Win Services Database - A Prototype

kosmo

Member
Messages
82
Reaction score
26
Most of us who are attempting to turn Windoze into a useful & efficient tool that’s a pleasure to use will, sooner or later, attempt to reduce the number of services running in the background. In order to do this in a rational, logical manner it should be obvious that before we can decide whether or not to disable (or otherwise change the state of) any service we need to know what that service actually does on our system. Now you could just kill all the services that you don’t like the name of or you could try and find that mythical secret list of services that are “Safe” to disable on every computer. But as you can see I prefer the 1st method.

For a variety of reasons getting real-world info on M$ services is not easy. And I was whining about this problem here on NTL a while ago and garlin replied with a link to this M$ page that lists their recommendations for 21H2 & later IoT Enterprise versions as to which services could be disabled. I was (initially) so enthused I decided to build a worksheet that I could use to make an list of candidates of services that might be disabled. Doing this with a spreadsheet allowed me to display all of the necessary data in a pageview that didn’t have to be scrolled horizontally. Like this:

SS.jpg

Great, you say, but “where’s the info on what each service does?”. For that I built a comments box for each service that holds all the descriptive data. (see the tiny red arrow in the 2nd column) Pulling up the comment window looks like this:
SS+Flyout.jpg

So, yes, this was a lot of work. Perhaps more than can be justified in order to tweak one single computer. For example each service entry contains info from the M$ page linked above, the CIS W10 Enterprise recommendations, Black Viper’s W0 recommendations as well as many other misc sources for each and every entry. Which is why i’m uploading here in the hopes that some of you will check it out and find it useful. But, more importantly, I hope that those of you that know way more than I do about Windoze (ie: most of you) will also post your corrections and additions. Because, as I found while doing this project, there is no comprehensive, publicly accessible database of what M$ services actually do. None. So let’s build one that we can all use.

(i’ll collect your feedback and update the database accordingly)

1/10/25: Added updates from AsadAlrafidain, garlin & Ihadaface
 

Attachments

Last edited:
Win Services & the Ghost of Black Viper

One of the sources of advice that I used in building this worksheet was an archived version of Black Viper’s recommendations on W10 services. It was his last “Black Viper” Windows services project - posted back in 2019. I included it because if I didn’t I would surely get complaints that this couldn’t be considered a serious project because it didn’t acknowledge BV’s contribution. The simple fact is that this person who refers to himself as Black Viper has become a living legend in the Windoze tweaking community. Because he did this for what? - 20 - 25 years? When he first started (XP?) Windoze did have too many services running full-time and RAM was expensive so disabling “unnecessary” services could have a measurable effect on system performance. But M$ has since figured out how to call up most services from “hibernation” when they’re needed and adequate RAM is now cheap. So 2 things have changed over the era of BV Service recommendations: the payback from turning off “extra” services has diminished but also, and more importantly, his original enthusiasm is clearly gone. BV can be forgiven if he’s tired of cranking out service tweaking recommendations for every new Windoze generation. An OS that, by his own words, he doesn’t even use anymore.

So, having said that, let me get further in trouble by voicing my (humble) opinion that his recommendations for W10 were...........odd (at best). Look at the worksheet. He has (only) 25 recommendations of services to disable (for his “tweaked” category). I have 49 services marked to be disabled. The number of times we both chose the same services? Six! Even a random roll of the dice should have been higher than that. Clearly he & I weren’t on the same wavelength. Also there’s at least 2 services where BV said: “Don’t Disable” and M$ said: “Sure, you can disable this”!

Look at his recommendation sheet (included in the zipfile). We have the “default” settings, the “Safe” settings, the Tweaked” settings and for the Extreme Hacker we have the “BareBones”settings. So, for the purposes of this discussion, let’s look at the “Safe” recommendations. BV apparently means that these changes will be “safe” for most of us to make. Well if you really mean safe to disable for everybody then common sense will tell us that the true # of services that every Windoze user in the world can disable without any possible adverse effect on their specific, individual setup is zero. There isn’t and, in fact, can never be - any generic, one-size-fits-all list of Windoze services that are “Safe” for everyone to disable. The only list that even approaches Complete Safety is the list of default services that your OS came with. (And even that isn’t 100%)

Well, “of course” - you say! “You’ve got to take into account the needs / requirements your particular computer setup”. And you say this as if it’s a minor adjustment of the fine print for the recommendations. It’s not. It’s a Night vs Day difference. Hot vs Cold. Black vs White. Because what BV did - with the very best of intentions - is to inadvertently create the mythology that you can take someone else's list of “Safe To Disable ™” services, apply it to your computer and presto! - Bob’s Your Uncle! You can now ride off into the sunset. He accidentally created a mythology that’s only grown stronger over the years.

