Change and Set Vista Shadow Copy or System Restore Disk Space Limit in cmd prompt with vss

admin
To use vssadmin.exe utility, users will need to launch Command Prompt with administrative rights. To do so, simply click on Start button, then type CMD in the Start Search box, and finally press Ctrl-Shift-Enter as a shortcut to open Command Prompt in elevated mode. Alternatively, you may also right click on CMD and select Run as Administrator. Answer Allow or Yes to User Access Control prompt. Then you can check, verify, or set the limit for VSS or System Restore using the following commands. 1. Display List of Commands Supported by VSSAdmin.exe vssadmin /? 2. Check and View Existing Used, Allocated and Maximum Shadow Copy Storage Space vssadmin List ShadowStorage Output will be something like this. The amount of space used is total for Shadow Copy service, which include System Restore and Previous Versions. vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2005 Microsoft Corp. Shadow Copy Storage association For volume: (C:)\\?\Volume{578b3fef-0d72-11dc-be49-806e6f6e6963}\ Shadow Copy Storage volume: (C:)\\?\Volume{578b3fef-0d72-11dc-be49806e6f6e6963}\ Used Shadow Copy Storage space: 89.724 GB Allocated Shadow Copy Storage space: 89.951 GB Maximum Shadow Copy Storage space: UNBOUNDED 3. Reduce, Increase or Change the Maximum Allocated Shadow Copy (System Restore) Space Size Syntax: vssadmin Resize ShadowStorage /On=[drive]: /For=[drive]: /Maxsize=[size]

For example, to limit the usage of VSS backup files which include System Restore files and Previous Versions file to 5 gigabytes on the C: drive, with the storage space for these files located on drive C: too, use the following command: vssadmin Resize ShadowStorage /On=C: /For=C: /MaxSize=5GB The value for MaxSize must be at least 300MB or greater and accepts the following suffixes: KB, MB, GB, TB, PB and EB (well, the last few sort of a joke as if you have such many space to spare you wont worry about how much space VSS is using). If a suffix is not supplied, MaxSize will treat the value entered as bytes. If you intend to set no limit to the amount of space VSS System Restore and Shadow Copy can use, leave out MaxSize parameter, and the max will be set to unbounded. But before you shrink or reduce the disk space limit for VSS, remember that VSS is used by both System Restore and the useful Previous Versions (Shadow Copy) feature, where you can retrieve and recover deleted files, or accidentally/wrongly modified files by restoring the saved copy or previous version of the file or document. So if you reduce the space it able to use, unavoidable the generation and number of the files that can be backed up are also reduced.

Change and Set Vista Shadow Copy or System Restore Disk Space Limit in Explorer GUI
Heres an alternative way to change and set a new limit to the size of hard disk space that Shadow Copy related services can used. The trick is to disable System Restore automatic restore points creation and then enable it again. The trick makes use of the fact that Windows Vista will always set the upper bound of the space for System Restore (and Shadow Copy) to equal to 30% of the remaining space on the volume or disk partition. By disabling and enabling System Restore, we can easily reset the limit to make it bigger or smaller. When your space usage grows and free space is limited, the trick will reduce and shrink the space System Restore use, and thus release and allocate more space to users. On the other hand, if system free space grows, Vista will recalculates the space available, and set 30% of it as the new limit, and thus increase or expand the allocation to System Restore. Note that the only downsize to this hack is that you will lose all previous restore points, which is exactly backups of files that has been saved. This including files that used to restore in Previous Versions and System Restore. 1. Click on Start button, then select Control Panel. Next click on System link (You may need to select System and Maintenance first). 2. In the Tasks pane on the left, click System Protection link.

