Name Description Status Startup Type Log On As ActiveX Installer (AxInstSV) Provides User Account Control validation for the installation of ActiveX controls from the Internet and enables management of ActiveX control installation based on Group Policy settings. This service is started on demand and if disabled the installation of ActiveX controls will behave according to default browser settings. Manual Local System Agent Activation Runtime_b4dee Runtime for activating conversational agent applications Manual Local System AllJoyn Router Service Routes AllJoyn messages for the local AllJoyn clients. If this service is stopped the AllJoyn clients that do not have their own bundled routers will be unable to run. Manual (Trigger Start) Local Service AMD 3D V-Cache Performance Optimizer Service Running Automatic Local System AMD Crash Defender Service Running Automatic Local System AMD External Events Utility Running Automatic Local System AMD Provisioning Packages Service Manages AMD provisioning packages, including processor and NVMe power management. Running Automatic Local System App Readiness Gets apps ready for use the first time a user signs in to this PC and when adding new apps. Manual Local System Application Identity Determines and verifies the identity of an application. Disabling this service will prevent AppLocker from being enforced. Manual (Trigger Start) Local Service Application Information Facilitates the running of interactive applications with additional administrative privileges. If this service is stopped, users will be unable to launch applications with the additional administrative privileges they may require to perform desired user tasks. Running Manual (Trigger Start) Local System Application Layer Gateway Service Provides support for 3rd party protocol plug-ins for Internet Connection Sharing Manual Local Service AppX Deployment Service (AppXSVC) Provides infrastructure support for deploying Store applications. This service is started on demand and if disabled Store applications will not be deployed to the system, and may not function properly. Running Manual (Trigger Start) Local System Armoury Crate Download Tool Manual Local System Asus Certificate Service Running Automatic Local System ASUS Com Service ASUS Com Service Description Running Automatic Local System AsusUpdateCheck Automatic Local System Auto Time Zone Updater Automatically sets the system time zone. Disabled Local Service AVCTP service This is Audio Video Control Transport Protocol service Running Manual (Trigger Start) Local Service Background Intelligent Transfer Service Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN Explorer, will be unable to automatically download programs and other information. Manual Local System Background Tasks Infrastructure Service Windows infrastructure service that controls which background tasks can run on the system. Running Automatic Local System Base Filtering Engine The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications. Running Automatic Local Service Battle.net Update Helper Svc Manual Local System BitLocker Drive Encryption Service BDESVC hosts the BitLocker Drive Encryption service. BitLocker Drive Encryption provides secure startup for the operating system, as well as full volume encryption for OS, fixed or removable volumes. This service allows BitLocker to prompt users for various actions related to their volumes when mounted, and unlocks volumes automatically without user interaction. Additionally, it stores recovery information to Active Directory, if available, and, if necessary, ensures the most recent recovery certificates are used. Stopping or disabling the service would prevent users from leveraging this functionality. Manual (Trigger Start) Local System Block Level Backup Engine Service The WBENGINE service is used by Windows Backup to perform backup and recovery operations. If this service is stopped by a user, it may cause the currently running backup or recovery operation to fail. Disabling this service may disable backup and recovery operations using Windows Backup on this computer. Manual Local System Bluetooth Audio Gateway Service Service supporting the audio gateway role of the Bluetooth Handsfree Profile. Running Manual (Trigger Start) Local Service Bluetooth Support Service The Bluetooth service supports discovery and association of remote Bluetooth devices. Stopping or disabling this service may cause already installed Bluetooth devices to fail to operate properly and prevent new devices from being discovered or associated. Running Manual (Trigger Start) Local Service Bluetooth User Support Service_b4dee The Bluetooth user service supports proper functionality of Bluetooth features relevant to each user session. Manual (Trigger Start) Local System Capability Access Manager Service Provides facilities for managing UWP apps access to app capabilities as well as checking an app's access to specific app capabilities Running Manual (Trigger Start) Local System CaptureService_b4dee Enables optional screen capture functionality for applications that call the Windows.Graphics.Capture API. Manual Local System Cellular Time This service sets time based on NITZ messages from a Mobile Network Manual (Trigger Start) Local Service Certificate Propagation Copies user certificates and root certificates from smart cards into the current user's certificate store, detects when a smart card is inserted into a smart card reader, and, if needed, installs the smart card Plug and Play minidriver. Manual (Trigger Start) Local System Client License Service (ClipSVC) Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled applications bought using Windows Store will not behave correctly. Running Manual (Trigger Start) Local System Clipboard User Service_b4dee This user service is used for Clipboard scenarios Running Automatic (Delayed Start) Local System Cloud Backup and Restore Service_b4dee Monitors the system for changes in application and setting states and performs cloud backup and restore operations when