Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Alerter]
"Description"="Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service usually is not required under normal circumstances. Note: This is NOT 'WinPopUp.'"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG]
"Description"="Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Internet Connection Firewall. BlackViper.com adds this: This service is required if using Internet Connection Sharing / Internet Connection Firewall to connect to the internet. This service uses about 1.5 MB of memory in an idle state."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt]
"Description"="Provides software installation services such as Assign, Publish, and Remove. BlackViper.com adds this: If you cannot modify your software installation of certain applications, put this service in to Automatic or Manual."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv]
"Description"="Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is required if you wish to hear any audio at all. If your computer does not have a sound card, disable this service."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
"Description"="Uses idle network bandwidth to transfer data. BlackViper.com adds this: This service is used to transfer asynchronous data via http1.1 servers. According to Microsoft's site, Windows Update uses this feature. It continues a download if you log off or shutdown the system (that is, when you log back in). The problem with that is, I do not like having this feature running all of the time. Even though I have found no side effects as to this being disabled, you may require this service for some MSN Explorer, Windows Messenger, Windows Media Player or future .NET functions. Take note: Manual (and Automatic) updates via Windows Update Version 5 web site requires Cryptographic Services, Background Intelligent Transfer Service, and Event Log to be running. Place All three in to automatic if you do not wish to update manually."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser]
"Description"="Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is not required on a standalone system. In fact, even if you want to browse the network (workgroup or domain) or have mapped network shares as local hard drives, you can still do so. On a large network, one computer is designated the 'master' browser and another one is the 'backup' browser. All others just announce they are available every 12 minutes to take over duties if one of the other computers fail. No lag time is discernable if this service remains disabled on all but one computer. Honestly, I do not even believe one needs to be running. You could, just in case, but it sure does not need to be running on all computers, all of the time."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cisvc]
"Description"="Indexes contents and properties of files on local and remote computers; provides rapid access to files through flexible querying language. BlackViper.com adds this: This service always has been a major resource hog. I NEVER recommend having this service enabled. Remove the function via the 'Add / Remove Programs' icon in the control panel (Windows Setup Programs). It uses about 500 K to 2 MB in an idle state, not to mention the amount of memory and CPU resources it takes to INDEX the drives. I have had people (and witnessed it on other people's computers) report to me that the Indexing Service sometimes starts up EVEN while the system is NOT idle... as in the middle of a game. You may feel, as I do, that this is unacceptable. If your computer suddenly seems 'sluggish,' Indexing Service is usually the cause of it."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv]
"Description"="Enables ClipBook Viewer to store information and share it with remote computers. If the service is stopped, ClipBook Viewer will not be able to share information with remote computers. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Used to store information (cut/paste) and share it with other computers. I have never found enough need for this to allow this service to always be running. This service alone uses about 1.3 MB of memory."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp]
"Description"="Manages the configuration and tracking of Component Object Model (COM)+ based components. If the service is stopped, most COM+ based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: You will receive, in the Event Log, an entry from 'DCOM' complaining about not having this service running if disabled. I am unaware of any application that uses COM+, but if set to manual, many services report to it, so it will start anyway. For the fun of it, go to Program Files, ComPlus Applications, on your system, see if you have any installed COM+ Applications. If not, you can probably disable this service with no side effects (besides the Event Log complaining upon reboots). This service is required for System Event Notification."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc]
"Description"="Provides three management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Mainly, it confirms signatures of Windows files. You may always get a dialog box complaining about uncertified drivers if this is disabled. This service is required for Windows Update to function in manual and automatic mode and this service is required to install Service Pack 1 unified updates and DirectX 9.0. Windows Media Player and future .NET applications may also require this service for some features to function. This service uses about 1.9 MB of memory."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp]
"Description"="Manages network configuration by registering and updating IP addresses and DNS names. BlackViper.com adds this: This service automatically receives a Dynamic IP address from your DHCP server and DNS updates. Required for ICS - internet client and if you run IPSEC, disable on a standalone system or one that has a static IP address. Take note: Most DSL or cable ISP's use DHCP to provide internet access. If you disable this service and your Internet connection no longer works, place this back into automatic. Most DSL and cable hardware routers have the option of enabling a DHCP server for the internal network. Ensure that the router is configured the same as your local PC's."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmadmin]