The simple fact is that these are 2 diametrically opposed perspectives on service tweaking. The “Safe to Disable” (for everyone) delusion taps into our universal human tendency to look for a Quick Fix - a Free Lunch. Taking someone else's “Safe to Disable” list and applying to your computer - which has a specific personalized list of requirements that’s very different from that of the list author is almost certain to end in disappointment. Simply because there ain’t no Free Lunch. Many of the services on Win 10 / 11 are very specialized. And almost all of the automatically started services have interlocking dependencies with other services. My goal in resetting my services was to reduce the “overhead” - the # of services running in the background - without crippling my OS in any way whatsoever. Only you can know what you expect your computer to be able to do. Which means that you’re the only one capable of deciding whether any particular service fits into your particular configuration.
 
Thanks kosmo, this should come in handy - services indeed are not documented well enough - it's becoming worse and worse lately.
Either they are rushing Windows changes or intentionally obfuscating what is what.

Important to note is that service dependencies are not identical pre and post-setup, so make sure to test in both cases.

Btw feedback is welcome in differences from NTLite's new Templates in the Services page (Privacy/Gaming/Lite), if it needs some obvious adjustments.
The built-in list was made by following what was removable over the years, not on data like in this topic.

Btw you can also make REG files for the Integrate - Registry page, or a preset for your recommendations and maintain that as your database matures.
 
This is an amazing compilation of data. Gonna take me a while to sort through it all. I remember using Black Viper's guide back when I was tweaking my dying Windows 7 PC haha. Nowadays I follow pretty much the same methodology as yours: Only disable undesirable stuff, the rest can be left on manual.
 
just wanted to share some notes I previously recorded when I was dealing with W11 23H2:

-disabling "sensor service" in services makes OOBE loop, unless also removed from "components" or setup was fully unattended
-disabling "WFDSConMgrSvc" or to be more clear [Wi-Fi Direct Services Connection Manager Service] breaks volume control near the clock
 
in my own experience, Sensor service and adjacent stuff are better disabled on a post setup script (setupcomplete.cmd), with the following commands:

sc config SensorDataService start= disabled
sc config SensrSvc start= disabled
sc config SensorService start= disabled

I also disable a few more which somehow always re-enable themselves despite being explicitly disabled through NTLite in the same script:

sc config wlidsvc start= disabled
sc config edgeupdate start= disabled
sc config edgeupdatem start= disabled
sc config SEMgrSvc start= disabled
sc config MSiSCSI start= disabled
 
just wanted to share some notes I previously recorded when I was dealing with W11 23H2:

-disabling "sensor service" in services makes OOBE loop, unless also removed from "components" or setup was fully unattended
Sensor Service is a big dependency if you have a laptop or tablet, which normally includes sensors for:
- auto-brightness​
- screen rotation​
- location (cell data)​

Just keep that in mind.
 
in my own experience, Sensor service and adjacent stuff are better disabled on a post setup script...

Would you mind sharing WHY you've found this to be a superior method?

I also disable a few more which somehow always re-enable themselves despite being explicitly disabled...

Windoze 10/11 seems to have the ability to "heal itself" which, in practice, means that even after spending many hours configuring things as you like them the OS, due to it's superior wisdom, will silently "fix" your "mistakes" for you in the background. IE: I set my Power Plan to Hi Performance and 2 weeks later found it reset to "Balanced". Reading some of the log files it was clear that M$ considered Hi Performance to be something that required correction.

When I build an ISO I use a mature version of the OS and bring it fully up to date. And once installed I never "update" it. Ever. But disabling the 4 update-related services was futile as they always got restarted somehow & I never figured out how. So (after backing them up) I deleted the 4 relevant keys from the reg which finally solved the problem.
 
