Windows Vista Services Tweak Guide v1.0

This guide is only recommended for power users. Inexperienced Windows users should NOT use this. It's also recommended that you have in-depth knowledge about network security. The guide is meant to be used with Windows Vista RTM build 6000.

Beware: Disabling some of the services below may have a negative impact on your system/network security. I take no responsibility what so ever of any negative consequences these tweaks may have on your system, hardware or life. Use on your own risk.

Disable the following services to improve performance and decrease RAM usage:

Base Filtering Engine
Disable if you don't use the Windows Firewall

Diagnostic Policy Service

Distributed Link Tracking Client

Function Discovery Provider Host

Function Discovery Resource Publication

Human Interface Device Access
Disable if you don't use/need hotkeys on your keyboard.

IKE and AuthIP IPSec Keying Modules
Disable to improve network performance and decrease RAM usage.
Disabling will have a negative impact on network security.

Internet Connection Sharing
Disable if you don't need to share your internet connection.

IP Helper
Disable to improve network performance and decrease RAM usage.
Will also disable IPv6 connectivity over IPv4. Might be useful in the future.

IPSec Policy Agent
Disable to improve network performance and decrease RAM usage.
Disabling will have a negative impact on network security.

KtmRm for Distributed Transaction Coordinator
Disable if you don't use MSDTC and/or KTM.

Messenger Sharing Folders USN Journal Reader service
This service is only available if Messenger Live is installed.
Disable if you don't use Messenger Live's sharing folders.

Microsoft Software Shadow Copy Provider
Disable if you don't use MS Shadow Copy.
Disabling will have a negative impact on system redundancy.

Net.Tcp Port Sharing Service
Disable if you don't use the Net.Tcp protocol (from .NET framework).
Disabling will make .NET applications using this protocol not to function properly.

Network List Service
Disable if you aren't connected to a LAN with multiple computers or if you don't share files or printers through your LAN.

Network Location Awareness
Disable if you aren't connected to a LAN with multiple computers or if you don't share files or printers through your LAN.

Offline Files
Disable if you only use local profiles and aren't connected to a domain.

Portable Device Enumerator Service
Disable if you don't need to syncronize data with removable storage (such as mp3 players. This will not affect third party applications such as iTunes, only applications using this service, e.g. Windows Media Player).

Program Compatibility Assistant Service
Disable if you don't care about compatibility issues. (Running applications in compatibility mode will still function.)

ReadyBoost
Disable if you don't use this feature.

Remote Access Connection Manager
Disable if you don't use dial-up connections and/or VPN-networks.

Routing and Remote Access
Disable if you don't need to route network data within a LAN or WAN.

Secondary Logon
Disable if you don't need to login two users at once.

Security Center
Disable if you can take care of the system security manually.

Server
Disable if you don't share files and/or printers through LAN.

Shell Hardware Detection
Disable to remove autoplay functionality on removable media.

SL UI Notification Service
Disable. You can manually run this if it's needed for activation or other software licensing issues.

Tablet PC Input Service
Disable if you don't have a Tablet PC.

TCP/IP NetBIOS Helper
Disable. Totally useless if you don't use NetBIOS (NetBT).

Telephony
Disable if you don't use dial-up connections.

Terminal Services
Disable if you don't use Remote Desktop.
Disabling will improve system security.

UPnP Device Host
Disable if you don't need to host UPnP devices.

WebClient

Windows Defender
Disable if you don't want to use it. Though, consider using third party anti-malware application if you disable it.

Windows Error Reporting Service
Disable if you don't use error reporting.

Windows Firewall
Disable if you don't use the Windows Firewall. Though, consider using third party firewall (hardware, software or router w/ firewall).

Windows Image Aquisition (WIA)
Disable if you don't use a scanner and/or digital cameras.

Windows Media Center Extender Service
Disable if you don't use Media Center extensions.

Windows Search
Disable if you don't want to use the advanced windows search feature with indexing (Normal search will still function, but is alot slower).

Windows Time
Disable if you don't want the clock to syncronize automatically. Waste of resources. Update clock manually.

WinHTTP WebProxy Auto-Discovery Service
Disable if you don't use applications which use the WPAD protocol (most applications don't). Manually enable if you need it.

