Windows Services and Startup

Looking at MSCONFIG and wondering...

Is there any free tool that will tell me what each of the items in
Services and Startup does and if it is really necessary for proper
windows operations?

Trying to speed up my Windows.
I know what my virus scanner is doing so let's skip that discussion.

WIN XP - everything starts a boot up
Win 7 - I read somewhere that stuff does not start at boot but when
needed.

Most important to me is if there is a tool about services and startups.



--- news://freenews.netfront.net/ - complaints: ---

"OldGuy" wrote in message
...

Looking at MSCONFIG and wondering...

Is there any free tool that will tell me what each of the items in
Services and Startup does and if it is really necessary for proper windows
operations?

All Windows Services are self-documenting i.e. can be reviewed at
/start / control panel / admin tools / services.

/MSCONFIG / Startup shows you all the items you have
added to the Windows Operating System. Each can each
reviewed in turn (each by its own procedures.)

For convenience, MSCONFIG lets you configure all
Services and Startup options either on or off, as well
as alter individual items. Using / System Restore you can
save to file today's boot setup, then experiment with
either all Services or all Startup options set either on or off,
and then experiment further by adding or subtracting items.
If dissatisfied with the result, / System Restore will let you
reset the system the way it formerly was.

Trying to speed up my Windows.
. . . WIN XP - everything starts a boot up
Win 7 - I read somewhere that stuff does not start at boot but when
needed.

Woody Leonard's Windows 7 for Dummies is probably a good
place to start. He advises how to unclutter Win7.
--
Don Phillipson
Carlsbad Springs
(Ottawa, Canada)

OldGuy wrote:
Looking at MSCONFIG and wondering...

Is there any free tool that will tell me what each of the items in
Services and Startup does and if it is really necessary for proper
windows operations?

Trying to speed up my Windows.
I know what my virus scanner is doing so let's skip that discussion.

WIN XP - everything starts a boot up
Win 7 - I read somewhere that stuff does not start at boot but when
needed.

Most important to me is if there is a tool about services and startups.

I don't view the problem that way.

I'm not a fan of the "Black Viper" site, because it leads
people to turn off things they later regret doing. It is a
reference source for info on Services.

Someone I helped, who "lost sound" on Windows 7, the root cause
was he had "Vipered" his Windows 7, turning off a service
which was not documented as being a dependency for Sound
to work. I got lucky, and discovered the name of the service
quite by accident, while searching for an answer.

So in general, don't go on a "slash and burn" campaign, without
some sort of plan B to rescue yourself.

*******

Both WinXP and Win7 have the same bug. It has to do with
the CPU being railed for long periods of time (on one core),
when wuauserv (wuauclt) tries to figure out what updates
you might need. If you install Win7 today, and it tries to
figure out which 200 updates need to be installed, it does
absolutely nothing for 40 minutes, tying up one core. On
some user machines, it also has peak memory consumption of 2GB.
On my Win7 setup, it has a memory peak of 800-900MB or so. So
I don't particularly need the memory patch.

When you know bugs like that exist, you focus your "services wrath"
on items like it. Not on randomly selecting things like RPC
for switch-off (which would kill your system). Remote Procedure
Calls are a dependency of just about everything.

*******

To split out a service into its own private SVVHOST, you can use
these commands.

"sc config service type= own"

To return to the normal sharing (wuauserv lives with 14 other
buddies, in a run-down SVCHOST), you do this again.

"sc config service type= share"

The purpose of splitting out a service, is so when using
Process Explorer, you see a SVCHOST with just one thing in it
is railed, then you know for sure, the single thing inside it
is "guilty". So for the Windows Update bug, as admin, you'd start
by doing this. This doesn't affect any functions, but it does
force wuauserv to live in a private SVCHOST by itself. So you
can tell "who is guilty" later.

sc config wuauserv type= own

There is a patch on Win7 to reduce the memory wuauserv
uses, but the patch does not fix the railed CPU problem.

You could also do this... If the CPU drops to zero, you've
got your culprit.