3. A System Properties dialog box will popped up with the System Protection tab selected. There should be a tick on at least one or more available disks. Clear or untick the check box to the left of the drive letter that you want to reset the space limit for VSS. 4. When prompted with Are you sure want to turn System Restore off warning dialog box, click on Turn System Restore Off button, and then click Apply. 5. After disabled System Restore, now we want to enable and turn if on again. Click and tick the checkbox to the left of the drive letter, and then click Apply button. 6. Manually create a restore point by click on Create button located at the bottom of System Protection tab. Windows Vista will now calculate the remaining space available and set the new System Restore space limit to be 30% of it. You can verify the new limit and amount of stored in use by using VSSadmin in command prompt. Note that the smallest the limit will go is 15% of the total drive or volume disk space. If the 30% of the free space fall below this value, 15% of the total disk space will become the bound and set as Volume Shadow Copy (VSS), System Restore and Previous Versions disk usage limit.

Optimize Vista by Disabling Unused, Unneeded or Unnecessary Windows Services

Like in Windows XP, when Windows Vista is installed, Microsoft configure the operating system to enable and turn on background services based on the default recommended settings for Windows Vista services. However, not all of these running processes in background are been used, needed, critical or necessary. To free up and conserve memory, reduce RAM usage and CPU resources, some of these services can be stopped and disabled. By turning off some background processes, Windows Vista can be optimized to be more responsive and speed up, especially in system with lesser memory. To disable any of the services in Windows Vista, simply press Windows + R keyboard shortcuts (equivalent with pressing Start button and then click Run), and then type services.msc into the Run textbox. Hit Enter and Services window which allows user to manage services will appear. Double click on the service which the startup type setting you want to modify to bring its properties window. Set the Startup type to Disabled in the drop down list, and then press OK. If you want to play safe, the Startup type can be set to Manual. Manual setting will cause the services do not start when Windows boots up, and only be started when theyre needed. Nevertheless, the service will still be launched, so to disable permanently, the Startup type has to set to Disabled. On page 4, there is a list is more than 130 services that exist in Windows Vista, with their description. Its best to read and understand what each service means before deciding on how to optimize the Vista system. But, depending on which Vista edition youre using, not all services listed below will appear in the system Services configuration. Only machine running Windows Vista Ultimate likely to see all entries from the list. To speed up and optimize Windows Vista for performance and responsiveness, the following services can generally be able to disable without affecting functionality of Windows Vista for average or common users, as long as you dont use the functions or devices that depends on
3

the services. Check page 2 for full description and dependencies. It should not been applied to computers on domain or corporate network before you understand what tasks are performing by each of the services. Beside, if the service hasnt been started when you check on it, its not necessary to disable it as it makes no different to system resources used, since non-starting process use no processing power and memory. Application Management Background Intelligent Transfer Service Base Filtering Engine Block Level Backup Engine Service Certificate Propagation COM+ Event System Computer Browser Diagnostic Policy Service Diagnostic System Host Distributed Link Tracking Client Fax Function Discovery Provider Host Function Discovery Resource Publication Human Interface Device Access IKE and AuthIP IPsec Keying Modules Internet Connection Sharing (ICS) IP Helper IPSec Policy Agent KtmRm for Distributed Transaction Coordinator Messenger Sharing Folders USN Journal Reader Service Microsoft iSCSI Initiator Service Microsoft Software Shadow Copy Provider Net.Tcp Port Sharing Service Network Access Protection Agent Network List Service Network Location Awareness Offline Files Parental Controls PnP-X IP Bus Enumerator Portable Device Enumerator Service Print Spooler Program Compatibility Assistant Service Quality Windows Audio Video Experience ReadyBoost Remote Access Connection Manager Remote Registry Routing and Remote Access
4