"Description"="Configures hard disk drives and volumes. The service only runs for configuration processes and then stops. BlackViper.com adds this: This service is vital to run the Disk Management MMC console for dynamic volumes."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver]
"Description"="Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. If this service is stopped, dynamic disk status and configuration information may become out of date. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is vital to run the Disk Management MMC console for dynamic volumes. If you attempt to 'Manage' your hard drives and a dialog box pops up complaining about not being able to do this, start this service."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache]
"Description"="Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Resolves and caches DNS names and Active Directory domain controller functions. This service is not required for DNS lookups, but if it makes you happy to have it running, you may. However, DNS Client is required if using IPSEC. If you attempt to 'repair' your network connection and a dialog box complains that the 'DNS resolver failed to flush the cache,' this service is the reason."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc]
"Description"="Allows error reporting for services and applictions running in non-standard environments. BlackViper.com adds this: Calls home to Microsoft when application errors occur. I personally do not like this. I feel it is a waste of memory and resources. On the other hand, if you are experiencing system crashes often, the best way to deal with them is to report them using this tool."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog]
"Description"="Enables event log messages issued by Windows-based programs and components to be viewed in Event Viewer. This service cannot be stopped. BlackViper.com adds this: Always helpful to check out the Event Log to see what problems with applications are popping up that is hidden from the normal user. To see quickly what, if anything has resulted in your adjustments, you may consider clearing the Event Log. Windows Management Instrumentation also requires Event Log Service to be running. If you disable the Event Log Service, but do not disable Windows Management Instrumentation, your computer may have an extended boot time while Windows Management Instrumentation is waiting for the Event Log to start. It is just best to keep Event Log active for troubleshooting purposes and normal operations. Take note: Manual (and Automatic) updates via Windows Update Version 5 web site requires Cryptographic Services, Background Intelligent Transfer Service, and Event Log to be running. Place All three in to automatic if you do not wish to update manually."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem]
"Description"="Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. BlackViper.com adds this: You will receive, in the Event Log, an entry from DCOM complaining about not having this service running if disabled. I am unaware of any application that uses COM+, but if set to manual, many services report to it, so it will start anyway. This service is required for System Event Notification. For the fun of it, go to: Program Files, ComPlus Applications, on your system, see if you have any installed COM+ Applications. If not, you can probably disable this service with no side effects (besides the Event Log complaining upon reboots). Take note: BootVis requires Task Scheduler and COM+ Event System to be running if you wish to take advantage of the optimize system function. I recommend disabled for Super Tweaking, automatic for safe, and manual for most other configurations."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FastUserSwitchingCompatibility]
"Description"="Provides management for applications that require assistance in a multiple user environment. BlackViper.com adds this: Unless you have many users on a system, you probably do not even need this service to be running. You could benefit greatly, however, if you use this service in conjunction with many users on your local computer to allow switching users without closing all existing applications running under a different account."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc]
"Description"="Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is required for Microsoft’s online (or offline) help documents. If you ever attempt to use Help and Support, the service places itself back into Automatic and starts even if you already had this service on disabled. I try to avoid as much Microsoft help as I can. :)"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ]
"Description"="Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: You may not have any peripherals that require this service. If one of yours magically does not function anymore, set it to automatic. Namely, scanners with function buttons (fax, copy) or even an Internet keyboard with volume or play controls."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ImapiService]
"Description"="Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this service is stopped, this computer will be unable to record CDs. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service operates that cool 'drag and drop' CD burn capability. You will need this service to burn CD's. What is the good news? If you set this service to manual, the service starts and stops itself when used with some software packages. This is practically the only service that does do this! If you still cannot burn a CD with it on manual, switch to automatic and feel safe that it starts only when needed. This service may take up about 1.6 MB of memory in an idle state."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver]
