What services are safe to disable?

[gregrocker]

Thank you for clarifying. I am not a Security specialist but focus almost entirely on performance. I don't know how Win7 could be made safer by disabling Services. It appeared from your quote that they were offering some variance for IT Pro's maintaining Server. I frankly don't have time to look into it with the caseload I have here but am happy to take your word that it is about Security.

I do not use Java on my installs and don't recommend it due to the Security hazards, unless it is required to run a specfic function for which I will install it temporarily. This has happened only once for me. It isn't a MS service but an installed program.

There is always a Theme with the standard default being Aero, but some use the Win2000-style Classic which is ugly as sin but still a Theme. I don't know how there wouldn't be a theme, or why one would want to mess with its enabling Service. I have never heard that it is a security risk before now and I monitor most of the trends here where we see everything related to Win7.

Frankly my only concern here is consumers being taken in by some Service edit list which is utterly unnecessary and harmful without proper warning of unintended consequences - which I think the thread does adequately.

 

[UsernameIssues]

If you have ever watched a really slow computer shutdown, you can sometimes see the theme (a window overlay) peel diagonally away from each window. You get to see the classic theme window underneath. The classic theme is called a theme, but it does not require the use of the Theme service to generate overlays.

As I mentioned, this is not the forum for this discussion... but I gave it a try for exitPr0gram's sake. I have the answers that I need. exitPr0gram will have to go elsewhere to learn his answers :-(


Thanks for your time and patience with me on this topic. I hope that I did not burn any bridges. I won't be leaving this forum over this divisive issue as others have*.

*edit: sorry that I was not clear. You cannot get rid of me that easy. See this post for clarification.

 

[gregrocker]

Not at all, friend. Your ideas are well-reasoned and quite advanced. I should not have questioned why a discussion of Server edits was brought into the thread as it was clearly to make your point that some edits are countenanced by MS, as in Security.

Wow, I didn't know this is considered that divisive. I've never really seen anyone passionately challenge the common position that Win7 MS Service edits are a minefield of unintended consequences. They should try that instead of leaving. Why would someone storm out over a service edit?

Normally these threads appear to be started by hackers who never give a good reason for what can be gained, seem to be operating with no accountability or point of view other than to hack away. They never come back to report unintended consequences as we did in the earliest threads where we tested these. They just move on to hack some more, hacking for its own ends.

Then we get the cases where those duped by them suddenly can't install a program or have lost some other function or worse.

 

[Layback Bear]

I have no idea why anybody would leave this forum over a thread like this.

For all those reading this thread; members and non members. Be careful if you intend to mess with Windows 7 Services.

Web sites like Black Viper can get you in a world of trouble if you don't have the proper knowledge.
Members of this forum try very have to help people with their Windows 7 system and we also try very hard to do no harm.
So this is a warning from me Layback Bear (Be careful). If it's your computer you will have to decide what to do.

 

[UsernameIssues]

Sorry for not being clear. People have left over the way this topic was handled in an older/nastier thread. This one was pretty civil. Hopefully, you can tell that I can take it or leave it. I'm not passionate about wanting a voice on this topic in this or any other forum. I have the info that I need. I know which MS services I can do without. I think that I understand the risks and I have ways to mitigate them*.

What I don't have is the means to research disabling MS services that I must have. e.g. exitPr0gram mentioned disabling NETLOGON. I'm in a domain as an AD domain admin, so I cannot disable that service. So I have no experience running W7 with that service not running. So I cannot help exitPr0gram on that item. So it seems that no one else will (can?) even discuss this hardening concept with exitPr0gram - much less go into the details of each service listed. So like I mentioned, exitPr0gram will need to go elsewhere if a second or third opinion is desired. So........

People are going to disable MS services in the name of security.
You can preach abstinence all day long...
...or you can provide sex ed** and a condom***.


*e.g I keep some MS services disabled inside a VM that I use when doing AD admin tasks. The VM is rebuilt from scratch about every two months due to new Windows Updates and the way that I freeze/manage my VMs.