Virtual Disk
Set as manual if you don't use Disk Management in the Computer Management console.
You can manually start this service at any time if you need to use Disk Management.

Volume Shadow Copy
Disable if you don't use MS Shadow Copy.
Disabling will have a negative impact on system redundancy.

If you don't use the Aero theme disable the following services:

Application Experience

Desktop Window Manager Session Manager

If you don't use themes at all, disable the following services:

Application Experience

Desktop Window Manager Session Manager

Windows Themes

Ok, that's all so far. If you have anything to add, just post a reply!
Constructive feedback and criticism is also welcome.

Request to be pinned!

This post has been edited by Menion: Nov 25 2006, 06:07 PM

My own personal views, opinions, and experiences with, some of these are:

Diagnostic Policy Service (part of the performance tuning foundation for Vista don't disable but you can set to manual)

Base Filtering Engine (not just for the firewall, it doesn't hurt to have it enabled. If you want to disable the firewall then do it in the GUI. Actually, once you get the hang of the Vista firewall its pretty neat and useful - its just hard to configure until you get used to it.)

IKE and AuthIP IPSec Keying Modules (disabling these doesn't do squat for improving network performance and decreasing RAM usage - another windows urban myth is born. However, if your on systems that use these things they are necessary. If your not on systems that use them they don't do anything at all and there is no impact on performance)

Human Interface Device Access (don't disable if you dont use accessability features. It doesn;t imapct anything at all if you haven;t set up any accessability features.)

IP Helper (disable IPv6 in the connection if you need to but don't disable this service)

Net.Tcp Port Sharing Service (if you disable this, parts of browsers and mail clients may not work correctly)

ReadyBoost (no need to disable, does not impact performance and only works if you have the right device to use eg...USB key. Set to manual instead)

SL UI Notification Service (i'd leave this set to automatic. Aside from the visible activation there is also the not so visible validation requirements)

Tablet PC Input Service (yeah, if you don't have a tablet PC then disable, but if you want to use some of the tablet PC stuff on your PC like the snipping tool for example then don't disable)

UPnP Device Host (yep, disable. However, if your going to use MCE then this might need to work.)

Volume Shadow Copy (I wouldn't disable it)

Virtual Disk (personally, i'd leave it to automatic, it does more than just interface with the management console, but it also doesn't hurt to have it set to manual)

Application Experience (not just for themes but it sure seems like it - doesn't hurt to have automatic)

Desktop Window Manager Session Manager (not just for themes but it sure seems like it - doesn't hurt to have automatic)

Personally though, all together, I wouldn't disable any service at all. They are there for a reason, and should be left alone. If they are causing such a big impact on your computers performance then there are probably areas of your computer you should tune up or beef up in some way like adding memory for example which will be of more benefit then disabling a service to compensate for the very little these services occupy.

This post has been edited by Spooky: Nov 25 2006, 06:53 PM

Leave the services alone people. They're there for a reason.

I've followed the guide myself, and my computer run so much better. I decreased RAM usage from about 480 to 330 after fresh startup. And that's noticeable. That's only from disabling services btw.



Yikes. Against any tweaking at all?

Well. ALOT of the services in Vista and XP aren't even used by us mortals, so why should they be enabled per default?

I don't want to waste resources on stuff I don't use and never will. And that's pretty understandable, isn't it?

Tweaking services is the same as overclocking. There's a risk, but it's worth the performance gain.

This post has been edited by Menion: Nov 26 2006, 02:50 AM

ive tweaked my other machine (xp) which is only for music making to work with only in 9-10 services... so you say that i should restore them just because they are there for reason?

Just ignore him he's been like that in the XP forum too

Getting back on-topic, I'd like to see some screenshots of the task manager showing how many processes are running and how much RAM it's all using. I heard stock was ~70 processes?

thanks a lot guys

I'd already disabled all the obvious ones that pretty much carried over from XP, but the list is quite helpful

Has Nuhi already got this info? I presume so

Warranty's are there for a reason.. doesn't stop me poking around with my hardware
I tweak, therefore I am

Everyone has replied to this comment up to now so I might as well too...

"They're there for a reason."

Yeah to be turned off because they use RAM.

I did a bit of an experiment - exported the whole Services hive, replaced
"Start"=dword:00000002 with "Start"=dword:00000003 and you
know what... it actually didn't make much difference in the RAM usage at all,
but there were a few errors here and there though.