required. Manual Local System CNG Key Isolation The CNG key isolation service is hosted in the LSA process. The service provides key process isolation to private keys and associated cryptographic operations as required by the Common Criteria. The service stores and uses long-lived keys in a secure process complying with Common Criteria requirements. Running Manual (Trigger Start) Local System COM+ Event System Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start. Running Automatic Local Service COM+ System Application Manages the configuration and tracking of Component Object Model (COM)+-based components. If the service is stopped, most COM+-based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Manual Local System Connected Devices Platform Service This service is used for Connected Devices Platform scenarios Running Automatic (Delayed Start, Trigger Start) Local Service Connected Devices Platform User Service_b4dee This user service is used for Connected Devices Platform scenarios Running Automatic Local System Connected User Experiences and Telemetry The Connected User Experiences and Telemetry service enables features that support in-application and connected user experiences. Additionally, this service manages the event driven collection and transmission of diagnostic and usage information (used to improve the experience and quality of the Windows Platform) when the diagnostics and usage privacy option settings are enabled under Feedback and Diagnostics. Running Automatic Local System ConsentUX User Service_b4dee Allows the system to request user consent to allow apps to access sensitive resources and information such as the device's location Manual Local System Contact Data_b4dee Indexes contact data for fast contact searching. If you stop or disable this service, contacts might be missing from your search results. Running Manual Local System CoreMessaging Manages communication between system components. Running Automatic Local Service Credential Manager Provides secure storage and retrieval of credentials to users, applications and security service packages. Running Manual Local System CredentialEnrollmentManagerUserSvc_b4dee Credential Enrollment Manager Manual Local System Cryptographic Services Provides three management services: Catalog Database Service, which confirms the signatures of Windows files and allows new programs to be installed; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Automatic Root Certificate Update Service, which retrieves root certificates from Windows Update and enable scenarios such as SSL. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. Running Automatic (Trigger Start) Network Service Data Sharing Service Provides data brokering between applications. Manual (Trigger Start) Local System Data Usage Network data usage, data limit, restrict background data, metered networks. Running Automatic Local Service DCOM Server Process Launcher The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service running. Running Automatic Local System Declared Configuration(DC) service Process Declared Configuration documents recevied from MDM and other channels and perform configurations on device Manual (Trigger Start) Local System Delivery Optimization Performs content delivery optimization tasks Running Automatic (Delayed Start, Trigger Start) Network Service Device Association Service Enables pairing between the system and wired or wireless devices. Running Manual (Trigger Start) Local System Device Install Service Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. Running Manual (Trigger Start) Local System Device Management Enrollment Service Performs Device Enrollment Activities for Device Management Manual Local System Device Management Wireless Application Protocol (WAP) Push message Routing Service Routes Wireless Application Protocol (WAP) Push messages received by the device and synchronizes Device Management sessions Manual (Trigger Start) Local System Device Setup Manager Enables the detection, download and installation of device-related software. If this service is disabled, devices may be configured with outdated software, and may not work correctly. Manual (Trigger Start) Local System DeviceAssociationBroker_b4dee Enables apps to pair devices Manual Local System DevicePicker_b4dee This user service is used for managing the Miracast, DLNA, and DIAL UI Manual Local System DevicesFlow_b4dee Allows ConnectUX and PC Settings to Connect and Pair with WiFi displays and Bluetooth devices. Running Manual Local System DevQuery Background Discovery Broker Enables apps to discover devices with a backgroud task Running Manual (Trigger Start) Local System DHCP Client Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to start. Running Automatic Local Service Diagnostic Execution Service Executes diagnostic actions for troubleshooting support Manual (Trigger Start) Local System Diagnostic Policy Service The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function. Running Automatic Local Service Diagnostic Service Host The Diagnostic Service Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local Service context. If this service is stopped, any diagnostics that depend on it will no longer function. Manual Local Service Diagnostic System Host The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context. If this service is stopped, any diagnostics that depend on it will no longer function. Running Manual Local System Display Enhancement Service A service for managing display enhancement such as brightness control. Manual (Trigger Start) Local System Display Policy Service Manages the connection and configuration of local and remote displays Running Automatic Local Service Distributed Link Tracking Client Maintains links between NTFS files within a computer or across computers in a network. Running Automatic Local System Distributed Transaction Coordinator Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will fail. If this service is disabled, any services that explicitly depend on it will fail to