net stop wuauserv

HTH,
Paul

Name Description
..NET Runtime Optimization Service v2.0.50727_X86 Microsoft .NET
Framework NGEN
Acronis Scheduler2 Service Provides scheduling for Acronis components'
tasks.
Agere Modem Call Progress Audio
Alerter Notifies selected users and computers of administrative alerts.
If the service is stopped, programs that use administrative alerts will
not receive them. If this service is disabled, any services that
explicitly depend on it will fail to start.
Application Layer Gateway Service Provides support for 3rd party
protocol plug-ins for Internet Connection Sharing and the Windows
Firewall.
Application Management Provides software installation services such as
Assign, Publish, and Remove.
ASP.NET State Service Provides support for out-of-process session
states for ASP.NET. If this service is stopped, out-of-process requests
will not be processed. If this service is disabled, any services that
explicitly depend on it will fail to start.
Automatic Updates Enables the download and installation of Windows
updates. If this service is disabled, this computer will not be able to
use the Automatic Updates feature or the Windows Update Web site.
Avira Mail Protection Offers permanent protection against viruses and
malware for email clients with the Avira search engine.
Avira Real-Time Protection Offers permanent protection against viruses
and malware with the Avira search engine.
Avira Scheduler Service to schedule Avira Antivirus jobs and updates.
Avira Service Host Service Host for Avira
Avira Web Protection Offers permanent protection against viruses and
malware for web browsers with the Avira search engine.
Background Intelligent Transfer Service Transfers files in the
background using idle network bandwidth. If the service is stopped,
features such as Windows Update, and MSN Explorer will be unable to
automatically download programs and other information. If this service
is disabled, any services that explicitly depend on it may fail to
transfer files if they do not have a fail safe mechanism to transfer
files directly through IE in case BITS has been disabled.
Bonjour Service Enables hardware devices and software services to
automatically configure themselves on the network and advertise their
presence.
ClipBook Enables ClipBook Viewer to store information and share it with
remote computers. If the service is stopped, ClipBook Viewer will not
be able to share information with remote computers. If this service is
disabled, any services that explicitly depend on it will fail to start.
COM+ Event System Supports System Event Notification Service (SENS),
which provides automatic distribution of events to subscribing
Component Object Model (COM) components. If the service is stopped,
SENS will close and will not be able to provide logon and logoff
notifications. If this service is disabled, any services that
explicitly depend on it will fail to start.
COM+ System Application Manages the configuration and tracking of
Component Object Model (COM)+-based components. If the service is
stopped, most COM+-based components will not function properly. If this
service is disabled, any services that explicitly depend on it will
fail to start.
Computer Browser Maintains an updated list of computers on the network
and supplies this list to computers designated as browsers. If this
service is stopped, this list will not be updated or maintained. If
this service is disabled, any services that explicitly depend on it
will fail to start.
Cryptographic Services Provides three management services: Catalog
Database Service, which confirms the signatures of Windows files;
Protected Root Service, which adds and removes Trusted Root
Certification Authority certificates from this computer; and Key
Service, which helps enroll this computer for certificates. If this
service is stopped, these management services will not function
properly. If this service is disabled, any services that explicitly
depend on it will fail to start.
DCOM Server Process Launcher Provides launch functionality for DCOM
services.
DeviceFinderService
DHCP Client Manages network configuration by registering and updating
IP addresses and DNS names.
Distributed Link Tracking Client Maintains links between NTFS files
within a computer or across computers in a network domain.
DNS Client Resolves and caches Domain Name System (DNS) names for this
computer. If this service is stopped, this computer will not be able to
resolve DNS names and locate Active Directory domain controllers. If
this service is disabled, any services that explicitly depend on it
will fail to start.
EPSON V3 Service4(04)
EPSON V5 Service4(04)
EpsonBidirectionalService
Error Reporting Service Allows error reporting for services and
applictions running in non-standard environments.
Event Log Enables event log messages issued by Windows-based programs
and components to be viewed in Event Viewer. This service cannot be
stopped.
Extensible Authentication Protocol Service Provides windows clients
Extensible Authentication Protocol Service
Fast User Switching Compatibility Provides management for applications
that require assistance in a multiple user environment.
Fax Enables you to send and receive faxes, utilizing fax resources
available on this computer or on the network.
FLEXnet Licensing Service This service performs licensing functions on
behalf of FLEXnet enabled products.
Google Update Service (gupdate) Keeps your Google software up to date.
If this service is disabled or stopped, your Google software will not
be kept up to date, meaning security vulnerabilities that may arise
cannot be fixed and features may not work. This service uninstalls
itself when there is no Google software using it.
Google Update Service (gupdatem) Keeps your Google software up to date.
If this service is disabled or stopped, your Google software will not
be kept up to date, meaning security vulnerabilities that may arise
cannot be fixed and features may not work. This service uninstalls
itself when there is no Google software using it.
Health Key and Certificate Management Service Manages health
certificates and keys (used by NAP)
Help and Support Enables Help and Support Center to run on this
computer. If this service is stopped, Help and Support Center will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
HID Input Service Enables generic input access to Human Interface
Devices (HID), which activates and maintains the use of predefined hot
buttons on keyboards, remote controls, and other multimedia devices. If
this service is stopped, hot buttons controlled by this service will no
longer function. If this service is disabled, any services that
explicitly depend on it will fail to start.
HTTP SSL This service implements the secure hypertext transfer protocol
(HTTPS) for the HTTP service, using the Secure Socket Layer (SSL). If
this service is disabled, any services that explicitly depend on it
will fail to start.
IMAPI CD-Burning COM Service Manages CD recording using Image Mastering
Applications Programming Interface (IMAPI). If this service is stopped,
this computer will be unable to record CDs. If this service is
disabled, any services that explicitly depend on it will fail to start.
Imapi Helper
InCD Helper Helper service for the InCD filesystem driver
Indexing Service Indexes contents and properties of files on local and
remote computers; provides rapid access to files through flexible
querying language.
Infrared Monitor Supports infrared devices installed on the computer
and detects other devices that are in range.
Innovative Solutions Service Monitor
InstallDriver Table Manager Provides support for the Running Object
Table for InstallShield Drivers
Intel(R) PROSet/Wireless Event Log Manages the event trace messages for
all the components of Intel(R) PROSet/Wireless software.
Intel(R) PROSet/Wireless Registry Service Intel(R) PROSet/Wireless
Registry Service
Intel(R) PROSet/Wireless Service Wireless Management Service for
Intel(R) PROSet/Wireless
IPSEC Services Manages IP security policy and starts the ISAKMP/Oakley
(IKE) and the IP security driver.
Logical Disk Manager Detects and monitors new hard disk drives and
sends disk volume information to Logical Disk Manager Administrative
Service for configuration. If this service is stopped, dynamic disk
status and configuration information may become out of date. If this
service is disabled, any services that explicitly depend on it will
fail to start.
Logical Disk Manager Administrative Service Configures hard disk drives
and volumes. The service only runs for configuration processes and then
stops.
Machine Debug Manager Supports local and remote debugging for Visual
Studio and script debuggers. If this service is stopped, the debuggers
will not function properly.
Macrium Reflect Image Mounting Service Macrium Reflect Scheduling
Services
MBAMService Malwarebytes Anti-Malware service
Messenger Transmits net send and Alerter service messages between
clients and servers. This service is not related to Windows Messenger.
If this service is stopped, Alerter messages will not be transmitted.
If this service is disabled, any services that explicitly depend on it
will fail to start.
Microsoft .NET Framework NGEN v4.0.30319_X86 Microsoft .NET Framework
NGEN
Mozilla Maintenance Service The Mozilla Maintenance Service ensures
that you have the latest and most secure version of Mozilla Firefox on
your computer. Keeping Firefox up to date is very important for your
online security, and Mozilla strongly recommends that you keep this
service enabled.
MS Software Shadow Copy Provider Manages software-based volume shadow
copies taken by the Volume Shadow Copy service. If this service is
stopped, software-based volume shadow copies cannot be managed. If this
service is disabled, any services that explicitly depend on it will
fail to start.
NAS PM Service NAS Power Management Service
Nero Update Provides access to Nero application updates and manages
Nero applications.
Net Logon Supports pass-through authentication of account logon events
for computers in a domain.
Net.Tcp Port Sharing Service Provides ability to share TCP ports over
the net.tcp protocol.
NetMeeting Remote Desktop Sharing Enables an authorized user to access
this computer remotely by using NetMeeting over a corporate intranet.