In VMware with Vista you can power it off and adjust the RAM down
to 224Mb (no less) then boot it up again and it uses less than 150Mb
RAM. Sounds impossible, sounds like a joke, but its true... if you have
VMware and Vista, try it. It runs pretty smooth on 224Mb RAM too!

This post has been edited by LeveL: Nov 26 2006, 04:24 AM

"480 to 330"

Considering that with all of the default services running they only take up, at the most, 50 MB or less of memory. Where did the other 100 MB go?




This post has been edited by Spooky: Nov 26 2006, 07:27 AM

Guys, I gota go with Spooky and Tarun on this. Yes disabling "things" will help performance on some low-resource machines but it needs to be done far more surgically and with a much greater understanding of how the services interact and what they actually do.

Consider, the above mentioned (as useless) Windows Time Service which keeps your computers clock synchronized with a predetermined time server. Is that really useless? Not if your on a domain. If your system clock skews more that 5min (by default) from the servers clock, you will be locked-out of Everything including LocalMachine!

Disabling the IKE service will (most likely) go unnoticed right up until you try to connect to a VPN (yes that even includes a 3rd party VPN Client) the connection will quite transparently fail ... leaving you on the phone with Tech Support for about 100yrs trying to figure out why.

Etc. etc. etc...

Your machine would have to have a horridly inaccurate clock for it to drift that far off, or it's time to replace the CMOS battery.

Even the cheapest quartz watches gain or lose an average of 0.5s per day. Assuming that the skew is always in one direction (highly inconcievable), to lose or gain 5 minutes would take 600 days. In practice the skew reverses direction frequently and never in one direction for more than 600 days, so the CMOS battery would probably need replacement long before the time drifts far enough to become a problem.

This guide wasn't meant for you tweak services haters...

As I clearly stated, you do it on your own risk. I gained a lot of performance and decreased Vista's RAM usage considerably, so what's wrong is wanting to share that experience and knowledge with the rest of the community?

Come on. Get a room!

Seems to me that you have to be a corporate user for these services .

You said in your original post: "Constructive feedback and criticism is also welcome"

So...thats what you got. No one hates tweaking services, but in line with your own post people offered their comments as well. Theres nothing wrong with what you shared, anyone thats willing to share information to help others isn't doing anything wrong. Anything posted on the internet will at some point or another be commented upon in ways the original poster may not have expected. I'm sure someone will put the information you posted to good use.




I don't think he's talking about individual client computers. I think he's talking about networks where all systems need to be sync'd together for time.

no comment.



I'll stick to my own guns thanks.....

64 services running on a stock install of Vista RTM (32 bit version) by counting those that are listed as "Started" in services.msc

After installing some Logitech mouse software and Firefox, a glance at the Task Manager shows 37 processes running (13 svchost.exe's) - but clicking on the Services tab shows many more than that (approximately 63 with a PID (presumed to be started) and a whole boat load more without PID's). Presumably the excess are running under the svchost.exe instances.

Here's the list of services that I had on my Vista RTM install when it first started - along with my choices about what should and should not me modified. A lot of this is based on previous experiences and may not apply in your situation. Finally, some of it is just a SWAG (scientific wild-a**ed guess) - so take it with a grain of salt.

My thoughts are that, when it doubt, you should set a service to Manual rather than Disabling it - this way you can go back and see if it's being called on as time progresses. If it isn't needed in a week or two, then chances are that you won't need it - so it should be safe to Disable then.

Regardless, take the time to export a list of the services as they sit on your system and save them to a text file - it's a good resource for resetting them if needs be. PM me for the Excel version of this if you'd like (it includes the comments from earlier in this thread).

