
Disabled - Windows Presentation Foundation Font Cache 3.0.0.0
Disabled - Windows Push Notifications System Service
Disabled - Windows Push Notifications User Service_16431
Disabled - Windows PushToInstall Service
Disabled - Windows Remote Management (WS-Management)
Disabled - Windows Search
Disabled - Windows Security Service
Disabled - Windows Time
Disabled - Windows Update
Disabled - Windows Update Medic Service
Disabled - WinHTTP Web Proxy Auto-Discovery Service
Disabled - Wired AutoConfig
Disabled - WLAN AutoConfig
Disabled - Work Folders
Disabled - Workstation
Disabled - WWAN AutoConfig
Disabled - Xbox Accessory Management Service
Disabled - Xbox Live Auth Manager
Disabled - Xbox Live Game Save
Disabled - Xbox Live Networking Service
 
Clanger said:
i also use "get" for Features, Capabilities, something and something,
Click to expand...
Click to expand...
dism /online /Get-Features /Format:Table /English >"%userprofile%\Desktop\Features.txt"
dism /online /Get-Capabilities /Format:Table /English >"%userprofile%\Desktop\Capabilities.txt"
dism /online /Get-Packages /Format:Table /English >"%userprofile%\Desktop\Packages.txt"
 
Clanger said:
I got it from someone else, probably garlin. i also use "get" for Features, Capabilities, something and something, drive is offline, will post when it isnt. users will probably want "safe mode with networking".
Click to expand...
Yeah, good point, most people will want the networking mode. I had used that services command to create the PDFs in another thread (link). I saved your "get" commands to my to-do list to check out as well, that list is just growing faster than I can pare it down though :p
 
the "gets" are copy/paste from the other thread, havnt looked at my file yet.
the only thing with safe mode is that it might disable some (needed by user)driver services, run ntlite on a safe mode windows to see.

Clanger said:
I got it from someone else, probably garlin.
Click to expand...
yep, it was him
 
Last edited:
there was recent chat about resource usage in percentages, 6% etc, cant remember where, could do with cross linking it to the resource usage thread.
 
It's in the DAW thread. I was gonna reply to those posts, but fell down a rabbit hole at the time and got lost. I can post my anecdote over there in a minute.
 
Clanger said:
or go to services.msc, arrange columns - export, ie
Automatic - Background Tasks Infrastructure Service
Automatic - COM+ Event System
Automatic - CoreMessaging
Automatic - DCOM Server Process Launcher
Automatic - Local Session Manager
Automatic - Power
Automatic - Remote Procedure Call (RPC)
Automatic - RPC Endpoint Mapper
Automatic - Security Accounts Manager
Automatic - User Profile Service
Automatic - Windows Audio
Automatic - Windows Audio Endpoint Builder
Automatic - Software Protection
Automatic - User Manager

Manual - COM+ System Application
Manual - Distributed Transaction Coordinator
Manual - Secondary Log-on
Manual - Windows Management Instrumentation
Manual - Windows Modules Installer
Manual - WMI Performance Adapter
Manual - KtmRm for Distributed Transaction Coordinator
Manual - Local Profile Assistant Service