Secondary Logon Security Center Server Shell Hardware Detection SL UI Notification Service Smart Card Smart Card Removal Policy SNMP Trap SSDP Discovery Superfetch Tablet PC Input Service TCP/IP NetBIOS Helper Telephony Terminal Services UPnP Device Host Volume Shadow Copy WebClient Windows Backup Windows Defender Windows Error Reporting Service Windows Firewall Windows Image Acquisition Windows Media Center Extender Service Windows Media Center Receiver Service Windows Media Center Scheduler Service Windows Media Center Service Launcher Windows Media Player Network Sharing Service Windows Search Windows Time WinHTTP WebProxy Auto-Discovery Service Virtual Disk Volume Shadow Copy Wired AutoConfig For those who doesnt use Windows Aero theme, the following services can be disabled: Application Experience Desktop Window Manager Session Manager For those who doesnt use any themes in Windows Vista, the following services can be disabled: Application Experience Desktop Window Manager Session Manager Windows Themes

Windows Vista Services configuration is not absolute. Each users can have their own optimum configuration. Thus, there are plenty of lists which suggest and recommend safe settings, or optimal settings based on the functionality of the Vista system, whether its laptop or desktop, been used as network server or not, or been used by average users or geeks. List of All Available Services in Windows Vista with Default Startup Type Settings Application Experience (svchost.exe) Automatic Processes application compatibility cache requests for applications when they are launched. Application Information (svchost.exe) Manual Helps interactive applications run with additional administrative privileges. Needed by apps such as Services and RegEdit. If disable, user has to boot into Safe Mode to enable again as Services applet is not accessible. Application Layer Gateway Service (alg.exe) Manual Provides support for third-party protocol plug-ins for Internet Connection Sharing and the Windows Firewall. Application Management (svchost.exe) Manual Provides software installation services such as Assign, Publish, and Remove. Use for group policy or IntelliMirror for corporate centralized management. Background Intelligent Transfer Service (svchost.exe) Manual Uses idle network bandwidth to transfer data. Use by Windows Update or MSN Explorer which no longer able to automatically download program or other information when disabled. However, if youre using Windows Update, the service will automatically and set as Automatic (Delayed Start). Base Filtering Engine (svchost.exe) Automatic Manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will reduce system security and cause unpredictable behavior in IPsec management and firewall applications. No necessary if there is other firewall system. Block Level Backup Engine Service (wbengine.exe) Manual Performs block-level backup and recovery of data. Certificate Propagation (svchost.exe) Manual Propagates certificates from smart cards. Not needed if dont use smart cards. CNG Key Isolation (lsass.exe) Manual Service stores and uses long-lived private keys and associated cryptographic operations in a secure process.
6

COM+ Event System (svchost.exe) Automatic Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing component object model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. COM+ System Application (dllhost.exe) Manual Manages the configuration and tracking of components based on COM+. If the service is stopped, most components based on COM+ will not function properly. Computer Browser (svchost.exe) Automatic Maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this service is stopped, this list will not be updated or maintained. Not needed if there is no other computer in the network. Cryptographic Services (svchost.exe) Automatic Provides four management services: Catalog Database Service, which confirms the signatures of Windows files; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; Automatic Root Certificate Update Service, which retrieves root certificates from Windows Update; and Key Service, which helps enroll this computer for certificates. If this service is stopped, these management services will not function properly. Windows Update will automatically set this service to Manual even if it has been set to Disabled. DCOM Server Process Launcher (svchost.exe) Automatic Provides launch functionality for distributed component object model (DCOM) services. DCOM allows COM components to communicate over networks. Desktop Window Manager Session Manager (dfsr.exe) Automatic Provides startup and maintenance services for the Desktop Window Manager, which is the windowing system that enables Windows Aero. DFS Replication (dfsr.exe) Automatic Replicates files among multiple PCs and keeps them synchronized. DHCP Client (svchost.exe) Automatic Manages network configuration by registering and updating Internet Protocol (IP) addresses and Domain Name System (DNS) names. Can be disabled if youre static IP address. Diagnostic Policy Service (svchost.exe) Automatic Enables detection of problems, troubleshooting, and problem resolution for Windows components. If the service is stopped, diagnostics will no longer function. Diagnostic Service Host (svchost.exe) Manual
7