If this service is stopped, remote desktop sharing will be unavailable.
If this service is disabled, any services that explicitly depend on it
will fail to start.
Network Access Protection Agent Allows windows clients to participate
in Network Access Protection
Network Connections Manages objects in the Network and Dial-Up
Connections folder, in which you can view both local area network and
remote connections.
Network DDE Provides network transport and security for Dynamic Data
Exchange (DDE) for programs running on the same computer or on
different computers. If this service is stopped, DDE transport and
security will be unavailable. If this service is disabled, any services
that explicitly depend on it will fail to start.
Network DDE DSDM Manages Dynamic Data Exchange (DDE) network shares. If
this service is stopped, DDE network shares will be unavailable. If
this service is disabled, any services that explicitly depend on it
will fail to start.
Network Location Awareness (NLA) Collects and stores network
configuration and location information, and notifies applications when
this information changes.
Network Provisioning Service Manages XML configuration files on a
domain basis for automatic network provisioning.
NMIndexingService
NovaCore SDK Service Provides support for 3rd party developers of
NovaCore applications.
NT LM Security Support Provider Provides security to remote procedure
call (RPC) programs that use transports other than named pipes.
O2Micro Flash Memory
Office Source Engine Saves installation files used for updates and
repairs and is required for the downloading of Setup updates and Watson
error reports.
Performance Logs and Alerts Collects performance data from local or
remote computers based on preconfigured schedule parameters, then
writes the data to a log or triggers an alert. If this service is
stopped, performance information will not be collected. If this service
is disabled, any services that explicitly depend on it will fail to
start.
Plug and Play Enables a computer to recognize and adapt to hardware
changes with little or no user input. Stopping or disabling this
service will result in system instability.
PMBDeviceInfoProvider Enables PlayMemories Home to communicate with the
device.
Portable Media Serial Number Service Retrieves the serial number of any
portable media player connected to this computer. If this service is
stopped, protected content might not be down loaded to the device.
Print Spooler Loads files to memory for later printing.
Protected Storage Provides protected storage for sensitive data, such
as private keys, to prevent access by unauthorized services, processes,
or users.
QoS RSVP Provides network signaling and local traffic control setup
functionality for QoS-aware programs and control applets.
Remote Access Auto Connection Manager Creates a connection to a remote
network whenever a program references a remote DNS or NetBIOS name or
address.
Remote Access Connection Manager Creates a network connection.
Remote Desktop Help Session Manager Manages and controls Remote
Assistance. If this service is stopped, Remote Assistance will be
unavailable. Before stopping this service, see the Dependencies tab of
the Properties dialog box.
Remote Packet Capture Protocol v.0 (experimental) Allows to capture
traffic on this machine from a remote machine.
Remote Procedure Call (RPC) Provides the endpoint mapper and other
miscellaneous RPC services.
Remote Procedure Call (RPC) Locator Manages the RPC name service
database.
Remote Registry Enables remote users to modify registry settings on
this computer. If this service is stopped, the registry can be modified
only by users on this computer. If this service is disabled, any
services that explicitly depend on it will fail to start.
Removable Storage
Routing and Remote Access Offers routing services to businesses in
local area and wide area network environments.
RunSwUSB
Secondary Logon Enables starting processes under alternate credentials.
If this service is stopped, this type of logon access will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
Security Accounts Manager Stores security information for local user
accounts.
Security Center Monitors system security settings and configurations.
Server Supports file, print, and named-pipe sharing over the network
for this computer. If this service is stopped, these functions will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
Shell Hardware Detection Provides notifications for AutoPlay hardware
events.
Smart Card Manages access to smart cards read by this computer. If this
service is stopped, this computer will be unable to read smart cards.
If this service is disabled, any services that explicitly depend on it
will fail to start.
Softex OmniPass Service
Sprint RcAppSvc
Spybot-S&D 2 Scanner Service Offers malware scanning services to
Spybot-S&D modules
Spybot-S&D 2 Security Center Service Integrates Spybot into the Windows
Security Center.
Spybot-S&D 2 Updating Service Downloads Spybot updates and installs
them.
SSDP Discovery Service Enables discovery of UPnP devices on your home
network.
System Event Notification Tracks system events such as Windows logon,
network, and power events. Notifies COM+ Event System subscribers of
these events.
System Restore Service Performs system restore functions. To stop
service, turn off System Restore from the System Restore tab in My
Computer-Properties
Task Scheduler Enables a user to configure and schedule automated tasks
on this computer. If this service is stopped, these tasks will not be
run at their scheduled times. If this service is disabled, any services
that explicitly depend on it will fail to start.
TCP/IP NetBIOS Helper Enables support for NetBIOS over TCP/IP (NetBT)
service and NetBIOS name resolution.
Telephony Provides Telephony API (TAPI) support for programs that
control telephony devices and IP based voice connections on the local
computer and, through the LAN, on servers that are also running the
service.
Telnet Enables a remote user to log on to this computer and run
programs, and supports various TCP/IP Telnet clients, including
UNIX-based and Windows-based computers. If this service is stopped,
remote user access to programs might be unavailable. If this service is
disabled, any services that explicitly depend on it will fail to start.
Terminal Services Allows multiple users to be connected interactively
to a machine as well as the display of desktops and applications to
remote computers. The underpinning of Remote Desktop (including RD for
Administrators), Fast User Switching, Remote Assistance, and Terminal
Server.
Themes Provides user experience theme management.
TOSHIBA Bluetooth Service
UMVPFSrv UMVPF is a user mode Logitech driver
Uninterruptible Power Supply Manages an uninterruptible power supply
(UPS) connected to the computer.
Universal Plug and Play Device Host Provides support to host Universal
Plug and Play devices.
Visual Studio Analyzer RPC bridge
Volume Shadow Copy Manages and implements Volume Shadow Copies used for
backup and other purposes. If this service is stopped, shadow copies
will be unavailable for backup and the backup may fail. If this service
is disabled, any services that explicitly depend on it will fail to
start.
WebClient Enables Windows-based programs to create, access, and modify
Internet-based files. If this service is stopped, these functions will
not be available. If this service is disabled, any services that
explicitly depend on it will fail to start.
Windows Audio Manages audio devices for Windows-based programs. If this
service is stopped, audio devices and effects will not function
properly. If this service is disabled, any services that explicitly
depend on it will fail to start.
Windows CardSpace Securely enables the creation, management, and
disclosure of digital identities.
Windows Driver Foundation - User-mode Driver Framework Manages
user-mode driver host processes
Windows Firewall/Internet Connection Sharing (ICS) Provides network
address translation, addressing, name resolution and/or intrusion
prevention services for a home or small office network.
Windows Image Acquisition (WIA) Provides image acquisition services for
scanners and cameras.
Windows Installer Adds, modifies, and removes applications provided as
a Windows Installer (*.msi) package. If this service is disabled, any
services that explicitly depend on it will fail to start.
Windows Management Instrumentation Provides a common interface and
object model to access management information about operating system,
devices, applications and services. If this service is stopped, most
Windows-based software will not function properly. If this service is
disabled, any services that explicitly depend on it will fail to start.
Windows Management Instrumentation Driver Extensions Provides systems
management information to and from drivers.
Windows Media Player Network Sharing Service Shares Windows Media
Player libraries to other networked players and media devices using
Universal Plug and Play
Windows Presentation Foundation Font Cache 3.0.0.0 Optimizes
performance of Windows Presentation Foundation (WPF) applications by
caching commonly used font data. WPF applications will start this
service if it is not already running. It can be disabled, though doing
so will degrade the performance of WPF applications.
Windows Presentation Foundation Font Cache 4.0.0.0 Optimizes
performance of Windows Presentation Foundation (WPF) applications by
caching commonly used font data. WPF applications will start this
service if it is not already running. It can be disabled, though doing
so will degrade the performance of WPF applications.
Windows Search Provides content indexing and property caching for file,
email and other content (via extensibility APIs). The service responds
to file and email notifications to index modified content. If the
service is stopped or disabled, the Explorer will not be able to
display virtual folder views of items, and search in the Explorer will
fall back to item-by-item slow search.
Windows Time Maintains date and time synchronization on all clients and
servers in the network. If this service is stopped, date and time
synchronization will be unavailable. If this service is disabled, any
services that explicitly depend on it will fail to start.