"Description"="Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Used for file and print sharing from your computer or Message Queuing. For security purposes, you may disable this service if you do not require local printers and files shared across your network. Connectivity, however, still exists even on incoming shared network drives. Workstation needs to be running to connect to another computer that has the files you are looking for. Note: If you disable File and Print sharing, the Server Service may disappear from the Services listing. Just enable File and Print sharing again and the Server Service will return."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation]
"Description"="Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Used to connect local computer to remote computers. Examples may include local network connectivity and File and Print sharing. Many services depend on Workstation to be functioning. Leave it on automatic for safe configurations."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LmHosts]
"Description"="Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. BlackViper.com adds this: This feature provides legacy support for NetBIOS over TCP/IP. If your network does not use NetBIOS and / or WINS, disable this function."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger]
"Description"="Transmits net send and Alerter service messages between clients and servers. BlackViper.com adds this: This service provides the ability to send messages between clients and servers. This service needs not to be running under normal home conditions. It is also advisable to make this service go away to avoid the possibility of 'net send' messages hitting your computer from the internet. This has nothing to do with MSN Messenger, nor is it WinPopUp. To test for this security vulnerability, at the command prompt, (run: cmd.exe) type: net send 127.0.0.1 hi. If you get a popup 'hi' message, you should disable the Messenger service. If you get an error stating, 'The message alias could not be found on the network,' you are safe. If, for whatever reason, you need the Messenger service running but wish not to have spam popups active, you can disable the particular ports at your firewall. The Messenger service uses UDP ports 135, 137, and 138; TCP ports 135, 139, and 445."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mnmsrvc]
"Description"="Enables an authorized user to access this computer remotely by using NetMeeting over a corporate intranet. If this service is stopped, remote desktop sharing will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Enables a user to access your computer using NetMeeting. This may create a BIG open door for the unwanted. If you are paranoid about security, disable this function. Even if you were not worried, I would still get rid of it."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC]
"Description"="Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is required if using Message Queuing. You may also see complaints in the Event Log if this service is disabled, but I have experienced no side effects. Microsoft's .NET may require this service in the future."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer]
"Description"="Installs, repairs and removes software according to instructions contained in .MSI files. BlackViper.com adds this: This service is required for software applications that install using MSI files. If no applications that you have will install properly or you get an error that involves 'RPC Service,' place this service in to Automatic or Manual. Only disable this service after you have completed installation of your applications, mainly Office and such. I am not aware how many Games actually use MSI Files. In an idle state, this service uses about 3.4 MB of RAM. Put it to manual to save that amount."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDE]
"Description"="Provides network transport and security for Dynamic Data Exchange (DDE) for programs running on the same computer or on different computers. If this service is stopped, DDE transport and security will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: I have not found a good use for this service. Unless you use remote ClipBook, disable it. This uses about 1.5 MB idle."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetDDEdsdm]
"Description"="Manages Dynamic Data Exchange (DDE) network shares. If this service is stopped, DDE network shares will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: I have not found a good use for this service. Unless you use remote ClipBook, disable it."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon]
"Description"="Supports pass-through authentication of account logon events for computers in a domain. BlackViper.com adds this: Used for logging onto a Domain Controller. This service is not required on a standalone system, or for a 'home' network."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman]
"Description"="Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. BlackViper.com adds this: Required for managing network connectivity. Set to disabled if you have no network or you do not toy with the configurations a lot. If your internet connectivity no longer operates after disabling this function, set it back to Automatic! Note: While disabling this service, you will no longer see the system tray icon (lower right) displayed, even for modem connections. Connectivity, however, still exists even on incoming shared network drives."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla]
"Description"="Collects and stores network configuration and location information, and notifies applications when this information changes. BlackViper.com adds this: This service is required for use with the Internet Connection Sharing service (server only)."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtLmSsp]
"Description"="Provides security to remote procedure call (RPC) programs that use transports other than named pipes. BlackViper.com adds this: Manages local system security information on the computer. You need this service if you are running Message Queuing or Telnet server."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc]
"Description"="BlackViper.com adds this: Used for managing removable media. Disable this service if you do not have items like tape backup devices, etc. If your CD ROM / DVD drive starts acting funny, (no auto play, etc) place this service into automatic. Normally, this service does not need to be running and you will not miss any of its functionality."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay]