Here's what I've gotten:

Application Experience - Disable if you don't use Aero or themes

Application Information - Manual - needed to install legacy software as an admin

Application Layer Gateway Service - Manual

Application Management - Manual

Background Intelligent Transfer Service - Auto

Base Filtering Engine - ? Manual

Block Level Backup Engine Service - Manual

Certificate Propagation - Manual

CNG Key Isolation - Manual

COM+ Event System - Auto

COM+ System Application - Manual

Computer Browser - Auto

Cryptographic Services - Auto

DCOM Server Process Launcher - Auto

Desktop Window Manager Session Manager - Disable if you don't use Aero or themes

DFS Replication - Manual

DHCP Client - Auto

Diagnostic Policy Service - ? Manual

Diagnostic Service Host - Manual

Diagnostic System Host - ? Manual

Distributed Link Tracking Client - Auto

Distributed Transaction Coordinator - Manual

DNS Client - Auto

Extensible Authentication Protocol - Manual

Fax - Disable if you don't fax

Function Discovery Provider Host - Manual

Function Discovery Resource Publication - Auto

Group Policy Client - Disable if you don't use Group Policy

Health Key and Certificate Management - Manual

Human Interface Device Access - Manual

IKE and AuthIP IPsec Keying Modules - ? Manual

Interactive Services Detection - ? Manual

Internet Connection Sharing (ICS) - Disabled by default on my system

IP Helper - ? Manual

IPsec Policy Agent - ? Manual

KtmRm for Distributed Transaction Coordinator - ? Disable

Link-Layer Topology Discovery Mapper - ? Manual

Microsoft .NET Framework NGEN v2.0.50727_X86 - Manual

Microsoft iSCSI Initiator Service - Manual

Microsoft Software Shadow Copy Provider - Disable if you don't use Volume Shadow Copy - otherwise Manual

Multimedia Class Scheduler - Disable, Manual if you need priority assigned to multimedia tasks

Net.Tcp Port Sharing Service - Disabled by default on my system

Netlogon - Manual

Network Access Protection Agent - Manual

Network Connections - Manual

Network List Service - ? Manual

Network Location Awareness - ? Manual

Network Store Interface Service - Auto

Offline Files - ? Manual

Parental Controls - Disable unless you need the Parental Controls

Peer Name Resolution Protocol - Manual

Peer Networking Grouping - Manual

Peer Networking Identity Manager - Manual

Performance Logs & Alerts - Manual

Plug and Play - Auto

PnP-X IP Bus Enumerator - Manual

PNRP Machine Name Publication Service - Manual

Portable Device Enumerator Service - ? Manual

Print Spooler - Disable if you don't have a printer

Problem Reports and Solutions Control Panel Support - Manual

Program Compatibility Assistant Service - ? Manual

Protected Storage - Disable if you're not worried about the security of your sensitive information

Quality Windows Audio Video Experience - Manual

ReadyBoost - Disable unless using ReadyBoost (gotta try this one!)

Remote Access Auto Connection Manager - ? Manual

Remote Access Connection Manager - Disable if you don't use dial-up connections and/or VPN-networks.

Remote Procedure Call (RPC) - Auto

Remote Procedure Call (RPC) Locator - Manual

Remote Registry - Manual

Routing and Remote Access - Disabled by default on my system

Secondary Logon - Disable

Security Accounts Manager - Auto

Security Center - ? Manual

Server - ? Manual

Shell Hardware Detection - Disable to remove autoplay functionality on removable media.

SL UI Notification Service - Disable. You can manually run this if it's needed for activation or other software licensing issues.

Smart Card - Manual

Smart Card Removal Policy - Manual

SNMP Trap - Manual

Software Licensing - Disable if you don't use licensed content - but be careful as it will cause some programs to run with decreased functionality. Otherwise, set it to manual

SSDP Discovery - Manual

Superfetch - Sorta like prefetch on steroids - I'd leave it on Auto

System Event Notification Service - Leave it if you want to know when an error occurs - otherwise, disable it.

Tablet PC Input Service - Disable if you don't have a Tablet PC

Task Scheduler - ? Manual

TCP/IP NetBIOS Helper - ? Manual if you don't know

Telephony - Disable if you don't use dial-up connections.

Terminal Services - Disable, reset it if you need remote functionality

Terminal Services Configuration - Manual

Terminal Services UserMode Port Redirector - Manual

Themes - Disable

Thread Ordering Server - Manual

TPM Base Services - Manual

UPnP Device Host - Disable if you don't need to host UPnP devices.

User Profile Service - Auto

Virtual Disk - Manual

Volume Shadow Copy - Manual

WebClient - Disable

Windows Audio - ? Manual

Windows Audio Endpoint Builder - ? Manual

Windows Backup - Manual

Windows CardSpace - Manual

Windows Color System - Manual

Windows Connect Now - Config Registrar - Manual

Windows Defender - Auto - use it, it's good and it's free!

