CryptoLock

How to Manage Windows Services: Start, Stop, and Optimize

6 min read

Windows runs dozens of background services. Learn which ones you can safely disable to free up RAM and CPU, and how to manage services via Services console and PowerShell.

Windows runs 80–100 background services by default. Many are essential, some are optional, and a few are safe to disable on certain configurations. Here's how to manage them intelligently.

Open Services Console

Win + R → services.msc

Shows all services with:

  • Status — Running or Stopped
  • Startup Type — Automatic, Manual, or Disabled
  • Log On As — which account runs the service

Service Startup Types

  • Automatic — starts at boot, before user login
  • Automatic (Delayed Start) — starts 2 minutes after login, less impact on boot time
  • Manual — starts only when something requests it
  • Disabled — won't start under any circumstances

View and Manage via PowerShell

# All services sorted by status
Get-Service | Sort-Object Status -Descending | Format-Table Name, Status, StartType, DisplayName

# Running services using the most memory
Get-WmiObject Win32_Service |
  Where-Object {$_.State -eq 'Running'} |
  ForEach-Object {
    $proc = Get-Process -Id $_.ProcessId -ErrorAction SilentlyContinue
    [PSCustomObject]@{
      Name = $_.Name
      DisplayName = $_.DisplayName
      'RAM(MB)' = if($proc){[math]::Round($proc.WorkingSet/1MB,0)}else{0}
    }
  } | Sort-Object 'RAM(MB)' -Descending | Select-Object -First 15

# Stop and disable a service
Stop-Service -Name "ServiceName" -Force
Set-Service -Name "ServiceName" -StartupType Disabled

# Start and set to automatic
Set-Service -Name "ServiceName" -StartupType Automatic
Start-Service -Name "ServiceName"

Services Safe to Disable on Desktop PCs

Fax — Fax — Not needed unless you use a fax machine.

Set-Service Fax -StartupType Disabled

Windows Search — WSearch — Disable if you use Everything instead or rarely use search.

Stop-Service WSearch -Force
Set-Service WSearch -StartupType Disabled

Bluetooth Support Service — bthserv — Disable if you have no Bluetooth devices.

Stop-Service bthserv -Force
Set-Service bthserv -StartupType Disabled

Print Spooler — Spooler — Disable if you have no printer (also reduces attack surface).

Stop-Service Spooler -Force
Set-Service Spooler -StartupType Disabled

Remote Registry — RemoteRegistry — Allows remote registry access. Disable for security.

Stop-Service RemoteRegistry -Force
Set-Service RemoteRegistry -StartupType Disabled

Tablet PC Input Service — TabletInputService — Only needed for touchscreen/stylus.

Xbox Services — XblAuthManager, XblGameSave, XboxNetApiSvc — Disable if you don't use Xbox features.

"XblAuthManager","XblGameSave","XboxNetApiSvc","XboxGipSvc" |
  ForEach-Object { Set-Service $_ -StartupType Disabled -ErrorAction SilentlyContinue }

Services You Should NOT Disable

Service Why it's needed
Windows Defender Antivirus Core security
Windows Update Security patches
Windows Firewall Network security
Cryptographic Services SSL, Windows Update
DCOM Server Process Launcher Core Windows functionality
RPC (Remote Procedure Call) Required by most Windows features
Windows Management Instrumentation Required by many management tools
Task Scheduler Scheduled maintenance tasks
System Events Broker Core event system

Change Service to Delayed Start

Services set to Automatic Delayed Start have much less impact on boot time:

# Change from Automatic to Automatic Delayed
Set-Service -Name "SysMain" -StartupType AutomaticDelayedStart

# Check current startup type
Get-Service SysMain | Select-Object Name, StartType

PowerShell's Set-Service doesn't support AutomaticDelayedStart directly on all versions. Use sc.exe if needed:

sc config "SysMain" start=delayed-auto

Audit Services for Security

# Services running as SYSTEM (highest privilege)
Get-WmiObject Win32_Service |
  Where-Object {$_.StartName -eq 'LocalSystem' -and $_.State -eq 'Running'} |
  Select-Object Name, DisplayName, PathName

# Services listening on network ports
Get-NetTCPConnection -State Listen |
  Select-Object LocalPort,
    @{n='Service';e={(Get-WmiObject Win32_Service | Where-Object {$_.ProcessId -eq $_.OwningProcess}).Name}} |
  Sort-Object LocalPort

Reset Services to Windows Defaults

If you've changed services and things are broken:

# Reset specific service to default via sc.exe
sc config "wuauserv" start=auto
sc config "WSearch" start=delayed-auto
sc config "Spooler" start=auto

Summary

Use services.msc for visual management. Use PowerShell for bulk operations. Safe to disable on desktop: Fax, Remote Registry, Bluetooth (if unused), Xbox services. Don't touch: Defender, Firewall, WMI, RPC, Cryptographic Services. For boot performance: change Automatic services to Delayed Start rather than disabling them entirely.

Related articles

← All articles