Better Windows ServicesWhich services should be running?
The honest answer is that nobody can tell you, and every list that claims to is describing a machine that is not yours. What can be answered is narrower and far more useful: what does not add up on this machine, and what is different from when it worked.
Why the general question has no answer
- The set differs by Windows edition, version and role. A domain controller, a laptop and a container host disagree about almost everything, and a list written for one is wrong for the others.
- Half of what is installed is not from Windows. Drivers, agents, update services, licence daemons - every one of them was put there by something, and no general list knows which.
- Most services are meant to be stopped. A modern Windows starts a fraction of what it registers: the rest wait for a trigger - a device arriving, a port opening, joining a domain - and stopped is their correct state.
- "Disable these for performance" lists are how machines break. The service that looks idle is the one something else starts on demand, and the failure shows up a week later somewhere unrelated.
The questions that do have answers
What should be up and is not
start:auto !status:running
Windows was told to start these and they are not running. On a healthy machine this is a short list - a couple of entries that start late and stop again. Anything else is worth a look.
What is disabled and running anyway
mismatch:running
Configuration and state disagree. Usually somebody disabled it without stopping it, and the next restart will be a surprise.
What points at a file that is gone
file:missing
An uninstall that left the registration behind. Harmless until something tries to start it, and a clue about what used to be on this machine.
What nobody signed
signed:no peruser:no
Not proof of anything by itself, and the right place to start reading. The second term drops the per-user families, which otherwise fill the list with near-duplicates.
What asks for the strongest privileges
privilege:SeDebugPrivilege
A privilege that lets a process open any other one. A handful of legitimate services ask for it, and it is worth knowing which on your machine do.
What is waiting for a trigger
trigger:any status:stopped
Stopped because nothing has asked for them yet, rather than because something is wrong. Knowing which these are is how the first list stops being alarming.
The one that beats all of them
Ask the machine itself, when it was working.
Take a snapshot the day the machine goes into service. Then should this be running becomes was this running when everything worked - a question about your machine rather than about a machine in an article.
bws snapshot create C:\baselines\web01.json --note "after the build"
# ... a week, a patch, or an incident later
bws snapshot diff C:\baselines\web01.json --liveConfiguration is reported apart from running state, so the answer is not forty services that happen to be up - it is the start type somebody changed.
Auditing a machine for driftBefore you stop anything
Every stop in this tool shows its plan first: the steps, what comes down with them, and a warning when one of them is something the machine does not work without. The list of those is a starter list of seven - the two halves of RPC, the account manager, key isolation, the session manager and plug and play - and Remote Desktop is not on it, so over a remote session, read the plan.