Wired AutoConfig This service performs IEEE 802.1X authentication on
Ethernet interfaces
Wireless Zero Configuration Provides automatic configuration for the
802.11 adapters
WMI Performance Adapter Provides performance library information from
WMI HiPerf providers.
Workstation Creates and maintains client network connections to remote
servers. If this service is stopped, these connections will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.

--

--
No signature

--- news://freenews.netfront.net/ - complaints: ---

Sysinternals - Process Explorer.

Left click on a column header and select
Select Columns
On the first tab shown, check
Command Line
close this

Hit space bar to stop updates.
Hover the mouse over the Process name and it will reveal what each has
under its wing.

The Command Line column will show how each line item was started.

Currently my 7 copies of
svchost.exe
that are running shows the thing it is hosting.
Some have one and others have multiple things.

--

--
No signature

--- news://freenews.netfront.net/ - complaints: ---

On Thu, 24 Sep 2015 12:47:09 -0700 "OldGuy" wrote in
article

Sysinternals - Process Explorer.

Left click on a column header and select
Select Columns
On the first tab shown, check
Command Line
close this

Hit space bar to stop updates.
Hover the mouse over the Process name and it will reveal what each has
under its wing.

The Command Line column will show how each line item was started.

Currently my 7 copies of
svchost.exe
that are running shows the thing it is hosting.
Some have one and others have multiple things.

Another way to view this is with Task Manager. Right-click on an item in
the Processes tab view and select Go To Service(s). It will display a
list of all of them and hilight the ones that instance of svchost is
hosting. You can go in the other direction too. Right-click on an entry
shown under the Services tab and it will display the users of that
service.

In article , ,
OldGuy says...

Looking at MSCONFIG and wondering...

Is there any free tool that will tell me what each of the items in
Services and Startup does and if it is really necessary for proper
windows operations?

Trying to speed up my Windows.
I know what my virus scanner is doing so let's skip that discussion.

WIN XP - everything starts a boot up
Win 7 - I read somewhere that stuff does not start at boot but when
needed.

Most important to me is if there is a tool about services and startups.



--- news://freenews.netfront.net/ - complaints: ---

*Don't* use MSCONFIG to disable services and startups - if you do,
msconfig runs at every startup. Use it to *view* startups and services
only.

A much better way, is to use Piriform's Crap Cleaner (CCleaner). You
can download it here...
http://www.piriform.com/ccleaner/download

It has a Tools section, in which you can simply *disable* startups,
without deleting them. That way, you can re-enable 'em if required.

--
Duncan.

Jason wrote:
On Thu, 24 Sep 2015 12:47:09 -0700 "OldGuy" wrote in
article
Sysinternals - Process Explorer.

Left click on a column header and select
Select Columns
On the first tab shown, check
Command Line
close this

Hit space bar to stop updates.
Hover the mouse over the Process name and it will reveal what each has
under its wing.

The Command Line column will show how each line item was started.

Currently my 7 copies of
svchost.exe
that are running shows the thing it is hosting.
Some have one and others have multiple things.

Another way to view this is with Task Manager. Right-click on an item in
the Processes tab view and select Go To Service(s). It will display a
list of all of them and hilight the ones that instance of svchost is
hosting. You can go in the other direction too. Right-click on an entry
shown under the Services tab and it will display the users of that
service.

On WinXP Pro

tasklist /svc

will list the contents of SVCHOSTs.

On WinXP Home, you'd have to rely on Sysinternals tools such
as Process Explorer, to see what is in the SVCHOSTs.

Using Process Explorer, you will see very low (i.e. zero) cycle
counts for the services not being used. That's why I'm not a big
fan of SVCHOST crusades.

There are also services which live outside SVCHOST, and I'm all
for smacking those. As an example, my Logitech webcam package
is such a pig (software continues to run when the webcam isn't
even plugged in), I had to remove the software to reduce wasted
resources. So yes, that and my printer driver, were such heroic
designs, I had to flush them. When I print (which doesn't happen
very often), I use the printer driver on my laptop instead. Keeping
the regular OS on this machine a little cleaner.