"Description"="Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. BlackViper.com adds this: This service is the heart and soul of the Plug and Play environment. I do not recommend disabling this service, but if you want to, you are on your own. Take note: UPnP is NOT PnP. UPnP is for connectivity on networks via TCP/IP to devices, such as scanners or printers. Your sound card is PnP. Do NOT disable Plug and Play service."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]
"Description"="Manages IP security policy and starts the ISAKMP/Oakley (IKE) and the IP security driver. BlackViper.com adds this: May be required on some domains or VPN connections, but the average user will not need this."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage]
"Description"="Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. BlackViper.com adds this: Allows for the saving of local passwords or even web sites information (AutoComplete). This service is set to Automatic by default. Due to security reasons, I recommend leaving this feature disabled to make things all that much more difficult to steal vital information if you do not save it. On the other hand, you may need this service to manage private keys for encryption purposes. If so, leave this service on automatic to ensure the higher security settings you choose work. If you disable this service, you will no longer have any of your passwords saved, no matter how many times you click the box. If you enjoy having your passwords saved in applications like Outlook or Dial up networking or you are connecting to the internet via a domain controller/server that requires authentication, set this service to Automatic."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto]
"Description"="Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. BlackViper.com adds this: Creates a connection to a network when a program requests a remote address. This service may be required for your internet connection. If things cease to function after disabling this service, put it to automatic. Note: you may require this service for some direct cable or DSL providers and connections, depending on how they implement their logon process. If your Dial-up, cable or DSL internet access no longer functions properly with this service disabled, place this service into automatic. If you use a hardware gateway or router, this service is not required."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan]
"Description"="Creates a network connection. BlackViper.com adds this: This service is required if you use Internet Connection Sharing. If things cease to function after disabling this service, put it to automatic. Note: you may require this service for some direct cable or DSL providers and connections, depending on how they implement their logon process. If your Dial-up, cable or DSL internet access no longer functions properly with this service disabled, place this service into automatic. If you use a hardware gateway or router, this service is not required."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDSessMgr]
"Description"="Manages and controls Remote Assistance. If this service is stopped, Remote Assistance will be unavailable. Before stopping this service, see the Dependencies tab of the Properties dialog box. BlackViper.com adds this: If you do not want or need to use this feature, disable it. In an idle state, this service sucks up 3.4 MB to 4 MB of RAM."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess]
"Description"="Offers routing services to businesses in local area and wide area network environments. BlackViper.com adds this: Allows computers to dial in to the local computer through a modem (or other devices) to access the local network using a standard or VPN connection. Unless you require this functionality, disable it for security reasons. Upon enabling this service, Incoming Connections icon will be available in the Network Connections control panel."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry]
"Description"="Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This feature is not available on Windows XP Home. This is one of those not needed services. One of the first I disable. If you are paranoid about security, disable this service. Even if you are not or do not care, disable it anyway."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator]
"Description"="Manages the RPC name service database. BlackViper.com adds this: I have not found a reason to keep this service running. However, if something on your network breaks after you disable this service, put it back to manual. About 1.2 MB of RAM is in use with this service."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs]
"Description"="Provides the endpoint mapper and other miscellaneous RPC services. BlackViper.com adds this: This service is rather vital. Practically everything depends on this service to be running. This is also the only service that you cannot disable via the Services MMC. Previously, if you disabled this service in Windows 2000, your computer would become unbootable. What I am trying to tell you is leave this service on automatic and absolutely DO NOT disable it in msconfig. If, for whatever reason, the service became disabled and you can no longer boot your system, please read the information available on BlackViper.com for a way to fix it."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSVP]
"Description"="Provides network signaling and local traffic control setup functionality for QoS-aware programs and control applets. BlackViper.com adds this: Provides traffic control on a network using IPSEC and applications that support QoS, and have an adapter that supports it. The QoS Packet Driver installs by default on any TCP/IP connections. I recommend uninstalling it if it is not needed on your network. As far as I can tell, you also need an ACS Server (Provided with Windows 2000 Server and Advanced Server) for the QoS Packet Scheduler and Applications to request the needed bandwidth. Since my network is not straining under any load, this is rather pointless. Take note: Some people (as I did before I completed extensive research on this) reported that QoS uses 20% of your bandwidth and does not allow any activity. This is false. For more information, please view the KB article q316666 from Microsoft. Regardless, if you uninstall the packet scheduler, no bandwidth is still reserved."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs]