 Enables detection of problems, troubleshooting, and problem resolution for Windows components. If the service is stopped, diagnostics will no longer function. Diagnostic System Host (svchost.exe) Manual Enables detection of problems, troubleshooting, and problem resolution for Windows components. If the service is stopped, diagnostics will no longer function. Distributed Link Tracking Client (svchost.exe) Automatic Maintains links between NTFS files within a computer or across computers in a network domain. Distributed Transaction Coordinator (msdtc.exe) Manual Coordinates transactions that span multiple resource managers, such as databases, message queues, and filesystems. If this service is stopped, these transactions will not occur. DNS Client (svchost.exe) Automatic Resolves and caches DNS names for this computer. If this service is stopped, this computer will not be able to resolve DNS names and locate Active Directory domain controllers. Extensible Authentication Protocol (svchost.exe) Manual The Extensible Authentication Protocol (EAP) service provides network authentication for 802.1x wired and wireless, Virtual Private Network (VPN), and Network Access Protection (NAP). It also provides APIs used by network access clients, including wireless and VPN clients, during the authentication process. If you disable the service, the PC cannot access networks that require EAP authentication. Fax (fxssvc.exe) Manual Enables you to send and receive faxes, utilizing fax resources available on this computer or on the network. Function Discovery Provider Host (svchost.exe) Manual The Host process for Function Discovery providers, which allows resources to be discovered over the network. Function Discovery Resource Publication (svchost.exe) Automatic Make information available to the computer and its attached resources so that they can be discovered over the network. If the service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network. Group Policy Client (svchost.exe) Automatic Applies settings configured by administrators for the computer and users through Group Policy. If the service is stopped or disabled, applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not work if the service is stopped or disabled.
8

Health Key and Certificate Management (svchost.exe) Manual Provides X.509 certificate and key management services for the Network Access Protection Agent. Enforcement technologies that use X.509 certificates may not function properly without the service. Human Interface Device Access (svchost.exe) Manual Enables generic input access to Human Interface Devices (HIDs), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. If this service is stopped, hot buttons controlled by this service will no longer function. Avoid disabling this service if youre using high-tech mouse or keyboard. Idwlog Service Automatic Use in internet Windows build. IKE and AuthIP IPsec Keying Module (svchost.exe) Automatic Modules used for authentication and key exchange in Internet Protocol security (IPsec). Stopping or disabling the service will disable IKE and AuthIP key exchange with peer computers. Disable this will decrease RAM utilization and improve network performance, but reduce network security. Interactive Services Detection (UI0Detect.exe) Manual Enables notification of user input for interactive services. This enables access to dialogs created by interactive services when they appear. If the service is stopped, notifications of new interactive service dialogs will no longer function. If the service is disabled, both notifications of and access to new interactive service dialogs will no longer function. Internet Connection Sharing (ICS) (svchost.exe) Disabled Provides Network Address Translation (NAT), addressing, name resolution, and/or intrusion prevention services for a home or small-office network. In other words, allow multiple PCs to access Internet by attaching to one computer with ICS enabled. IP Helper (svchost.exe) Automatic Provides automatic IPv6 connectivity over an IPv4 network. If the service is stopped, the PC will only have IPv6 connectivity if it is connected to a native IPv6 network. Less common currently as low popularity of IPv6. Disable will improve network performance and decrease RAM usage. IPsec Policy Agent (svchost.exe) Automatic Enforces IPsec policies created through the IP Security Policies Snap-in or the command-line tool netsh ipsec. If you stop the service, you may experience network connectivity issues if your policy requires that connections use IPsec.