But for the system stuff, like the errant wuauserv, that is only
on an as-needed basis. If the wasted CPU caused by wuauserv bothers
you, you can always stop the service. It's too bad there wasn't
a patch to just fix it, since the evidence is, the thing runs
off into lala land and takes forever to come back. I often wonder
whether it comes back, based on some sort of timeout inside
the code, rather than actually completing its algorithm.

Paul

On 2015-09-24 15:01, Paul wrote:

To split out a service into its own private SVVHOST, you can use
these commands.

"sc config service type= own"

To return to the normal sharing (wuauserv lives with 14 other
buddies, in a run-down SVCHOST), you do this again.

"sc config service type= share"

You see any problems with doing this for every single service? I'm
thinking this would be great for services using the network; I could
finally control them with the firewall...

Thanks.
Best Regards,

--
! _\|/_ Sylvain /
! (o o) Member-+-David-Suzuki-Fdn/EFF/Red+Cross/Planetary-Society-+-
oO-( )-Oo --T-A+G-L-I+N-E--+M-E-A+S-U-R+I-N-G+--G-A+U-G-E--char-57^

B00ze wrote:
On 2015-09-24 15:01, Paul wrote:

To split out a service into its own private SVVHOST, you can use
these commands.

"sc config service type= own"

To return to the normal sharing (wuauserv lives with 14 other
buddies, in a run-down SVCHOST), you do this again.

"sc config service type= share"

You see any problems with doing this for every single service? I'm
thinking this would be great for services using the network; I could
finally control them with the firewall...

Thanks.
Best Regards,


It all depends on how much overhead this would add to the
kernel scheduler. And I've not tested how much CPU gets
wasted by doing that. Could be 2-3% maybe.

But this technique does have value for debugging, when you
have no idea which thing living in a single SVCHOST is the
troublemaker, so you send them off to their own SVCHOST each.

Paul

This _looks_ like it might be a quite useful list - but I don't have the
time to unpick the formatting, which something between your posting and
my reading has made a mess of. Do you have it on a web page, or as a
word-processor document, or something?