"Description"="Stores security information for local user accounts. BlackViper.com adds this: Like Protected Storage, it saves profile and security information for local users. This service is required for the IIS Admin Service. If you have ever used the Group Policy Editor (gpedit.msc) to modify your settings, you need to keep this service running; otherwise, your modifications will not apply. For safe configurations, place this into automatic."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardDrv]
"Description"="Enables support for legacy non-plug and play smart-card readers used by this computer. If this service is stopped, this computer will not support legacy reader. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Supports the use of a Smart Card for local or network computer authentication. If you do not have a Smart Card, you do not need this service running."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr]
"Description"="Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Supports the use of a Smart Card for local or network computer authentication. If you do not have a Smart Card, or you do not know what a Smart Card is, you do not need this service running. Save the 1.1 MB to 1.4 MB of RAM this service uses."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule]
"Description"="Enables a user to configure and schedule automated tasks on this computer. BlackViper.com adds this: I do everything manually, to avoid having this service running all the time. Some third party software may require this service to be active for automated functions, such as virus scanners, system maintenance tools, and automatic patch/driver lookups. Take note: BootVis requires Task Scheduler and COM+ Event System to be running if you wish to take advantage of the 'optimize system' function. Why may you need this service? It is due to the pre-fetching function built into Windows XP. Another Note: Pre-fetching only occurs on boot up and application start, so if you do not care about a few extra seconds of boot time, do not even bother with it and disable Task Scheduler. On some applications, the pre-fetching feature really does help. Only you can decide whether to use its functionality and if it helps in the performance of your system."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon]
"Description"="Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: I have never found a reason to keep this service running. I have always considered 'Alternate Credentials' someone other than me! Not my idea of fun. Really, though, it allows a 'limited user' account to start an application or process with higher privileges, such as the Administrator account or another user. You can also have a privileged user start an application or process with limited privileged account. If you right-click a file, the menu will display 'Run As' option. If you disable this service, that function will no longer be available."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS]
"Description"="Tracks system events such as Windows logon, network, and power events.  Notifies COM+ Event System subscribers of these events. BlackViper.com adds this: Used in conjunction with COM+ Event System, this service notifies particular services when system events, such as logon and power events occur. I doubt the average user really cares about this. I have also not seen any applications that use this. You will receive, in the Event Log, an entry complaining about not having this service running if disabled. I have yet to find a side effect, though. For a safe configuration, leave this service on automatic."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. BlackViper.com adds this: Used to allow multiple computers on your network to access the internet via only one account. This service installs on the modem computer. If you are using a third party firewall or Internet Connection Sharing software package, this service is not required."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection]
"Description"="BlackViper.com adds this: Used for the auto play of devices like memory cards, CD drives, etc. Also, set to automatic if you are experiencing problems with laptop docking stations. In 'My Computer,' you may not see your hardware (example: DVD drive) displayed as a 'DVD Drive' if this service is disabled. However, all functionality still exists. In addition, when checking the properties of an auto play device, such as a DVD drive, you will not have an auto play tab displayed or available. This service also allows the option of selecting what action you wish to take with a particular type of file. If you enjoy the auto play function of CD's and DVD's after inserting them into your drive, leave this service on automatic."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler]
"Description"="Loads files to memory for later printing. BlackViper.com adds this: This service is required if you have printers, even if they are network printers. If this does not fit your needs, disable it. You will save about 3.8 MB by making this service go away. Your printers will still be 'installed' if you disable this service, but not visible in the printers folder. After restarting Print Spooler, they will reappear and be available for use. I place this service into manual mode and only start it up when printing is required. In manual mode, the service will not automatically start at boot time."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
"Description"="Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties. BlackViper.com adds this: This service creates system snap shots or restores a point for returning to later. Every time you install a program or new driver, and on a schedule, this service creates a 'restore point' to roll back to if a problem occurs. This is the FIRST thing that I get rid of on a clean installation. A rather GOOD (and possibly the only) reason to use this feature is to roll back your OS after installing an unknown program or testing software. For example, if you use BETA software of any kind. NOTE: If you disable this service, your previous restore points will delete. If, for whatever reason, you do not want this to happen, do not disable this service. By default, System Restore Service uses a LARGE amount of disk space to store rollback points. On large hard drives, this could be well over 10 to 20 GB."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV]