**proper testing and research techniques?

***system images?

 

[exitPr0gram]

Sorry for not being clear. People have left over the way this topic was handled in an older/nastier thread. This one was pretty civil. Hopefully, you can tell that I can take it or leave it. I'm not passionate about wanting a voice on this topic in this or any other forum. I have the info that I need. I know which MS services I can do without. I think that I understand the risks and I have ways to mitigate them*.

What I don't have is the means to research disabling MS services that I must have. e.g. exitPr0gram mentioned disabling NETLOGON. I'm in a domain as an AD domain admin, so I cannot disable that service. So I have no experience running W7 with that service not running. So I cannot help exitPr0gram on that item. So it seems that no one else will (can?) even discuss this hardening concept with exitPr0gram - much less go into the details of each service listed. So like I mentioned, exitPr0gram will need to go elsewhere if a second or third opinion is desired. So........

People are going to disable MS services in the name of security.
You can preach abstinence all day long...
...or you can provide sex ed** and a condom***.


*e.g I keep some MS services disabled inside a VM that I use when doing AD admin tasks. The VM is rebuilt from scratch about every two months due to new Windows Updates and the way that I freeze/manage my VMs.

**proper testing and research techniques?

***system images?

The ENTIRE point of me posting this is to help figure out which are the most common services that can be disabled. Not to piss member off from leaving the forum. BTW Did they actually delete their forum account or just stop participating in the thread? If they actually left sevenforums, entirely... thats pretty stupid IMHO.

As you stated... This is for security reasons. If you NEVER use Bluetooth or Remote Access.... Then why leave that service available anyways? Both of those have exploits that can be taken advantage of. If you look at the list of services that i've disabled they are pretty simple. Also, as stated previously in post#36, i have had NO issues disabling these service. And i have installed quite a few programs before AND after disabling them.

It is the user's problem if they do not want to do the research necessary. You don't just read something and say "Oh, i want to do that" and then just do it. But unfortunately there are users out there like that and they would have no problem blaming the forum site.

In more than one place, Microsoft suggests that "Unnecessary services should be disabled".

Doing so is such a difficult task that MS has a Security Configuration Wizard for server operating systems.

There are many W7 users that wish to extend the concept of security hardening via disabling services to non server operating systems... but this is extremely hard to do. You could actually end up lessening your security. The W7 images deployed where I work do indeed have some services disabled via GPO, but you would not believe the time and effort that goes into testing each business related app via Virtual Machines to arrive at the service configurations.

I'm mentioning the security angle because exitPr0gram is in the thread

Not MS Services. The "unnecessary" ones can be viewed and deselected after hiding all MS Services on the msconfig Services tab, all except your AV and any sync. Most are on Startup tab but some are deemed Services

The MS documentation that I read concerning making Windows more secure left me with the impression that MS's Security Configuration Wizard disabled MS Services based on the server's role. Watching videos of users configuring MS's Security Configuration Wizard for Windows Server 2008 r2 reinforced that impression. Since I cannot test MS's Security Configuration Wizard first hand, I'll take your word for it that MS does not do that.

I might also be wrong about there being a correlation between Windows 2008 r2 core services and W7 core services. There might be no value in learning from MS's hardening of that server OS.


If a user has Java installed, but does not need/use Java, then they incur Java related security risks for no good reason. If a Windows 7 user does not use the Themes service, why should they leave the Themes service running?

Since the Windows Theme service is a known attack vector for W7 (MS13-071), there does seem to be some security related value in disabling that service if it is not being used. While this particular attack could not be carried out via drive by installation (as far as MS knows), those who keep the Windows Theme service running are accepting the risk that such a different drive by install/attack will strike them. It is fine to run that small risk as long as the user is benefiting from running the Theme service.

A bug was found with Windows 7 Aero (MS10-043). Those that don't use themes probably were not at risk from that bug. Disabling the W7 Themes service probably had no security implications for this bug.



I've already stated that it is extremely difficult to determine which services are safe to disable for a given set of applications. It is certainly possible to lower the security of a computer by turning off the wrong service(s). And each set of operating system patches makes for more uncertainty about the interactions between services. I am aware that users disabling services makes our volunteer jobs harder. Am I wrong to think that a disabled service is less likely to be attacked by malicious objects?