start. Manual Network Service DNS Client The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start. Running Automatic (Trigger Start) Network Service Downloaded Maps Manager Windows service for application access to downloaded maps. This service is started on-demand by application accessing downloaded maps. Disabling this service will prevent apps from accessing maps. Automatic (Delayed Start) Network Service DtsApo4Service Running Automatic Local System Embedded Mode The Embedded Mode service enables scenarios related to Background Applications. Disabling this service will prevent Background Applications from being activated. Manual (Trigger Start) Local System Encrypting File System (EFS) Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. If this service is stopped or disabled, applications will be unable to access encrypted files. Manual (Trigger Start) Local System Enterprise App Management Service Enables enterprise application management. Manual Local System Epic Online Services Runs background processes for applications using Epic Games services Manual Local System Extensible Authentication Protocol The Extensible Authentication Protocol (EAP) service provides network authentication in such scenarios as 802.1x wired and wireless, VPN, and Network Access Protection (NAP). EAP also provides application programming interfaces (APIs) that are used by network access clients, including wireless and VPN clients, during the authentication process. If you disable this service, this computer is prevented from accessing networks that require EAP authentication. Manual Local System File History Service Protects user files from accidental loss by copying them to a backup location Manual (Trigger Start) Local System Function Discovery Provider Host The FDPHOST service hosts the Function Discovery (FD) network discovery providers. These FD providers supply network discovery services for the Simple Services Discovery Protocol (SSDP) and Web Services Discovery (WS-D) protocol. Stopping or disabling the FDPHOST service will disable network discovery for these protocols when using FD. When this service is unavailable, network services using FD and relying on these discovery protocols will be unable to find network devices or resources. Manual Local Service Function Discovery Resource Publication Publishes this computer and resources attached to this computer so they can be discovered over the network. If this service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network. Manual (Trigger Start) Local Service GameDVR and Broadcast User Service_b4dee This user service is used for Game Recordings and Live Broadcasts Running Manual Local System GameInput Service Enables keyboards, mice, gamepads, and other input devices to be used with the GameInput API. Manual (Trigger Start) Local System GameSDK Service Running Automatic Local System Gaming Services Gaming Services Running Automatic Local Service Gaming Services Gaming Services Running Automatic (Trigger Start) Local System Geolocation Service This service monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service, applications will be unable to use or receive notifications for geolocation or geofences. Running Manual (Trigger Start) Local System GraphicsPerfSvc Graphics performance monitor service Running Manual (Trigger Start) Local System Group Policy Client The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is disabled. Running Automatic (Trigger Start) Local System Human Interface Device Service Activates and maintains the use of hot buttons on keyboards, remote controls, and other multimedia devices. It is recommended that you keep this service running. Running Manual (Trigger Start) Local System HV Host Service Provides an interface for the Hyper-V hypervisor to provide per-partition performance counters to the host operating system. Running Manual (Trigger Start) Local System Hyper-V Data Exchange Service Provides a mechanism to exchange data between the virtual machine and the operating system running on the physical computer. Manual (Trigger Start) Local System Hyper-V Guest Service Interface Provides an interface for the Hyper-V host to interact with specific services running inside the virtual machine. Manual (Trigger Start) Local System Hyper-V Guest Shutdown Service Provides a mechanism to shut down the operating system of this virtual machine from the management interfaces on the physical computer. Manual (Trigger Start) Local System Hyper-V Heartbeat Service Monitors the state of this virtual machine by reporting a heartbeat at regular intervals. This service helps you identify running virtual machines that have stopped responding. Manual (Trigger Start) Local System Hyper-V PowerShell Direct Service Provides a mechanism to manage virtual machine with PowerShell via VM session without a virtual network. Manual (Trigger Start) Local System Hyper-V Remote Desktop Virtualization Service Provides a platform for communication between the virtual machine and the operating system running on the physical computer. Manual (Trigger Start) Local System Hyper-V Time Synchronization Service Synchronizes the system time of this virtual machine with the system time of the physical computer. Manual (Trigger Start) Local Service Hyper-V Volume Shadow Copy Requestor Coordinates the communications that are required to use Volume Shadow Copy Service to back up applications and data on this virtual machine from the operating system on the physical computer. Manual (Trigger Start) Local System IKE and AuthIP IPsec Keying Modules The IKEEXT service hosts the Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules. These keying modules are used for authentication and key exchange in Internet Protocol security (IPsec). Stopping or disabling the IKEEXT service will disable IKE and AuthIP key exchange with peer computers. IPsec is typically configured to use IKE or AuthIP; therefore, stopping or disabling the IKEEXT service might result in an IPsec failure and might compromise the security of the system. It