"Description"="Enables discovery of UPnP devices on your home network. BlackViper.com adds this: Used in conjunction with Universal Plug and Play Device Host, it detects and configures UPnP devices on your home network. For security reasons and for the fact that I doubt that you have any of these devices, disable this service. If any EXTERNAL device does not function because of this service being disabled, place it back in to automatic. MSN Messenger uses this service in conjunction with supported UPnP devices, to provide support for networks behind a NAT firewall or router. Also, if you are experiencing difficulty connecting to multiplayer games that use DirectX(7,8,9), place this service to automatic and ensure you download all security updates. The problem that I have found with this service is that it broadcasts UDP port 1900 a lot. If you notice plenty of network activity even though nothing is happening, this serivice is sometimes the cause. Take note: Do NOT disable the Plug and Play service."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc]
"Description"="Provides image acquisition services for scanners and cameras. BlackViper.com adds this: Used for some scanners, web cams, and cameras. If, after disabling this service, your scanner or camera fails to function properly, enable this service by placing it into automatic."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SwPrv]
"Description"="Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Used in conjunction with the Volume Shadow Copy service, Microsoft Backup uses these services. You will receive, in the Event Log, an entry complaining about not having this service running if disabled. I have yet to find a side effect, though, but to avoid the messages, you can place the service in manual. Some third party hard disk ghost or imaging software may require this service to be running."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonLog]
"Description"="Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This may be a super geek tool, but I feel that the overhead associated with it is not worth the benefit. You decide."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv]
"Description"="Provides Telephony API (TAPI) support for programs that control telephony devices and IP based voice connections on the local computer and, through the LAN, on servers that are also running the service. BlackViper.com adds this: This service is required for dial-up modem connectivity. Note: you may require this service for some direct cable or DSL providers, depending on how they implement their logon process or some AOL functionality, depending on software used. If Dial-up, cable or DSL internet access no longer functions properly with this service disabled, place it into automatic. If you are connecting via a hardware router or gateway, this service is not needed."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]
"Description"="Allows multiple users to be connected interactively to a machine as well as the display of desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. BlackViper.com adds this: Allows remote login to the local computer. This service is required for Fast User Switching, Remote Desktop Server and Remote Assistance. You will not be able to view who is logged on to a particular computer by viewing the 'user' tab located in the Task Manager if this service is disabled. For security reasons, disable this unless you specifically require its functionality. For some reason, start this service to install Norton 2003."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes]
"Description"="Provides user experience theme management. BlackViper.com adds this: Used to display all those new XP themes and colors on your desktop. If memory conscious and does not care about the new XP look, disable this service to save RAM. I have observed between 4 MB to 12 MB of RAM used for the new themes."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr]
"Description"="Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is not available on Windows XP Home. It allows remote login to the local computer via the telnet function. For security reasons, disable this unless you specifically require its functionality. You will save about 2 MB of RAM by plugging this security hole."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks]
"Description"="Maintains links between NTFS files within a computer or across computers in a network domain. BlackViper.com adds this: For example, you could make a file on Computer A. You then create a short cut or link to that file on Computer B. If you would move the file on Computer A to a different location, this service would tell Computer B to update its information to allow uninterrupted connectivity. Even though this is rather valuable on a large network, I have not found a use for this service on a home network. It uses about 3.5 MB to 4 MB in an idle state."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uploadmgr]
"Description"="Manages synchronous and asynchronous file transfers between clients and servers on the network. If this service is stopped, synchronous and asynchronous file transfers between clients and servers on the network will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service sends driver information to Microsoft to track availability of driver information. This service is not required for basic File and Print sharing. I have yet to find a need for this service, nor do I wish to send my hardware information to Microsoft."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost]