Disabled - ActiveX Installer (AxInstSV)
Disabled - AllJoyn Router Service
Disabled - App Readiness
Disabled - Application Identity
Disabled - Application Information
Disabled - Application Layer Gateway Service
Disabled - Application Management
Disabled - AppX Deployment Service (AppXSVC)
Disabled - AssignedAccessManager Service
Disabled - Auto Time Zone Updater
Disabled - AVCTP service
Disabled - Background Intelligent Transfer Service
Disabled - Base Filtering Engine
Disabled - BitLocker Drive Encryption Service - Note, must leave driver enabled, will brick system if driver disabled.
Disabled - Block Level Backup Engine Service
Disabled - Bluetooth Audio Gateway Service
Disabled - Bluetooth Support Service
Disabled - BranchCache
Disabled - Capability Access Manager Service
Disabled - CaptureService_16431
Disabled - Certificate Propagation
Disabled - Client License Service (ClipSVC)
Disabled - Clipboard User Service_16431
Disabled - CNG Key Isolation
Disabled - Connected Devices Platform Service
Disabled - Connected Devices Platform User Service_16431
Disabled - Connected User Experiences and Telemetry
Disabled - Contact Data_16431
Disabled - Credential Manager
Disabled - Cryptographic Services
Disabled - Data Sharing Service
Disabled - Data Usage
Disabled - Delivery Optimization
Disabled - Device Association Service
Disabled - Device Install Service
Disabled - Device Management Enrollment Service
Disabled - Device Management Wireless Application Protocol (WAP) Push message Routing Service
Disabled - Device Setup Manager
Disabled - DevicePicker_16431
Disabled - DevicesFlow_16431
Disabled - DevQuery Background Discovery Broker
Disabled - DHCP Client
Disabled - Diagnostic Execution Service
Disabled - Diagnostic Policy Service
Disabled - Diagnostic Service Host
Disabled - Diagnostic System Host
Disabled - Display Enhancement Service
Disabled - Distributed Link Tracking Client
Disabled - DNS Client
Disabled - Downloaded Maps Manager
Disabled - Embedded Mode
Disabled - Encrypting File System (EFS)
Disabled - Enterprise App Management Service
Disabled - Extensible Authentication Protocol
Disabled - Fax
Disabled - File History Service
Disabled - Function Discovery Provider Host
Disabled - Function Discovery Resource Publication
Disabled - GameDVR and Broadcast User Service_16431
Disabled - Geolocation Service
Disabled - GraphicsPerfSvc
Disabled - Group Policy Client
Disabled - Human Interface Device Service
Disabled - HV Host Service
Disabled - Hyper-V Data Exchange Service
Disabled - Hyper-V Guest Service Interface
Disabled - Hyper-V Guest Shutdown Service
Disabled - Hyper-V Heartbeat Service
Disabled - Hyper-V PowerShell Direct Service
Disabled - Hyper-V Remote Desktop Virtualization Service
Disabled - Hyper-V Time Synchronization Service
Disabled - Hyper-V Volume Shadow Copy Requestor
Disabled - IKE and AuthIP IPsec Keying Modules
Disabled - Infrared monitor service
Disabled - Internet Connection Sharing (ICS)
Disabled - IP Helper
Disabled - IP Translation Configuration Service
Disabled - IPsec Policy Agent
Disabled - Language Experience Service
Disabled - Link-Layer Topology Discovery Mapper
Disabled - Microsoft (R) Diagnostics Hub Standard Collector Service
Disabled - Microsoft Account Sign-in Assistant
Disabled - Microsoft App-V Client
Disabled - Microsoft iSCSI Initiator Service
Disabled - Microsoft Passport
Disabled - Microsoft Passport Container
Disabled - Microsoft Software Shadow Copy Provider
Disabled - Microsoft Storage Spaces SMP
Disabled - Microsoft Store Install Service
Disabled - Microsoft Windows SMS Router Service.
Disabled - Multimedia Class Scheduler Service - hidden service.
Disabled - Natural Authentication
Disabled - Net.Tcp Port Sharing Service
Disabled - Netlogon
Disabled - Network Connected Devices Auto-Setup
Disabled - Network Connection Broker
Disabled - Network Connections
Disabled - Network Connectivity Assistant
Disabled - Network List Service
Disabled - Network Location Awareness
Disabled - Network Setup Service
Disabled - Network Store Interface Service
Disabled - Offline Files
Disabled - OpenSSH Authentication Agent
Disabled - Optimise drives
Disabled - Parental Controls
Disabled - Payments and NFC/SE Manager
Disabled - Peer Name Resolution Protocol
Disabled - Peer Networking Grouping
Disabled - Peer Networking Identity Manager
Disabled - Performance Counter DLL Host
Disabled - Performance Logs & Alerts
Disabled - Phone Service
Disabled - Plug and Play
Disabled - PNRP Machine Name Publication Service
Disabled - Portable Device Enumerator Service
Disabled - Print Spooler
Disabled - Printer Extensions and Notifications
Disabled - PrintWorkflow_16431
Disabled - Problem Reports and Solutions Control Panel Support
Disabled - Program Compatibility Assistant Service
Disabled - Quality Windows Audio Video Experience
Disabled - Radio Management Service
Disabled - Remote Access Auto Connection Manager
Disabled - Remote Access Connection Manager
Disabled - Remote Desktop Configuration
Disabled - Remote Desktop Services
Disabled - Remote Desktop Services UserMode Port Redirector