Remote management of the Windows Firewall will not be available if the service is stopped. Disable will improve network performance and decrease RAM usage, but affect negatively network performance. KtmRm for Distributed Transaction Coordinator (svchost.exe) Automatic Coordinates transactions between MSDTC and the Kernel Transaction Manager (KTM). Disable if both MSDTC and KTM is not used. Link-Layer Topology Discovery (Mapper svchost.exe) Manual Creates the Network Map in the Network and Sharing Center. If this service is disabled, the Network Map will not function properly. Messenger Sharing Folders USN Journal Reader Installed if Windows Live Messenger is installed. Disable if dont use Messenger Lives sharing folders. Microsoft .NET Framework NGEN (mscorsvw.exe) Manual Microsoft .NET Framework native image generator (NGEN). Microsoft iSCSI Initiator Service (svchost.exe) Manual Manages Internet SCSI (iSCSI) sessions from the computer to remote iSCSI target devices. If the service is stopped, this computer will not be able to log in or access iSCSI targets. Microsoft Software Shadow Copy Provider (dllhost.exe) Manual Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this service is stopped, software-based volume shadow copies cannot be managed, and will have a negative impact on system redundancy. Multimedia Class Scheduler (svchost.exe) Automatic Used mainly by multimedia applications, this service enables relative prioritization of work based on system-wide task priorities. If the service is stopped, individual tasks resort to their default priority. Requires by Windows audio to give higher priority to multimedia applications. Net.Tcp Port Sharing Service (SMSvcHost.exe) Disabled Provides ability to share TCP ports over the net.tcp protocol. .NET applications that use this service will be affected if disabled. Netlogon (lsass.exe) Manual Maintains a secure channel between the PC and the domain controller for authenticating users and services. If the service is stopped, the computer may not authenticate users and services and the domain controller cannot register DNS records.

10

Network Access Protection Agent (svchost.exe) Manual Enables NAP functionality, which allows network administrators to set security requirements for computers that want to connect to a network. Network Connections (svchost.exe) Manual Manages objects in the Network and Dial-Up Connections folder. Network List Service (svchost.exe) Manual Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change. If disabled, the network icon in system tray (notification area) wont be able to tell if network is connected, although the network connection wont be affected. Disable if not connected to a LAN with multiple computers or if dont share files or printers through LAN. Network Location Awareness (svchost.exe) Automatic Collects and stores configuration information for the network and notifies programs when the information is modified. If the service is stopped, configuration information might be unavailable. Disable if not connected to a LAN with multiple computers or if dont share files or printers through LAN. Network Store Interface Service (svchost.exe) Automatic Delivers network notifications to clients. Stopping the service will cause loss of network connectivity. Offline Files (svchost.exe) Automatic Performs maintenance activities on the Offline Files cache, responds to user logon and logoff events, implements the internals of the public API, and dispatches interesting events to those interested in Offline Files activities and changes in cache state. Disable if not connecting to domain or use only local profiles. Parental Controls (svchost.exe) Manual Enables Parental Controls. If the service is not running, Parental Controls will not work. Peer Name Resolution Protocol (svchost.exe) Manual Enables Serverless Peer Name Resolution over the Internet. If disabled, some Peer-to-Peer and Collaborative applications, such as Windows Meetings, may not function. Peer Networking Grouping (svchost.exe) Manual Provides Peer Networking Grouping services. Peer Networking Identity Manager (svchost.exe) Manual Provides Identity service for Peer Networking.