I actually use Win7 Basic to help improve with performance, anyways.

And you have proven my point again... If you do not need or use JAVA then why install it? Java has constant exploits and continuously needs to be updated to patch up the holes. Even though JAVA is somewhat unrelated to services... If you DID have Java installed but hardly ever used them... just disable the service and then re-enable when u need to use Java. Doing this would increase security.

Again, i will consider this discussion closed since no one feels comfortable posting on this thread because people might "Mess up" their machines. The two sites that i listed on post#36 is where i got my information from and so far so good. As far as PERFORMANCE goes. i have a Dell Inspiron 530 with 4GB RAM + Windows Ready Boost and my computer boots in 30 seconds after disabling these services. Pretty impressive to me. I have my Logitech G510 startup app that needs to load, MSE loads, and COMODO loads.... All under 30-35 seconds.

Sorry to piss anyone off. I'm just trying to be a contributor to the forum. At least on the stuff the I'M interested in modifying/playing with.

Although i must be honest, i am a bit disappointed that no body would like to help even determine which services are disable. I know it would require a bit of typing "Dont disable this if you plan on using this, etc, etc". I just thought i'd receive more support, is all.

 

[UsernameIssues]

Since I cannot locate the thread...
...I cannot confirm my recollection
(which at my age - one really must do

Let's just say it was not pretty. I doubt that accounts were closed. They just stopped posting.

edit I did learn some new stuff in this thread - so I'm happy

 

[gregrocker]

Here's some feedback since you asked:

30 seconds is standard boot time, nothing special. The best upgrade is an SSD which cuts it to around 10 seconds.

Have you done a perfect Clean Reinstall - Factory OEM Windows 7 on the Inspiron? The factory install is inferior and performs noticeably slower and more buggy.

I would not use MSE with Comodo, and I would not use Comodo which presents nothing but problems here.

With 4gb RAM I would run 32 bit for best performance, edit Visual Effects of fading, sliding, dragging intact and selection rectangle from Optimize Windows 7 - Windows 7 Forums.

Better to upgrade RAM than to use Ready Boost.

No need for any service edits.

 

[exitPr0gram]

Here's some feedback since you asked:

30 seconds is standard boot time, nothing special. The best upgrade is an SSD which cuts it to around 10 seconds.

Have you done a perfect Clean Reinstall - Factory OEM Windows 7 on the Inspiron? The factory install is inferior and performs noticeably slower and more buggy.

I would not use MSE with Comodo, and I would not use Comodo which presents nothing but problems here.

With 4gb RAM I would run 32 bit for best performance, edit Visual Effects of fading, sliding, dragging intact and selection rectangle from Optimize Windows 7 - Windows 7 Forums.

Better to upgrade RAM than to use Ready Boost.

No need for any service edits.

Thanks for the reply.

I have done what i consider a "Clean" install which is to boot to Windows Disc, Format the drives, Delete the partitions, install Windows7... Afterwards Activate Windows... Perform Update IMMEDIATELY after activating, and then downloading your security (MSE, Windows Defender, Etc.)

What kind of problems are you talking about concerning running COMODO with MSE? I've experienced none, so far...

I will try the 32 version like you recommended... But i JUST did a clean install on this machine and i really don't want to to do another one :shock:

This machine is maxed out on RAM with 4GB which is why i use ReadyBoost and SSD's are expensive. I am planning on just selling this one and building a new machine once the finances allow me to do so.

P.S.

The Optimize Windows 7 link you provided on Post#''s 8, 9, and 10 has somethings in it directly related to this thread (Disabling services) just not in great detail.

 

[exitPr0gram]

Since I cannot locate the thread...
...I cannot confirm my recollection
(which at my age - one really must do

Let's just say it was not pretty. I doubt that accounts were closed. They just stopped posting.

edit I did learn some new stuff in this thread - so I'm happy

If you don't mind me asking, what are those one or two things you learned in this thread before i resolve this thread?