Windows Driver Foundation - User-mode Driver Framework - Manual

Windows Error Reporting Service - Leave it if you want to know when an error occurs - otherwise, disable it.

Windows Event Collector - Manual

Windows Event Log - Leave it if you want to know when an error occurs - otherwise, disable it.

Windows Firewall - Disable only if using another software firewall - otherwise, leave it alone.

Windows Image Acquisition (WIA) - Manual

Windows Installer - Manual

Windows Management Instrumentation - Auto

Windows Media Center Extender Service - Disabled by default on my system

Windows Media Center Receiver Service - Manual

Windows Media Center Scheduler Service - Manual

Windows Media Center Service Launcher - ? Manual

Windows Media Player Network Sharing Service - ? Manual

Windows Modules Installer - Manual

Windows Presentation Foundation Font Cache 3.0.0.0 - ? Manual

Windows Remote Management (WS-Management) - ? Disable

Windows Search - Disable

Windows Time - Disable

Windows Update - Auto - you need the updates!

WinHTTP Web Proxy Auto-Discovery Service - Disable or Manual

Wired AutoConfig - ? Disable if you don't have wireless - otherwise Manual

WLAN AutoConfig - ? Disable if you don't have wireless - otherwise Manual

WMI Performance Adapter - Manual

Workstation- Auto

This post has been edited by usasma: Nov 30 2006, 10:18 AM

http://www.msfn.org/board/index.php?showto...6648&st=15#

I would not recommend doing this exactly like this as there are services in this key that do not show up in Computer Management Services. Check that you only do this for type 32 (dword 20), these are the actual services. This might give you a good indication of what services are needed, but some services do not start-up in manual mode by themselves when needed. If this should occur for RPC service, then you could be in trouble.

I can however confirm memory usage went down to around 330MB for me as well. This was however on a fully installed system, with Virus scan enabled in the background, so say around 300 to 310MB without AV.

Network Connections - disable if you set static IP-address and do not access network connections frequently
Software Licensing - required for control panel, personalization
Secure Accounts Manager - required for Windows Mail
User Profile Service - disable will cause login failure to you default account (auto-login)

Question:
Group Policy - disable, anyone know how as this service is protected in services as well as in the registry

My 2 cents. If a service:
1. starts at system start-up in manual mode, then I re-evaluate (maybe it is essential?) and if I still do not want it to start, then I set it to disabled.
2. does not start at system start-up in manual mode, then I leave it that way. If it starts because of some application, then it is most likely required.
3. absolutely must not start, because of security risks (like peer-to-peers services) then I always put them to disabled.

My settings...

Automatic:
- Application Experience, Desktop Window Manager Session Manager, Themes (Aero Interface)
- Multimedia Class Scheduler, Windows Audio, Windows Audio Endpoint Builder (Audio)
- DCOM Server Process Launcher, Group Pollicy Client, Multimedia Class Scheduler, Plug and Play, Remote Procedure Call (RPC), Task Scheduler, User Profile Service, Windows Event Log, Windows Management Instrumentation (mandatory)
- Program Compatibility Assistant Service (unsure)
- Protected Storage (Security, Windows Mail)
- Software Licensing (Control Panel)
- SuperFetch (Performance. Yes it uses memory, but less memory usage does not mean better performance)

Disabled (keep starting or depend on eachother):
- Background Intelligent Transfer Service, COM+ Event System, COM+ System Application, Network List Service, Network Location Awareness, SL UI Notification Service, System Event Notification Service
- DHCP Client, WinHTTP Web Proxy Auto-Discovery Service
- Function Discovery Provider Host, PnP-X IP Bus Enumerator
- Function Discovery Resource Publication
- Internet Connection Sharing (ICS), Network Connections, Remote Access Connection Manager, Routing and Remote Access, Telephony
- Net.Tcp Port Sharing Service (default?!)
- Remote Registry (security!?)
- Shell Hardware Detection
- SSDP Discovery, UPnP Device Host, Windows Media Player Network Sharing Service (security!?)

Note that all other services will be at manual, but then again I have already removed a lot of services from the Windows Vista Home Basic by use of vLite (0.8 beta)