In message , OldGuy
writes:
Name Description
.NET Runtime Optimization Service v2.0.50727_X86 Microsoft .NET
Framework NGEN
Acronis Scheduler2 Service Provides scheduling for Acronis
components' tasks.
Agere Modem Call Progress Audio
Alerter Notifies selected users and computers of administrative
alerts. If the service is stopped, programs that use administrative
alerts will not receive them. If this service is disabled, any services
that explicitly depend on it will fail to start.
Application Layer Gateway Service Provides support for 3rd party
protocol plug-ins for Internet Connection Sharing and the Windows
Firewall.
Application Management Provides software installation services such as
Assign, Publish, and Remove.
ASP.NET State Service Provides support for out-of-process session
states for ASP.NET. If this service is stopped, out-of-process requests
will not be processed. If this service is disabled, any services that
explicitly depend on it will fail to start.
Automatic Updates Enables the download and installation of Windows
updates. If this service is disabled, this computer will not be able to
use the Automatic Updates feature or the Windows Update Web site.
Avira Mail Protection Offers permanent protection against viruses and
malware for email clients with the Avira search engine.
Avira Real-Time Protection Offers permanent protection against
viruses and malware with the Avira search engine.
Avira Scheduler Service to schedule Avira Antivirus jobs and updates.
Avira Service Host Service Host for Avira
Avira Web Protection Offers permanent protection against viruses and
malware for web browsers with the Avira search engine.
Background Intelligent Transfer Service Transfers files in the
background using idle network bandwidth. If the service is stopped,
features such as Windows Update, and MSN Explorer will be unable to
automatically download programs and other information. If this service
is disabled, any services that explicitly depend on it may fail to
transfer files if they do not have a fail safe mechanism to transfer
files directly through IE in case BITS has been disabled.
Bonjour Service Enables hardware devices and software services
to automatically configure themselves on the network and advertise
their presence.
ClipBook Enables ClipBook Viewer to store information and share
it with remote computers. If the service is stopped, ClipBook Viewer
will not be able to share information with remote computers. If this
service is disabled, any services that explicitly depend on it will
fail to start.
COM+ Event System Supports System Event Notification Service
(SENS), which provides automatic distribution of events to subscribing
Component Object Model (COM) components. If the service is stopped,
SENS will close and will not be able to provide logon and logoff
notifications. If this service is disabled, any services that
explicitly depend on it will fail to start.
COM+ System Application Manages the configuration and tracking
of Component Object Model (COM)+-based components. If the service is
stopped, most COM+-based components will not function properly. If this
service is disabled, any services that explicitly depend on it will
fail to start.
Computer Browser Maintains an updated list of computers on the
network and supplies this list to computers designated as browsers. If
this service is stopped, this list will not be updated or maintained.
If this service is disabled, any services that explicitly depend on it
will fail to start.
Cryptographic Services Provides three management services: Catalog
Database Service, which confirms the signatures of Windows files;
Protected Root Service, which adds and removes Trusted Root
Certification Authority certificates from this computer; and Key
Service, which helps enroll this computer for certificates. If this
service is stopped, these management services will not function
properly. If this service is disabled, any services that explicitly
depend on it will fail to start.
DCOM Server Process Launcher Provides launch functionality for DCOM
services.
DeviceFinderService
DHCP Client Manages network configuration by registering and
updating IP addresses and DNS names.
Distributed Link Tracking Client Maintains links between NTFS
files within a computer or across computers in a network domain.
DNS Client Resolves and caches Domain Name System (DNS) names for
this computer. If this service is stopped, this computer will not be
able to resolve DNS names and locate Active Directory domain
controllers. If this service is disabled, any services that explicitly
depend on it will fail to start.
EPSON V3 Service4(04)
EPSON V5 Service4(04)
EpsonBidirectionalService
Error Reporting Service Allows error reporting for services and
applictions running in non-standard environments.
Event Log Enables event log messages issued by Windows-based
programs and components to be viewed in Event Viewer. This service
cannot be stopped.
Extensible Authentication Protocol Service Provides windows clients
Extensible Authentication Protocol Service
Fast User Switching Compatibility Provides management for
applications that require assistance in a multiple user environment.
Fax Enables you to send and receive faxes, utilizing fax resources
available on this computer or on the network.
FLEXnet Licensing Service This service performs licensing
functions on behalf of FLEXnet enabled products.
Google Update Service (gupdate) Keeps your Google software up to
date. If this service is disabled or stopped, your Google software will
not be kept up to date, meaning security vulnerabilities that may arise
cannot be fixed and features may not work. This service uninstalls
itself when there is no Google software using it.
Google Update Service (gupdatem) Keeps your Google software up to
date. If this service is disabled or stopped, your Google software will
not be kept up to date, meaning security vulnerabilities that may arise
cannot be fixed and features may not work. This service uninstalls
itself when there is no Google software using it.
Health Key and Certificate Management Service Manages health
certificates and keys (used by NAP)
Help and Support Enables Help and Support Center to run on this
computer. If this service is stopped, Help and Support Center will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
HID Input Service Enables generic input access to Human Interface
Devices (HID), which activates and maintains the use of predefined hot
buttons on keyboards, remote controls, and other multimedia devices. If
this service is stopped, hot buttons controlled by this service will no
longer function. If this service is disabled, any services that
explicitly depend on it will fail to start.
HTTP SSL This service implements the secure hypertext transfer
protocol (HTTPS) for the HTTP service, using the Secure Socket Layer
(SSL). If this service is disabled, any services that explicitly
depend on it will fail to start.
IMAPI CD-Burning COM Service Manages CD recording using Image
Mastering Applications Programming Interface (IMAPI). If this service
is stopped, this computer will be unable to record CDs. If this service
is disabled, any services that explicitly depend on it will fail to start.
Imapi Helper
InCD Helper Helper service for the InCD filesystem driver
Indexing Service Indexes contents and properties of files on
local and remote computers; provides rapid access to files through
flexible querying language.
Infrared Monitor Supports infrared devices installed on the
computer and detects other devices that are in range.
Innovative Solutions Service Monitor
InstallDriver Table Manager Provides support for the Running Object
Table for InstallShield Drivers
Intel(R) PROSet/Wireless Event Log Manages the event trace messages
for all the components of Intel(R) PROSet/Wireless software.
Intel(R) PROSet/Wireless Registry Service Intel(R) PROSet/Wireless
Registry Service
Intel(R) PROSet/Wireless Service Wireless Management Service for
Intel(R) PROSet/Wireless
IPSEC Services Manages IP security policy and starts the ISAKMP/Oakley
(IKE) and the IP security driver.
Logical Disk Manager Detects and monitors new hard disk drives and
sends disk volume information to Logical Disk Manager Administrative
Service for configuration. If this service is stopped, dynamic disk
status and configuration information may become out of date. If this
service is disabled, any services that explicitly depend on it will
fail to start.
Logical Disk Manager Administrative Service Configures hard disk
drives and volumes. The service only runs for configuration processes
and then stops.
Machine Debug Manager Supports local and remote debugging for Visual
Studio and script debuggers. If this service is stopped, the debuggers
will not function properly.
Macrium Reflect Image Mounting Service Macrium Reflect Scheduling
Services
MBAMService Malwarebytes Anti-Malware service
Messenger Transmits net send and Alerter service messages between
clients and servers. This service is not related to Windows Messenger.
If this service is stopped, Alerter messages will not be transmitted.
If this service is disabled, any services that explicitly depend on it
will fail to start.
Microsoft .NET Framework NGEN v4.0.30319_X86 Microsoft .NET Framework
NGEN
Mozilla Maintenance Service The Mozilla Maintenance Service ensures
that you have the latest and most secure version of Mozilla Firefox on
your computer. Keeping Firefox up to date is very important for your
online security, and Mozilla strongly recommends that you keep this
service enabled.
MS Software Shadow Copy Provider Manages software-based volume
shadow copies taken by the Volume Shadow Copy service. If this service
is stopped, software-based volume shadow copies cannot be managed. If
this service is disabled, any services that explicitly depend on it
will fail to start.
NAS PM Service NAS Power Management Service
Nero Update Provides access to Nero application updates and manages
Nero applications.
Net Logon Supports pass-through authentication of account logon
events for computers in a domain.
Net.Tcp Port Sharing Service Provides ability to share TCP ports over
