Services are background programs that start with Windows, often with high privileges. Every running service is a possible doorway, so disabling what you do not need is classic hardening. Work on your own VM from a snapshot.

What services are

A service runs without a signed-in user. Examples are the Print Spooler, Windows Update, and the Windows Firewall. Each has:

  • Startup type: Automatic, Automatic (Delayed Start), Manual, or Disabled.
  • Status: Running or Stopped.
  • Log On As: the account it runs under, such as Local System or Network Service.

Open the list with Win+R then services.msc. Double-click a service to see its description, path to executable, and dependencies. Read the description before changing anything.

Services commonly reviewed

Whether to disable a service depends on the machine’s role and the README. Examples often examined:

  • Telnet: sends text, including passwords, unencrypted. Disable if present.
  • Remote Registry: lets remote users read the registry. Usually disable.
  • Remote Desktop Services: disable unless the README says remote access is needed.
  • FTP, SNMP, or Simple TCP/IP services: disable if not required.
  • Print Spooler: disable if the machine does not print.
  • Windows Defender, Windows Firewall, and Windows Update: keep these running. Attackers and mistakes often turn them off.

Never disable a service you do not understand without checking its dependencies. Stopping the wrong one can break networking or sign-in.

Command-line control

sc query state= all
sc config RemoteRegistry start= disabled
sc stop RemoteRegistry
Get-Service | Where-Object {$_.Status -eq "Running"}
Set-Service -Name RemoteRegistry -StartupType Disabled
Stop-Service -Name RemoteRegistry

Note the space after start= in sc syntax; it is required.

Startup items

Programs can also launch at sign-in without being services. Check:

  • Task Manager > Startup tab: shows apps and their impact. Disable ones you do not recognize.
  • Settings > Apps > Startup.
  • Task Scheduler (taskschd.msc): look for tasks with odd names or that run from user folders.
  • The Startup folder: shell:startup in the Run dialog.

Compare each item against the README and against what the machine needs. For unfamiliar items, check the file location and digital signature in the Properties window.

Process for each suspicious item

  • Identify what it is and where the file lives.
  • Check whether the README or a legitimate program requires it.
  • Disable first, observe, and only then uninstall or delete.
  • Record the change.

Check your understanding

1. What is a service?

  • A user’s document
  • A background program that can start without a signed-in user
  • A type of password
  • A web page

Answer: A background program that can start without a signed-in user. Many run with elevated rights.

2. Which service is risky because it sends data, including passwords, unencrypted?

  • Windows Update
  • Telnet
  • Windows Firewall
  • Windows Defender

Answer: Telnet. It has no encryption and should be disabled.

3. What should you do before disabling an unfamiliar service?

  • Delete the file at once
  • Read its description and dependencies
  • Reboot ten times
  • Make it Automatic

Answer: Read its description and dependencies. Stopping a needed service can break the system.

4. Where else can programs be set to run at sign-in besides services?

  • Task Manager Startup tab and Task Scheduler
  • Calculator
  • Event Viewer only
  • The Recycle Bin

Answer: Task Manager Startup tab and Task Scheduler. Both, plus the Startup folder, are places to check.

PreviousNext