11

Performance Logs & Alerts (svchost.exe) Manual Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. If this service is stopped, performance information will not be collected. Plug and Play (svchost.exe) Automatic Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. PnP-X IP Bus Enumerator (svchost.exe) Manual Manages the virtual network bus. It discovers network-connected devices using the SSDP/WS discovery protocols and gives them presence in PnP. If this service is stopped or disabled, presence of NCD devices will not be maintained in PnP. PNRP Machine Name Publication Service (svchost.exe) Manual Publishes a machine name using the Peer Name Resolution Protocol. Portable Device Enumerator Service (svchost.exe) Automatic Enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and the Image Import Wizard to transfer and synchronize content using removable mass-storage devices. Disable if dont need to synchronize data with removable storage such as mp3 players. Anyway, the setting will not affect third party applications such as iTunes, but only applications using this service such as Windows Media Player. Print Spooler (spoolsv.exe) Automatic Loads files to memory for later printing. If disabled, user may still be able to print, but need to wait the printing job to finish before able to use computer again. Problem Reports and Solutions Control Panel Support (svchost.exe) Manual Provides support for viewing, sending, and deleting system-level problem reports for the Problem Reports and Solutions control panel. Program Compatibility Assistant Service (svchost.exe) Automatic Provides support for the Program Compatibility Assistant. If this service is stopped, the Program Compatibility Assistant will not function properly. If this service is disabled, any services that depend on it will fail to start. Protected Storage (lsass.exe) Manual Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services, processes, or users. Quality Windows Audio Video Experience (qWave) (svchost.exe) Manual A networking platform for Audio Video (AV) streaming applications on IP home networks.

12

Wave enhances AV streaming performance and reliability by ensuring network quality of service (QoS) for AV applications. The technology is not wide-spread yet, and can be disabled. ReadyBoost (svchost.exe) Automatic Provides support for improving system performance using ReadyBoost. Disable if dont have USB flash drive or dont use this feature. Remote Access Auto Connection Manager (svchost.exe) Manual Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Remote Access Connection Manager (svchost.exe) Manual Creates a network connection. Disable if dont use dial-up connections and VPN-networks. Remote Procedure Call (RPC) (svchost.exe) Automatic Provides the endpoint mapper and other miscellaneous RPC services. Remote Procedure Call (RPC) Locator (locator.exe) Manual Manages the RPC name service database. Remote Registry (svchost.exe) Manual Enables remote users to modify Registry settings on this computer. If this service is stopped, only users on this computer can modify the Registry. Use mostly in corporate network. Routing and Remote Access (svchost.exe) Disabled Offers routing services to businesses in local- and wide-area network environments. Disable if dont need to route network data within a LAN or WAN. Secondary Logon (svchost.exe) Automatic Enables starting processes under alternate credentials. If this service is stopped, this type of logon access will be unavailable. Some application may need this service, such as Postgres. Disable if simultaneous logon to 2 users is needed. Security Accounts Manager (lsass.exe) Automatic Stores security information for local user accounts. Security Center (svchost.exe) Automatic (Delayed Start) Monitors system security settings and configurations. Disable will stop all security warnings. Server (svchost.exe) Automatic Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable, affecting file and printer sharing through LAN.
13

Shell Hardware Detection (svchost.exe) Automatic Provides notifications for AutoPlay hardware events. Disable to remove auto play functionality on removable media. SL UI Notification Service (svchost.exe) Manual Provides Software Licensing activation and notification. Manually run the service when needed for activation or other software licensing issues. Smart Card (svchost.exe) Manual Manages access to smart cards read by this computer. If this service is stopped, this computer will be unable to read smart cards. Smart Card Removal Policy (svchost.exe) Manual Allows the system to be configured to lock the user desktop upon smart card removal. SNMP Trap (Snmptrap.exe) Manual Receives trap messages generated by local or remote Simple Network Management Protocol (SNMP) agents and forwards the messages to SNMP management programs running on this computer. If this service is stopped, SNMP-based programs on this computer will not receive SNMP trap messages. Software Licensing (slsvc.exe) Automatic Enables the download, installation, and enforcement of digital licenses for Windows and Windows applications. If the service is disabled, the operating system and licensed applications may run in a reduced function mode. SSDP Discovery Service (svchost.exe) Manual Enables discovery of UPnP devices on your home network. Superfetch (svchost.exe) Automatic Maintains and improves system performance over time. System Event Notification (svchost.exe) Automatic Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. Tablet PC Input Service (svchost.exe) Automatic Enables Tablet PC pen and ink functionality. Mostly for Tablet PC use. Task Scheduler (svchost.exe) Automatic Enables a user to configure and schedule automated tasks on this computer. If this service is stopped, these tasks will not be run at their scheduled times.
14