the net.tcp protocol.
NetMeeting Remote Desktop Sharing Enables an authorized user to
access this computer remotely by using NetMeeting over a corporate
intranet. If this service is stopped, remote desktop sharing will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
Network Access Protection Agent Allows windows clients to
participate in Network Access Protection
Network Connections Manages objects in the Network and Dial-Up
Connections folder, in which you can view both local area network and
remote connections.
Network DDE Provides network transport and security for Dynamic Data
Exchange (DDE) for programs running on the same computer or on
different computers. If this service is stopped, DDE transport and
security will be unavailable. If this service is disabled, any services
that explicitly depend on it will fail to start.
Network DDE DSDM Manages Dynamic Data Exchange (DDE) network
shares. If this service is stopped, DDE network shares will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
Network Location Awareness (NLA) Collects and stores network
configuration and location information, and notifies applications when
this information changes.
Network Provisioning Service Manages XML configuration files on a
domain basis for automatic network provisioning.
NMIndexingService
NovaCore SDK Service Provides support for 3rd party developers of
NovaCore applications.
NT LM Security Support Provider Provides security to remote
procedure call (RPC) programs that use transports other than named
pipes.
O2Micro Flash Memory
Office Source Engine Saves installation files used for updates and
repairs and is required for the downloading of Setup updates and Watson
error reports.
Performance Logs and Alerts Collects performance data from local or
remote computers based on preconfigured schedule parameters, then
writes the data to a log or triggers an alert. If this service is
stopped, performance information will not be collected. If this service
is disabled, any services that explicitly depend on it will fail to start.
Plug and Play Enables a computer to recognize and adapt to hardware
changes with little or no user input. Stopping or disabling this
service will result in system instability.
PMBDeviceInfoProvider Enables PlayMemories Home to communicate with
the device.
Portable Media Serial Number Service Retrieves the serial number of
any portable media player connected to this computer. If this service
is stopped, protected content might not be down loaded to the device.
Print Spooler Loads files to memory for later printing.
Protected Storage Provides protected storage for sensitive data,
such as private keys, to prevent access by unauthorized services,
processes, or users.
QoS RSVP Provides network signaling and local traffic control
setup functionality for QoS-aware programs and control applets.
Remote Access Auto Connection Manager Creates a connection to a remote
network whenever a program references a remote DNS or NetBIOS name or
address.
Remote Access Connection Manager Creates a network connection.
Remote Desktop Help Session Manager Manages and controls Remote
Assistance. If this service is stopped, Remote Assistance will be
unavailable. Before stopping this service, see the Dependencies tab of
the Properties dialog box.
Remote Packet Capture Protocol v.0 (experimental) Allows to
capture traffic on this machine from a remote machine.
Remote Procedure Call (RPC) Provides the endpoint mapper and other
miscellaneous RPC services.
Remote Procedure Call (RPC) Locator Manages the RPC name service
database.
Remote Registry Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
Removable Storage
Routing and Remote Access Offers routing services to businesses in
local area and wide area network environments.
RunSwUSB
Secondary Logon Enables starting processes under alternate
credentials. If this service is stopped, this type of logon access will
be unavailable. If this service is disabled, any services that
explicitly depend on it will fail to start.
Security Accounts Manager Stores security information for local
user accounts.
Security Center Monitors system security settings and configurations.
Server Supports file, print, and named-pipe sharing over the network
for this computer. If this service is stopped, these functions will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
Shell Hardware Detection Provides notifications for AutoPlay
hardware events.
Smart Card Manages access to smart cards read by this computer. If
this service is stopped, this computer will be unable to read smart
cards. If this service is disabled, any services that explicitly depend
on it will fail to start.
Softex OmniPass Service
Sprint RcAppSvc
Spybot-S&D 2 Scanner Service Offers malware scanning services to
Spybot-S&D modules
Spybot-S&D 2 Security Center Service Integrates Spybot into the
Windows Security Center.
Spybot-S&D 2 Updating Service Downloads Spybot updates and installs
them.
SSDP Discovery Service Enables discovery of UPnP devices on your home
network.
System Event Notification Tracks system events such as Windows
logon, network, and power events. Notifies COM+ Event System
subscribers of these events.
System Restore Service Performs system restore functions. To stop
service, turn off System Restore from the System Restore tab in My
Computer-Properties
Task Scheduler Enables a user to configure and schedule automated tasks
on this computer. If this service is stopped, these tasks will not be
run at their scheduled times. If this service is disabled, any services
that explicitly depend on it will fail to start.
TCP/IP NetBIOS Helper Enables support for NetBIOS over TCP/IP (NetBT)
service and NetBIOS name resolution.
Telephony Provides Telephony API (TAPI) support for programs that
control telephony devices and IP based voice connections on the local
computer and, through the LAN, on servers that are also running the
service.
Telnet Enables a remote user to log on to this computer and run
programs, and supports various TCP/IP Telnet clients, including
UNIX-based and Windows-based computers. If this service is stopped,
remote user access to programs might be unavailable. If this service is
disabled, any services that explicitly depend on it will fail to start.
Terminal Services Allows multiple users to be connected
interactively to a machine as well as the display of desktops and
applications to remote computers. The underpinning of Remote Desktop
(including RD for Administrators), Fast User Switching, Remote
Assistance, and Terminal Server.
Themes Provides user experience theme management.
TOSHIBA Bluetooth Service
UMVPFSrv UMVPF is a user mode Logitech driver
Uninterruptible Power Supply Manages an uninterruptible power supply
(UPS) connected to the computer.
Universal Plug and Play Device Host Provides support to host
Universal Plug and Play devices.
Visual Studio Analyzer RPC bridge
Volume Shadow Copy Manages and implements Volume Shadow Copies used
for backup and other purposes. If this service is stopped, shadow
copies will be unavailable for backup and the backup may fail. If this
service is disabled, any services that explicitly depend on it will
fail to start.
WebClient Enables Windows-based programs to create, access, and
modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
Windows Audio Manages audio devices for Windows-based programs. If
this service is stopped, audio devices and effects will not function
properly. If this service is disabled, any services that explicitly
depend on it will fail to start.
Windows CardSpace Securely enables the creation, management, and
disclosure of digital identities.
Windows Driver Foundation - User-mode Driver Framework Manages
user-mode driver host processes
Windows Firewall/Internet Connection Sharing (ICS) Provides network
address translation, addressing, name resolution and/or intrusion
prevention services for a home or small office network.
Windows Image Acquisition (WIA) Provides image acquisition
services for scanners and cameras.
Windows Installer Adds, modifies, and removes applications
provided as a Windows Installer (*.msi) package. If this service is
disabled, any services that explicitly depend on it will fail to start.
Windows Management Instrumentation Provides a common interface and
object model to access management information about operating system,
devices, applications and services. If this service is stopped, most
Windows-based software will not function properly. If this service is
disabled, any services that explicitly depend on it will fail to start.
Windows Management Instrumentation Driver Extensions Provides systems
management information to and from drivers.
Windows Media Player Network Sharing Service Shares Windows Media
Player libraries to other networked players and media devices using
Universal Plug and Play
Windows Presentation Foundation Font Cache 3.0.0.0 Optimizes
performance of Windows Presentation Foundation (WPF) applications by
caching commonly used font data. WPF applications will start this
service if it is not already running. It can be disabled, though doing
so will degrade the performance of WPF applications.
Windows Presentation Foundation Font Cache 4.0.0.0 Optimizes
performance of Windows Presentation Foundation (WPF) applications by
caching commonly used font data. WPF applications will start this
service if it is not already running. It can be disabled, though doing
so will degrade the performance of WPF applications.
Windows Search Provides content indexing and property caching for file,
email and other content (via extensibility APIs). The service responds
to file and email notifications to index modified content. If the
service is stopped or disabled, the Explorer will not be able to
display virtual folder views of items, and search in the Explorer will
fall back to item-by-item slow search.
Windows Time Maintains date and time synchronization on all clients
and servers in the network. If this service is stopped, date and time
synchronization will be unavailable. If this service is disabled, any
services that explicitly depend on it will fail to start.