is strongly recommended that you have the IKEEXT service running. Manual (Trigger Start) Local System Internet Connection Sharing (ICS) Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Manual (Trigger Start) Local System Inventory and Compatibility Appraisal service This service performs background system inventory, compatibility appraisal, and maintenance used by numerous system components. Manual Local System IP Helper Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer. Running Automatic Local System IP Translation Configuration Service Configures and enables translation from v4 to v6 and vice versa Manual (Trigger Start) Local System IPsec Policy Agent Internet Protocol security (IPsec) supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. This service enforces IPsec policies created through the IP Security Policies snap-in or the command-line tool "netsh ipsec". If you stop this service, you may experience network connectivity issues if your policy requires that connections use IPsec. Also,remote management of Windows Defender Firewall is not available when this service is stopped. Manual (Trigger Start) Network Service KtmRm for Distributed Transaction Coordinator Coordinates transactions between the Distributed Transaction Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it is recommended that this service remain stopped. If it is needed, both MSDTC and KTM will start this service automatically. If this service is disabled, any MSDTC transaction interacting with a Kernel Resource Manager will fail and any services that explicitly depend on it will fail to start. Manual (Trigger Start) Network Service Language Experience Service Provides infrastructure support for deploying and configuring localized Windows resources. This service is started on demand and, if disabled, additional Windows languages will not be deployed to the system, and Windows may not function properly. Manual Local System Link-Layer Topology Discovery Mapper Creates a Network Map, consisting of PC and device topology (connectivity) information, and metadata describing each PC and device. If this service is disabled, the Network Map will not function properly. Manual Local Service Local Profile Assistant Service This service provides profile management for subscriber identity modules Manual (Trigger Start) Local Service Local Session Manager Core Windows Service that manages local user sessions. Stopping or disabling this service will result in system instability. Running Automatic Local System McpManagementService Manual Local System MessagingService_b4dee Service supporting text messaging and related functionality. Manual (Trigger Start) Local System Microsoft (R) Diagnostics Hub Standard Collector Service Diagnostics Hub Standard Collector Service. When running, this service collects real time ETW events and processes them. Manual Local System Microsoft Account Sign-in Assistant Enables user sign-in through Microsoft account identity services. If this service is stopped, users will not be able to logon to the computer with their Microsoft account. Running Manual (Trigger Start) Local System Microsoft Defender Antivirus Network Inspection Service Helps guard against intrusion attempts targeting known and newly discovered vulnerabilities in network protocols Manual Local Service Microsoft Defender Antivirus Service Helps protect users from malware and other potentially unwanted software Manual Local System Microsoft Defender Core Service Monitors the availability, health, and performance of various security components Manual Local System Microsoft Edge Elevation Service (MicrosoftEdgeElevationService) Keeps Microsoft Edge up to update. If this service is disabled, the application will not be kept up to date. Manual Local System Microsoft Edge Update Service (edgeupdate) Keeps your Microsoft software up to date. If this service is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Microsoft software using it. Automatic (Delayed Start, Trigger Start) Local System Microsoft Edge Update Service (edgeupdatem) Keeps your Microsoft software up to date. If this service is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Microsoft software using it. Manual (Trigger Start) Local System Microsoft iSCSI Initiator Service Manages Internet SCSI (iSCSI) sessions from this computer to remote iSCSI target devices. If this service is stopped, this computer will not be able to login or access iSCSI targets. If this service is disabled, any services that explicitly depend on it will fail to start. Manual Local System Microsoft Passport Provides process isolation for cryptographic keys used to authenticate to a user s associated identity providers. If this service is disabled, all uses and management of these keys will not be available, which includes machine logon and single-sign on for apps and websites. This service starts and stops automatically. It is recommended that you do not reconfigure this service. Running Manual (Trigger Start) Local System Microsoft Passport Container Manages local user identity keys used to authenticate user to identity providers as well as TPM virtual smart cards. If this service is disabled, local user identity keys and TPM virtual smart cards will not be accessible. It is recommended that you do not reconfigure this service. Running Manual (Trigger Start) Local Service Microsoft Software Shadow Copy Provider Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. Running Manual Local System Microsoft Storage Spaces SMP Host service for the Microsoft Storage Spaces management provider. If this service is stopped or disabled, Storage Spaces cannot be managed. Running Manual Network Service Microsoft Store Install Service Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then installations will not function properly. Running Manual Local System Microsoft Update Health Service Maintains Update Health Disabled Local System Microsoft Windows SMS Router Service. Routes messages based on rules to appropriate clients. Manual (Trigger Start) Local Service