TCP/IP NetBIOS Helper (svchost.exe) Automatic Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. Modern network rarely need this service. Telephony (svchost.exe) Manual Provides Telephony API (TAPI) support for programs that control telephony devices and IPbased voice connections on the local computer and, through the LAN, on servers that are also running the service. Disable if dont use dial-up connections. Terminal Services (svchost.exe) Automatic Allows multiple users to be connected interactively to a machine as well as the display of Desktops and applications to remote computers. The underpinning of Remote Desktop (including RD for Administrators), Fast User Switching, Remote Assistance, and Terminal Server. Disable if not using Remote Desktop, and its not needed to remotely connect to another computer. Disable this service will improve system security. Terminal Services Configuration (svchost.exe) Manual Responsible for all Terminal Services and Remote Desktop-related configuration and session maintenance activities that require SYSTEM context. Terminal Services UserMode Port Redirector (svchost.exe) Manual Allows the redirection of printers/drives/ports for RDP connections. Themes (svchost.exe) Automatic Provides user experience theme management. Thread Ordering Server (svchost.exe) Manual Provides ordered execution for a group of threads within a specific period of time. TPM Base Services (svchost.exe) Manual Enables access to the Trusted Platform Module (TPM), which provides hardware-based cryptographic services to system components and applications. If this service is stopped or disabled, applications will be unable to use keys protected by the TPM. Universal Plug and Play Device Host (svchost.exe) Automatic Provides support to host Universal Plug and Play devices. User Profile Service (svchost.exe) Automatic Responsible for loading and unloading user profiles. If this service is stopped or disabled, users will no longer be able to successfully log on or log off, applications may have problems getting to users data, and components registered to receive profile event notifications will not receive them.

15

Virtual Disk (vds.exe) Manual Provides management services for disks, volumes, filesystems, and hardware array objects such as subsystems, controllers, and so on. Set as manual if dont use Disk Management in the Computer Management console. It can be started manually at any time when need to use Disk Management. Volume Shadow Copy (vssvc.exe) Manual Manages and implements Volume Shadow Copies used for backup and other purposes. If this service is stopped, shadow copies will be unavailable for backup and the backup may fail. Disable this service will have a negative impact on system redundancy. WebClient (svchost.exe) Automatic Enables Windows-based programs to create, access, and modify Internet-based files. If this service is stopped, these functions will not be available. Windows Audio (svchost.exe) Automatic Manages audio devices for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. Windows Audio Endpoint Builder (svchost.exe) Automatic Manages audio devices for the Windows Audio service. If this service is stopped, audio devices and effects will not function properly. Windows Backup (svchost.exe) Manual Provides Windows Backup and Restore capabilities. Windows CardSpace (infocard.exe) Manual Securely enables the creation, management, and disclosure of digital identities. Windows Color System (svchost.exe) Manual Hosts third-party Windows Color System color device model and gamut map model plug-in modules. Windows Connect Now Config Registrar (svchost.exe) Manual Acts as a registrar; issues network credential to enrollee. Windows Defender (svchost.exe) Automatic Scans your computer for unwanted software, schedules scans, and gets the latest unwanted software definitions. Can be stopped if user has another anti-spyware application. Entry in registry needs to be removed too to avoid Unable to Start error message. Run msconfig, click on Startup tab and uncheck Windows Defender. Windows Driver FoundationUser-mode Driver Framework (svchost.exe) Manual Manages user-mode driver host processes.
16