Wired AutoConfig This service performs IEEE 802.1X authentication
on Ethernet interfaces
Wireless Zero Configuration Provides automatic configuration for the
802.11 adapters
WMI Performance Adapter Provides performance library information
from WMI HiPerf providers.
Workstation Creates and maintains client network connections to
remote servers. If this service is stopped, these connections will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.


--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

Science is built with facts as a house is with stones--but a collection of facts
is no more a science than a heap of stones is a house. -Jules Henry Poincare
(1854-1912)

In message , Don Phillipson
writes:
"OldGuy" wrote in message
...

Looking at MSCONFIG and wondering...

Is there any free tool that will tell me what each of the items in
Services and Startup does and if it is really necessary for proper windows
operations?

All Windows Services are self-documenting i.e. can be reviewed at
/start / control panel / admin tools / services.
[]
(That's Start | Settings | Control Panel ... on my machine.)

I was all set to mock the above - but in fact it's pretty excellent!
Thanks Don. Of course it does depend on, presumably, the writers of the
service having included the necessary text in the service, but looking
at the ones it shows up in mine, the first 14 have reasonably
descriptive text - I had to go through to the 15th to find one that has
no text at all. (BrSplService - I suspect that may be something to do
with Brother printer/scanners.)

Right-clicking on one in that and selecting Properties will show the
path to the executable, so you can navigate to it and hopefully find out
something from its properties there (yes, the above _is_ Brother);
there's also a Dependencies tab, which shows both ways.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

As we journey through life, discarding baggage along the way, we should keep
an iron grip, to the very end, on the capacity for silliness. It preserves the
soul from desiccation. - Humphrey Lyttelton quoted by Barry Cryer in Radio
Times 10-16 November 2012

| All Windows Services are self-documenting i.e. can be reviewed at
| /start / control panel / admin tools / services.
| []
| (That's Start | Settings | Control Panel ... on my machine.)
|
| I was all set to mock the above - but in fact it's pretty excellent!

It can be useful, but it's not designed in the
interest of either security or simplicity. Example:

Messenger service was the first problem that
came up when XP was released in only a corporate
configuration, as an NT system. WinNT has always
come with corporate workstation services enabled
by default. Many of them are pointless. Some are
risky. (Remote anything shouldn't be running on a
standalone PC.... But if you turn off RPCSS [remote
procedure call], you're cooked.)

Messenger service, unrelated to Windows Messenger,
allows corporate network admins to show messages to
employees. The service was hijacked to show spam
messages when XP first came out. Microsoft had no
business leaving that service enabled in the first place.
But they deliver the system defaulting to corporate
workstation configuration. That means it's set up to
trust the network.

The description for Messenger:
"Transmits net send and Alerter service messages between
clients and servers."

Not very informative, especially for people with little
experience. If Don depends on those descriptions then I'm
guessing he's never tried to trim down services. (And
that's one of the more verbose descriptions.)

The only good information I know of is blackviper.com.

Without studying services I don't think there's any
way to decide what to enable, and which to set to
auto vs manual. Remote Registry and Remote Desktop
are both very unsafe. On the other hand, some people
enable Remote Desktop for tech support. DHCP is
unnecessary for fixed IP address, but critical if one
doesn't use fixed IP in network settings. WMI is an
unnecessary risk for most people. I have it enabled
only because I use it myself. I've never had workstation
or server services enabled. They might be needed on
a home network. I don't know. I always disable Task
Scheduler on XP. It's only used by bloatware that
wants to run things without asking. But I haven't
been able to disable it on Win7.

I have numerous services disabled that are, at
best, useless on a standalone machine. At worst
they're security risks:

distributed link tracking client
TCP/IP over NETBIOS
Alerter
BITS
Clipbook
distributed lnik tracking
computer browser
error reporting service
Indexing (Windows find is broken, so indexing just burns disks)
Messenger
Net logon
Net meeting
Network DDE
Network location awareness
Network provisioning
NT LM Security support
Remote desktop helper
Remote access connection manager
Remote Registry
Routing and Remote access
Secondary logon
Server
SSDP discovery
UPNP
Web client
Workstation
Terminal services

I also disable system restore, windows update,
and various 3rd-party crap like Epson Customer
Participation. And I disable silliness like Windows
Time. (Though that one has somehow disappeared
from my list, anyway. Maybe I deleted it from the
Registry at some point.)

But I would never tell someone else that my list
should be their list. There are too many variables.

Anyone who wants to optimize services for themselves
and reduce security risks needs to visit blackviper.com
and learn about every service they're thinking of
changing. In many cases it may be possible to eliminate
anything that needs to go online (I've done that),
which allows svchost to be entirely blocked from
going out, closing a big security/privacy hole.

| You see any problems with doing this for every single service? I'm
| thinking this would be great for services using the network; I could
| finally control them with the firewall...
|

I do that by simply not needing any remote services.
I block any instance of svchost going out. Do you know
a firewall that can block one instance of svchost but
not another? I don't.

| The most relevant opinion is Microsoft's, as they are *supposed* to
| know what Windows really needs to run but they do include an awful lot
| of crud.

Yes, indeed. Microsoft is the last authority to
listen to. They cater to business. They configure
things for the convenience of business and for
minimal tech support. See my post below. Microsoft
are the ones who make this discussion relevant in
the first place. They've made a mess of things for
SOHo computer owners by catering only to IT people.

| But my opinion is no more valid, maybe less valid, than
| that of Black Viper.

It shouldn't be a matter of anyone's opinion. It's
a matter of preferences and needs. Anyone who
cares to delve into it needs to understand the
services, their risks and their interconnections.
For instance, Remote Desktop should be disabled
by anyone who cares about security, assuming
they're not using it. On the other hand, the elderly
person whose tech support person uses RD will need
to leave it running. There's no opinion involved there.
It's just a matter of weighing pros and cons for one's
own situation.

I wrote a utility for XP when I first ran into the
services problem:

http://www.jsware.net/jsware/xpfix.php5

It's designed to provide an easy tool that allows
me to quickly trim down and tame any XP system
I need to work on. A selective collection of tweaks,
including a basic services trimmer. But it's not
intended for use by people who want an easy solution.
It's more like a partial distillation of the information
that one can get from sources like blackviper.com.
The intent was to narrow down how much people have
to research and understand in order to clean up XP
services. (It also serves as a handy info repository
for me. I spend days or weeks figuring these things
out and then if I don't write it all down I've forgotten
a few months later.

I haven't, so far, made a similar tool for Win7. I do
know that Win7 has a lot more services running by
default. So, a lot more details to figure out.