Last edited:
New NTL member Ihadaface sent me a DM with info about certain services that may be involved in updating Root Certificates. (I've added it to the spreadsheet) But the DM included 2 program recommendations that i'm so impressed with that I want to pass it along.

System Informer is a freeware utility that looks a bit like Process Explorer when you first open it but it has specific tabs for Processes, Services, Network, Disk, Firewall & Devices. And the Services section seems to provide more useful info on a particular service than any other single app i've even used. For example certain services can't be disabled from any user interface because they're protected. But SI allows you to change the service's permissions from it's own UI:
SI.jpg
The 2nd on is a tiny utility - 157kb - to organize / tweak your services. It has 3 columns: Autostart, Manual & Disabled. You can change their startup status simply by D&D between columns! Import-Export xml files of services status. The writeup on the website is the only help file but it should be adequate. Looks to be very useful while you're still experimenting with your services setup. Here's a screenshot:
SS_1.jpg
If you find either of these programs useful then thank Ihadaface
 
Last edited:
glad to hear it! I've been using a system at the edge of stability for long time. So, despite getting portable pro/technician licenses, I've been having endless issues with repeated requests for re-activation and repeated failures (ntlite and others). Was Nuhi who suggested some services (and firewall rules) for certificate verification, maybe a year ago, and I'm just getting around to it. Meanwhile i think MS has made many inroads toward a goal of cloud control (means corporate control, no?) and total interdepenency of MS goals and user autonomy.

In other words, all credit to you and Nuhi. And Garlin, and Clanger, ..people who aren't selfish and whose brains work. May everyone have a nice drink and feel good about themselves.
 
Would you mind sharing WHY you've found this to be a superior method?
Hrmm, its been a while since Truly dove into Windows Tweaking, but if I recall correctly, some computers with non-standard sensors (Dell Inspiron 5378 was the one I experimented most with), had issues completing the driver install phase of setup, or sometimes failed to install the Wireless drivers is the sensor services were not installed and running (don't ask, I never found why), so I've let those services on in that particular machine, and disabled via post-setup script on others.

Windoze 10/11 seems to have the ability to "heal itself" which, in practice, means that even after spending many hours configuring things as you like them the OS, due to it's superior wisdom, will silently "fix" your "mistakes" for you in the background. IE: I set my Power Plan to Hi Performance and 2 weeks later found it reset to "Balanced". Reading some of the log files it was clear that M$ considered Hi Performance to be something that required correction.
I guess I wasn't clear on this: If I disable them through NTLite they re-enable themselves on OOBE, so I disable them AGAIN through post-OOBE script, and they stick. Being a simple SMD script also means you could theoretically have it running every boot too, just to be safe.
 
Would you mind sharing WHY you've found this to be a superior method?



Windoze 10/11 seems to have the ability to "heal itself" which, in practice, means that even after spending many hours configuring things as you like them the OS, due to it's superior wisdom, will silently "fix" your "mistakes" for you in the background. IE: I set my Power Plan to Hi Performance and 2 weeks later found it reset to "Balanced". Reading some of the log files it was clear that M$ considered Hi Performance to be something that required correction.

When I build an ISO I use a mature version of the OS and bring it fully up to date. And once installed I never "update" it. Ever. But disabling the 4 update-related services was futile as they always got restarted somehow & I never figured out how. So (after backing them up) I deleted the 4 relevant keys from the reg which finally solved the problem.
I am a Barney Rubble Style Administrator: To Stop the, "Snitch" --->Event log from triggering a report to MS, I put a dummy file named as the offending file; where Ms expects it. Cmd or any benign .exe file. The -->Event Log sees the execution and Ignores what actually happens. "Offending-File.exebad "works, as I have the Event Log: OFF. Win 7 Os.
 
I created a post asking if it would be possible to get information like notes about NTlite components and I didn't get an answer. So I used OCR in Windows 11 Photos app and created my table with all the information that exists in "Components" in its latest version, 2025.5.10428. I didn't put Drivers and Fonts in the table.Hope this helps someone...
 

Attachments

Back
Top