Infohub‎ > ‎Articles‎ > ‎

Optimizing windows services


To have your system boot in a short time, you also need to enable only useful services.
Here comes the problem: which are the useful services?
The simple answer is: useful services are the ones that do a job you're interested in. As you can note, this is not a real answer.

Windows, as other operating systems, comes with a series of services that are configured to start at every boot. Any of these does something and also there are dependencies between them (you have a dependency when starting service X requires service Y to be started also).

The initial mix of service is some kind of one size fits all, so let's discuss about the way to personalize it.
First of all, there are a lot of tools that "optimize" system services startup. Since as we know "useful" is a personal point of view, the only programs of this type you can afford to use are those who ask you about the intended usage of your system.
I think that if you can consciously answer these questions, you also can optimize your system by yourself. This article gives you some hints on this way.

To have a look at system services type services.msc at your command prompt. You see a list and eventually a description of the services installed on your machine.
There are 3 possible state for a service startup:
Disabled: the service will never load, even trying to start it manually. Every service that depend on the disabled ones, will not start.
Manual: the service is not started until the user or another service will start it. If there is a service that depends on a manual one, this will be started.
Automatic: the service will start without external help, bringing up all its dependencies.

The status column tells you the current state of the service. You can have Manually startup services shown as running (brought to life by others), and Automatic services that are not running (since they do their work and then stop).

The dependencies tab shows the explicit dependencies between services (look at "computer browser"): note that not all of them must be declared here. One application may need a service and start it when it is the right time. Please note that system drivers are also "services". 
As an example you can consider tools that rely on the Winpcap library that need the NPF driver/service to be running. This service is not started at boot, so it is started on need. This also means that the user must have the rights to do it (by default admin have it) and so, indirectly, to use the program.
Sometimes you cannot figure out which process start which service: remember to check the processes that run on startup. Consider using Autoruns that lets you disable and reenable items with no hassle.

So the general way to dig into service startup optimization is disabling unneeded ones and set to manual the ones that are used "on demand".

You must read the documentation about services, comprehend their purpose and change the startup type.
Again a lot of sites have pseudo-documentation about services. My favorite way to find info about them is reading official papers from Microsoft who made them all. You can find them at Microsoftand digging into TechNet or MSDN.

Unfortunately, not all the interactions between services are described in the official documentation, so you need to google around to find other sources.
Never take information as is comes: the better way is to experiment on your virtual machine to avoid surprises.

Start by changing your target service to manual and restart the PC. If the service does not come up, no other service depend on it. Now use your system normally, and check if you lack functionalities or, very important, if the System and Application log display events complaining about the service. If it all seems working, set the service to disabled and step to the next one.
Some services also can be stopped while running. You can use the services console or just type net stop MyService from the command line. Also you can use the SC tool from Microsoft orPsService from SysInternals.
If after stopping the service you can continue working, this could be one service to change the startup type and further experiment.

There are some services that have a visible impact when stopped: try to stop the Themes service and you’ll go back to Windows 2000 like interface instead of the colored one of XP. 
Note that not starting services, speeds up system boot time but also have generally positive impact on memory consumption and system performance.

This is not so easy although. Suppose you say "I don’t need to run scheduled tasks, so I’m going to stop the task scheduler service".
Obviously you double checked that programs did not use it (IE, Norton Antivirus, …) and set it to manual.
You’re happy and could probably live all the rest of your life telling your friends how different is your life now. You probably don’t know that you lost some Windows XP prefetch optimization features that mystically depend on it (ProcessIdleTasks export from Advapi32).
As we said, most important thing is digging for documentation, not rely on "last time worked" posts around…

Finally we can look into boot time drivers. Using LoadOrder or boot time logging, you can see which drivers start. Why you should look here and find something wrong? Because different programs that you install put drivers here and don’t remove them on uninstall. Once you find an old driver here, set its Start value to 4 and see if your system boots correctly (You can find Start value in HKLM\System\CurrentControlSet\Services\MyService key).

Since also 3rd party (non Microsoft) applications rely on their own services, let me point out 2 examples:
Executive software diskeeper: it installs the Diskeeper service, that starts automatically. You can safely change it to manual if you only need to defrag your disk from time to time and manually. When you start the console, the service is automatically started and the job done.
VMWare Workstation 4/5: it installs 3 auto-starting services
"VMware Authorization Service"
"VMware DHCP Service"
"VMware NAT Service"
These can be put to manual and started with a script when you need VMWare. Just make a batch file and link it to the original icon: you free up several MB of memory and get a couple of seconds gain on startup.

If you want to experiment, you can try to stop all the services running: you’ll find that some don’t stop but the most do. A little script can be used to strip down your system on demand, freeing up memory and reducing the attack surface of your system.
You can also consider using hardware profiles, that we’ll discuss in another article or safe mode :)

Finally remember that you must move having a clear direction in your mind: if you need to maximize security (hardening) or if you need to optimize boot or memory consumption you’ll probably make different choices.

So I hope you learned that there is no magic mix of services, everyone has its own and obtaining it by experimenting could be a challenging and funny experience.

\|||/
O-O
(._.)