"Description"="Provides support to host Universal Plug and Play devices. BlackViper.com adds this: Used in conjunction with SSDP Discovery Service, it detects and configures UPnP devices on your home network. For security reasons and for the fact that I doubt that you have any of these devices, disable this service. If any EXTERNAL device does not function because of this service being disabled, place it back in to automatic. MSN Messenger uses this service in conjunction with supported UPnP devices, to provide support for networks behind a NAT firewall or router. Also, if you are experiencing difficulty connecting to multiplayer games that use DirectX(7,8,9), place this service to automatic and ensure you download all security updates. Furthermore, if you use Internet Connection Sharing and wish to make use of the 'allow others to modify this connection' feature, enable UPnP. Take note: UPnP is NOT PnP. Your sound card is PnP. Do NOT disable Plug and Play service."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS]
"Description"="Manages an uninterruptible power supply (UPS) connected to the computer. BlackViper.com adds this: I have not found a need for this. My UPS that connects via USB does NOT need this service to run. However, some APC UPS install a totally different service for communication. Windows Update also has a patch for the UPS service. Some UPS connected via serial port may require this service to be running."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS]
"Description"="Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Used in conjunction with the MS Software Shadow Copy Provider service. Microsoft Backup also uses these services. You will receive, in the Event Log, an entry complaining about not having this service running if disabled. I have yet to find a side effect, though. If you do not like the errors, place it in manual. By taking it out of automatic, you will save about 3.0 MB of memory."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]
"Description"="Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: Automatically sets your clock by contacting a server (Microsoft’s server by default) on the internet. Great idea if your network connects to the internet 24/7. The Event Log fills up with 'cannot find server' messages on a non-dedicated setup, though. After successful synchronizing, this service will not attempt to do it again for 7 days, meanwhile, taking up resources. You may choose to set your clock manually on a dial up connection, but with a 24/7 broadband setup, this could keep you on time for work. Note: as mentioned, 'time.windows.com' is the default server for synchronization. For those privacy conscious people that prefer to connect to a government site rather then MS, use 'time.nist.gov.'"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient]
"Description"="Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: I have not found a reason to have this service running. I have a hunch that this is going to be required for Microsoft's '.Net Software as a service.' For security reasons, I recommend for this service to be disabled. If some MS products, such as MSN Explorer, Media Player, NetMeeting or Messenger fail to provide a particular function, try to enable this service to see if it is required for your configuration."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt]
"Description"="Provides a common interface and object model to access management information about operating system, devices, applications and services. If this service is stopped, most Windows-based software will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start. BlackViper.com adds this: This service is required if you want to see the Dependencies tab in service configuration and you want everything to go smoothly. I do not recommend disabling this service as strange things may start to happen."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSp]
"Description"="Retrieves the serial number of any portable music player connected to your computer. BlackViper.com adds this: I have not really found a good reason to keep this service always running. I am not aware of anything that actually requires it. Disable it unless something of yours ceases to function properly, such as Windows Media Player, Microsoft's integration with Digital Rights Management and copy protection."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wmi]
"Description"="Provides systems management information to and from drivers. BlackViper.com adds this: This feature is not available on Windows XP Home. This service is not as vital as Windows Management Instrumentation, but I recommend leaving this service in manual."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrv]
"Description"="Provides performance library information from WMI HiPerf providers. BlackViper.com adds this: I have not found a use for this service. Save the 2.5 MB to 6 MB of memory, this service consumes."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
"Description"="Enables the download and installation of critical Windows updates. BlackViper.com adds this: After the installation of Service Pack 1, you may configure how often updates are checked. Using default values, Windows XP automatically downloads the updates and asks to install them. A few reasons why you may think this is unacceptable in your situation: 1) You could have a dial-up connection. 2) You may also: a) Wish to know what, when and how an update installs BEFORE using any bandwidth. b) Want to read about the update BEFORE downloading. c) Want to know WHY you need it and WHAT it fixes. It is very important that if you decide to disable this service, you check the Windows Update site often to ensure the latest patches install properly. Take note: Manual (and Automatic) updates via Windows Update Version 5 web site requires Cryptographic Services, Background Intelligent Transfer Service, and Event Log to be running. Place All three in to automatic if you do not wish to update manually."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC]
"Description"="Provides automatic configuration for the 802.11 adapters. BlackViper.com adds this: Provides automatic configuration for wireless network devices and connection quality feedback. If you do not have any wireless network devices in use on the local system, disable this service. You may require this service for connectivity with some hot sync software for a PDA, laptop or other portable computer."