Windows Error Reporting Service (svchost.exe) Automatic Allows errors to be reported when programs stop working or responding and allows existing solutions to be delivered. Also allows logs to be generated for diagnostic and repair services. If this service is stopped, error reporting might not work correctly and results of diagnostic services and repairs might not be displayed. Windows Event Collector (svchost.exe) Manual Manages persistent subscriptions to events from remote sources that support the WSManagement protocol. This includes Windows Vista event logs, hardware, and IPMI-enabled event sources. If this service is stopped or disabled, event subscriptions cannot be created and forwarded events cannot be accepted. Windows Event Log (svchost.exe) Automatic Manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain-text formats. Stopping this service may compromise security and reliability of the system. Windows Firewall (svchost.exe) Automatic Helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network. Not needed if another firewall exists. Windows Image Acquisition (WIA) (svchost.exe) Manual Provides image acquisition services for scanners and cameras. Can be disabled if dont have both gadgets. Windows Installer (msiexec.exe) Manual Installs, repairs, and removes software according to instructions contained in .msi files. Windows Management Instrumentation (svchost.exe) Automatic Provides a common interface and object model to access management information about operating systems, devices, applications, and services. If this service is stopped, most Windowsbased software will not function properly. Windows Media Center Extender Service (mcx2svc) Disabled Windows Media Center Service to allow connection for Media Center devices such as XBox 360. Windows Media Center Receiver Service (ehrecvr.exe) Manual Windows Media Center Service for TV and FM broadcast reception. Windows Media Center Scheduler Service (ehsched.exe) Manual Starts and stops recording of TV programs within Windows Media Center.
17

Windows Media Center Service Launcher (svchost.exe) Automatic (Delayed Start) Starts Windows Media Center Scheduler and Windows Media Center Receiver services at startup if TV is enabled within Windows Media Center. Windows Media Player Network Sharing Service (wmpnetwk.exe) Manual Shares Windows Media Player libraries with other networked players and media devices using Universal Plug and Play. Windows Modules Installer (trustedinstaller.exe) Manual Enables installation, modification, and removal of Windows updates and optional components. If this service is disabled, you may not be able to install or uninstall Windows updates. Windows Presentation Foundation Font Cache (presentationfontcache.exe) Manual Optimizes performance of Windows Presentation Foundation (WPF) applications by caching commonly used font data. WPF applications will start this service if it is not already running. It can be disabled, though doing so will degrade the performance of WPF applications. Windows Process Activation Service (svchost.exe) Provides process activation, resource management, and health management services for message-activated applications. Windows Remote Management (WS-Management) (svchost.exe) Manual Implements the WS-Management protocol for remote management, a standard web services protocol used for remote software and hardware management. Windows Search (searchindexer.exe) Automatic Provides content indexing and property caching for file, email, and other content (via extensibility APIs). If the service is stopped or disabled, the Explorer will not be able to display virtual folder views of items, and search in the Explorer will fall back to item-by-item slow search. Used to call Indexing Service. Disable will not affect search function,but search will be perform slower. Windows Time (svchost.exe) Automatic Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. Windows Update (svchost.exe) Automatic (Delayed Start) Enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled,

18

users of this computer will not be able to use Windows Update or its automatic updating feature, and programs will not be able to use the Windows Update Agent (WUA) API. WinHTTP Web Proxy Auto-Discovery Service (svchost.exe) Manual Implements the client HTTP stack and provides developers with a Win32 API and COM Automation component for sending HTTP requests and receiving responses. In addition, WinHTTP provides support for auto-discovering a proxy configuration via its implementation of the Web Proxy Auto-Discovery (WPAD) protocol. Most applications dont use this service. Wired AutoConfig (svchost.exe) Manual Performs IEEE 802.1X authentication on Ethernet interfaces. WLAN AutoConfig (svchost.exe) Manual Enumerates WLAN adapters, and manages WLAN connections and profiles. WMI Performance Adapter (wmiapsrv.exe) Manual Provides performance library information from WMI HiPerf providers. Workstation (svchost.exe) Automatic Creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. World Wide Web Publishing Service (svchost.exe) Provides web connectivity and administration through the Internet Information Services Manager.

19