Disabled - Remote Procedure Call (RPC) Locator
Disabled - Remote Registry
Disabled - Retail Demo Service
Disabled - Routing and Remote Access
Disabled - Secure Socket Tunneling Protocol Service
Disabled - Security Center
Disabled - Sensor Data Service
Disabled - Sensor Monitoring Service
Disabled - Sensor Service
Disabled - Server
Disabled - Shared PC Account Manager
Disabled - Shell Hardware Detection
Disabled - Smart Card
Disabled - Smart Card Device Enumeration Service
Disabled - Smart Card Removal Policy
Disabled - SNMP Trap
Disabled - Spatial Data Service
Disabled - Spot Verifier
Disabled - SSDP Discovery
Disabled - State Repository Service
Disabled - Still Image Acquisition Events
Disabled - Storage Service
Disabled - Storage Tiers Management
Disabled - Sync Host_16431
Disabled - SysMain
Disabled - System Event Notification Service
Disabled - System Events Broker
Disabled - System Guard Runtime Monitor Broker
Disabled - Task Scheduler
Disabled - TCP/IP NetBIOS Helper
Disabled - Telephony
Disabled - Themes
Disabled - Time Broker
Disabled - Touch Keyboard and Handwriting Panel Service
Disabled - Update Orchestrator Service
Disabled - UPnP Device Host
Disabled - User Data Access_16431
Disabled - User Data Storage_16431
Disabled - User Experience Virtualization Service
Disabled - Virtual Disk
Disabled - Volume Shadow Copy
Disabled - Volumetric Audio Compositor Service
Disabled - WalletService
Disabled - WarpJITSvc
Disabled - Web Account Manager
Disabled - WebClient
Disabled - Wi-Fi Direct Services Connection Manager Service
Disabled - Windows Backup
Disabled - Windows Biometric Service
Disabled - Windows Camera Frame Server
Disabled - Windows Connect Now - Config Registrar
Disabled - Windows Connection Manager
Disabled - Windows Defender Advanced Threat Protection Service
Disabled - Windows Defender Antivirus Network Inspection Service
Disabled - Windows Defender Antivirus Service
Disabled - Windows Defender Firewall
Disabled - Windows Encryption Provider Host Service
Disabled - Windows Error Reporting Service
Disabled - Windows Event Collector
Disabled - Windows Event Log
Disabled - Windows Font Cache Service
Disabled - Windows Image Acquisition (WIA)
Disabled - Windows Insider Service
Disabled - Windows Installer
Disabled - Windows License Manager Service
Disabled - Windows Management Service
Disabled - Windows Media Player Network Sharing Service
Disabled - Windows Mobile Hotspot Service
Disabled - Windows Perception Service
Disabled - Windows Perception Simulation Service
Disabled - Windows Presentation Foundation Font Cache 3.0.0.0
Disabled - Windows Push Notifications System Service
Disabled - Windows Push Notifications User Service_16431
Disabled - Windows PushToInstall Service
Disabled - Windows Remote Management (WS-Management)
Disabled - Windows Search
Disabled - Windows Security Service
Disabled - Windows Time
Disabled - Windows Update
Disabled - Windows Update Medic Service
Disabled - WinHTTP Web Proxy Auto-Discovery Service
Disabled - Wired AutoConfig
Disabled - WLAN AutoConfig
Disabled - Work Folders
Disabled - Workstation
Disabled - WWAN AutoConfig
Disabled - Xbox Accessory Management Service
Disabled - Xbox Live Auth Manager
Disabled - Xbox Live Game Save
Disabled - Xbox Live Networking Service
Click to expand...
Additional info that could help nuhi is that the services
Application Information is needed to identify the apps and run the programs with admin rights, if disabled user has problemas running any program like cmd.exe,services.msc and etc.... To fix this the user need to change EnableLUA from 1 to 0
Here's a link for the complete name of the setting available in Local Security Policy (secpol.msc)
www.tenforums.com

Enable or Disable User Account Control (UAC) in Windows

How to Enable or Disable User Account Control (UAC) in Windows
www.tenforums.com www.tenforums.com

Also if Application Information is disabled, the new Notepad is not available to be used and the user is "forced" to use the old one.

DevicesFlowUserSvc and DevicesFlow_* is required to make Bluetooth & Devices accessible and also when you click the volume icon in taskbar, if the service is disabled, the user is not allowed to change the volume manually or even see the current volume for the speakers or headphones.
You can check this in the screenshot.

And SystemEventsBroker is also needed to the system get this information, I disable the service and when re-enabled I could see all the informations and change the volume manually.

Another service which I don't have too much sure if is the cause of this problem is Shell Hardware Detection, I have this service disabled and I cannot see the Encryption Icon (which is encrypted with BitLocker) here's the screenshot
1681749504386.png

Quick update: I plug in a usb drive and the icons are back, I don't know why they are not there before, but they are back hahah
1681750084879.png
 

Attachments

  • explorer_xPobgZlNDT.png
    explorer_xPobgZlNDT.png
    428.5 KB
Last edited:
You must log in or register to reply here.
Back
Top