 

[gregrocker]

I think you'd be surprised at how quickly the prices are coming down on SSD's. We had a 120gb posted here last week from Tiger Direct for $49 and are starting to see 240gb for under $100. This puts them within reach. Watch Tiger Direct, Best Buy and New Egg.

I would try running MSE with the Windows Firewall to see if it improves performance. The only reason I would use a custom firewall is if there are extra requirements since the Win7 firewall is perfected.

Everything that works best in tens of thousands of installs we've helped with here is compiled in Clean Reinstall - Factory OEM Windows 7 .

Our threads are never closed but live on for others to learn and contribute which is why its important they not encourage risky changes.

Actually hearing of any performance improvement from editing Services would be a good start before advising those changes in Win7, and we are still waiting after five years to hear of any.

 

[exitPr0gram]

I think you'd be surprised at how quickly the prices are coming down on SSD's. We had a 120gb posted here last week from Tiger Direct for $49 and are starting to see 240gb for under $100. This puts them within reach. Watch Tiger Direct, Best Buy and New Egg.

I would try running MSE with the Windows Firewall to see if it improves performance. The only reason I would use a custom firewall is if there are extra requirements since the Win7 firewall is perfected.

Everything that works best in tens of thousands of installs we've helped with here is compiled in Clean Reinstall - Factory OEM Windows 7 .

Our threads are never closed but live on for others to learn and contribute which is why its important they not encourage risky changes.

Actually hearing of any performance improvement from editing Services would be a good start before advising those changes in Win7, and we are still waiting after five years to hear of any.

Wow 240GB SSD for under 100? That's awesome.

I can't lie, i haven't been in the market for one in awhile. And like i said, instead of beefing this machine up, i might just get a whole new computer. The day i get an SSD will be the day that i can get a case and motherboard that can hold an AWESOME graphics card to play my games at EXTREME settings

I can't lie though... if i see an SSD made by Intel for around bucks, i'd probably buy it.

 

[exitPr0gram]

Leave services alone. In lots of testing, I was almost unable to prove any benefit whatsoever to shutting down services and in most cases the system performed worse with services disabled.

Can you please provide a link to where it sais a system performed worse with certain services disabled? In this thread, i have listed all the ones that i have disabled, whether for security, or for performance.

I feel like i'm running in circles on trying to get an answer an what detrimental effects disabling services (that you do NOT need) will have on a Windows 7 machine.

 

[gregrocker]

PParks is a respected member here who echoes the opinion of almost everyone who has in-depth experience with Win7.

It is not up to us to prove that there are not problems with hacking Win7. We have stated our position clearly against disabling any MS Services by consumers.

The burden of proof is on those who want to disable MS Services to show that there is any appreciable performance improvement and this has never yet been shown that I have seen. Instead we see random hit-n-run suggestions by hackers to disable a Service which causes unintended consequences, often months later.

I do feel like we are going around in circles, especially when you just now PM to ask if I have any problem with this after I've repeated myself here ad nauseum. Had you even read this thread until now?

 

[exitPr0gram]

PParks is a respected member here who echoes the opinion of almost everyone who has in-depth experience with Win7.

It is not up to us to prove that there are not problems with hacking Win7. We have stated our position clearly against disabling any MS Services by consumers.

The burden of proof is on those who want to disable MS Services to show that there is any appreciable performance improvement and this has never yet been shown that I have seen. Instead we see random hit-n-run suggestions by hackers to disable a Service which causes unintended consequences, often months later.

I do feel like we are going around in circles, especially when you just now PM me to ask if I have any problem with this after I've repeated myself here ad nauseum.

Well i'm sorry that i PM'd you to see if you had some information for me. Maybe it was "taboo" to do so. Wont message you again, promise.

Regardless, I will post if i run in to any problems on my personal home PC with the services that I've disabled. Which, when it comes right down to it, is all that i'm trying to figure out. Its known it can provide security and performance. Whether it's a "Big enough improvement" to tell is not the point. Improvement in security or performance is improvement in security in performance, no matter how you look at it. Especially on low end systems.

And by you saying "we see random hit-n-run suggestions by hackers to disable a Service which causes unintended consequences, often months later." are you insinuating that actual "Hackers" recommended to disable services with verified malicious activity cause by disabling said service?

 

[gregrocker]

No but I consider such inadvisable service edits to be hacking.

Again where is any proof of performance improvements you persist to claim resulting from MS Service edits?

You were provided with actual performance improvements you can achieve with your system

 

[exitPr0gram]

No but I consider such inadvisable service edits to be hacking.

Again where is any proof of performance improvements you persist to claim resulting from MS Service edits?

You were provided with actual performance improvements you can achieve with your system

When you say "Hacking" do you mean tweaking Windows? Or "hacking" as in doing something with malicious intent? I simply don't understand how disabling a Microsoft service you never use could open you up to an attack. Corporate companies disable services ALL the time. The only difference is that this is a HOME pc.

I do not have "Proof" of any performance/security improvement but neither have i seen a link indicating the opposite which are you guys recommending not to make any changes..

If you'd like, if you have a way of me testing the performance/security improvements just tell me and i'll do it so that we can get this settled once and for all and stop bickering over whether or not user's should disabled MS services.

 

[Layback Bear]

exitPr0gram many of us have given our opinions.
It's your computer do what you want with it.

We don't want to argue about it.
We don't want to do it.
We don't want to test it on our equipment.
We don't want to do anymore Googling to prove our point.
We lost the OP. Not a good thing.

Do your tweaking the way your heart desires and have fun.

Have a nice day.

 

[UsernameIssues]

Leave services alone. In lots of testing, I was almost unable to prove any benefit whatsoever to shutting down services and in most cases the system performed worse with services disabled.

Can you please provide a link to where it says a system performed worsewith certain services disabled? In this thread, i have listed all the ones that i have disabled, whether for security, or for performance.

I feel like I'm running in circles on trying to get an answer an what detrimental effects disabling services (that you do NOT need) will have on a Windows 7 machine.

Benchmarking (with its flaws) might prove that you have no performance loss with services disabled. You cannot prove (to my satisfaction) that your list of disabled services and your system stability data is meaningful to every other computer*. Thus your labor would not settle anything "once and for all".

*Because your computer has usage patterns and 3rd party software that other computers might not have.


About your list of disabled services; I was not expecting any individual member here to research each and every item. I was hoping that (with enough sets of eyes) someone could say: "Oh, I had <insert a specific service> disabled too and this negative event happened......" The problem is, this forum does not have enough members with current experiences in this type of hardening. There might be some members that have MS services disabled, but they are not willing to admit/defend it here; and/or they've not noticed this thread.


As for the things that I've learned:
1) My employer still uses GPO to disable certain services on certain computers instead of using SCCM. I've not asked why, but horror stories like this one, might be the reason.
2) I should not post when I'm really tired...
...I've not stuck to a level of citing references that I prefer
...I did not always stay on topic.
3) I should not have mention people leaving the forum without being able to cite references.
4) There are other things that I've learned too, but I don't want to dig up the references

I should also clarify, that my AD domain admin duties are infrequent (maybe once or twice a month). That is not my full time job. I only know how to do the things that I need to do. It is a very small subset of what an AD domain admin could do. Its relevance to the thread was/is: W7 computers that are used to perform AD domain admin duties have some MS services disabled where I work. I'm not going to list those services because doing so could get me fired :-(


gregrocker and Layback Bear,
Thanks for your patience with me

 

[LMiller7]

The problem with disabling services is that there is no way of knowing for sure everything that each service does. Microsoft has never published this information. Anyone disabling system services is in uncharted territory and you will have to make your own way. Every service serves some purpose and when disabled you must accept that some functionality will be lost. Will that functionality be important to you is a difficult question. It depends on what devices and applications you are using and how the system is configured. The possibilities are virtually endless.

I do have some experience with disabling services from my younger days but will not post it (do not ask) as the information may no longer be relevant and is likely to be misinterpreted. I am not interested in experimenting with this.