RIVET
Home / Process library
Windows process and service library
This library explains 108 common Windows processes and services: what each one does, whether it is safe to stop or disable, and what happens if you do. It is the same library RIVET shows next to each item in the app, written in plain English and checked against Microsoft's documentation.
Processes with their own page: dwm.exe, lsass.exe, mpdefendercoreservice.exe, msmpeng.exe, nissrv.exe, searchindexer.exe, spoolsv.exe, svchost.exe, winlogon.exe. Jump to: Usually safe to disable · Depends · Caution · Keep.
Before you disable anything: a service marked "usually safe to disable" is only safe if you don't use what it supports. Change one thing at a time, and keep a way back. RIVET records every service start-type change so it can be undone, even after a restart.
Usually safe to disable (14)
Usually safe to disable if you don't use the feature.
| Name | What it is | If you stop it |
|---|---|---|
| AJRouter | Routes messages for AllJoyn smart-home devices, now rarely used. | Rarely noticeable. |
| ALG | Supports plug-ins for the old Internet Connection Sharing. | Rarely noticeable. |
| AxInstSV | Controls installation of ActiveX controls from the web. | Rarely noticeable on a modern PC. |
| icssvc | Runs Windows' mobile hotspot. | Mobile hotspot is unavailable until it restarts. |
| lltdsvc | Draws the old Network Map. | Network Map is empty. |
| MapsBroker | Manages offline maps for the Maps app. | Offline maps stop working. |
| PcaSvc | Watches for old programs with known compatibility problems and offers fixes. | Compatibility suggestions stop appearing. |
| QWAVE | Improves audio and video streaming on home networks. | Rarely noticeable. |
| RemoteRegistry | Lets other PCs edit this PC's registry. It is off by default on Windows 10 and 11. | Nothing, on a home PC. |
| TrkWks | Keeps shortcuts working when their target files move between NTFS drives. | Some moved-file shortcuts break. |
| WalletService | Supports the Wallet feature used by some payment apps. | Wallet features are unavailable. |
| wisvc | Runs the Windows Insider Program. | Insider builds can't be managed. It does nothing on a PC that isn't in the program. |
| XblAuthManager | Signs you in to Xbox services for games. | Xbox sign-in in games stops until it restarts. Other apps aren't affected. |
| XblGameSave | Syncs game saves to the cloud. | Cloud saves stop syncing for Xbox-enabled games. |
Depends (28)
Depends on whether you use the feature it supports.
| Name | What it is | If you stop it |
|---|---|---|
| searchindexer.exe | Builds the index that makes Start and File Explorer search fast. It is busy after you add a lot of files. | Search still works, but slowly, and Outlook search can fail. |
| spoolsv.exe | Queues documents for printers, including PDF and OneNote virtual printers. | Nothing can print until it restarts. |
| bthserv | Discovers and pairs Bluetooth devices. | Bluetooth mice, headphones and keyboards stop working. |
| DiagTrack | Collects Windows diagnostic data and sends it to Microsoft. | Less diagnostic data is sent. Windows keeps working; some Insider and feedback features need it. |
| dmwappushservice | Receives device-management messages from an organisation. | Work PCs managed by Intune or other MDM stop receiving policy. |
| EFS | Encrypts individual files and folders on NTFS drives. | Files you encrypted with EFS can't be opened. |
| iphlpsvc | Provides IPv6 transition technologies and some network tunnelling. | Some VPNs and IPv6 connectivity break. |
| lfsvc | Tells apps where you are. | Maps, weather and Find my device lose your location. |
| lmhosts | Supports older NetBIOS name lookups on local networks. | Very old network devices and shares may not be found. |
| PhoneSvc | Manages calling features for VoIP and phone apps. | Some calling apps lose phone features. |
| PrintNotify | Shows printer pop-ups and extension apps. | Printer notifications stop. |
| seclogon | Runs programs as a different user (Run as different user). | Run as different user stops working. |
| SensorDataService | Delivers data from sensors to apps. | Apps lose sensor data. |
| SensorService | Manages sensors such as screen rotation and ambient light. | Auto-rotate and auto-brightness stop on laptops and tablets. |
| SensrSvc | Adjusts the PC based on its sensors, such as screen brightness. | Adaptive brightness stops. |
| SessionEnv | Sets up Remote Desktop sessions. | Remote Desktop into this PC fails. |
| SharedAccess | Shares this PC's connection with other devices, and is used by Miracast. | The mobile hotspot and Miracast projection stop working. |
| Spooler | Queues documents for printing. | Nothing can print, including to PDF. |
| SSDPSRV | Finds UPnP devices such as media servers and smart TVs on your network. | Network media devices stop appearing. |
| stisvc | Connects scanners and some cameras. | Scanners stop working. |
| SysMain | Preloads apps you use often into spare memory. | Apps may open a little slower. On old hard drives it can reduce disk thrashing. |
| TermService | Lets other PCs connect to this one with Remote Desktop. | Nobody can connect to this PC with Remote Desktop. |
| UmRdpService | Passes printers, drives and ports into Remote Desktop sessions. | Device redirection in Remote Desktop stops. |
| upnphost | Lets this PC act as a UPnP device on the network. | Media streaming from this PC to other devices stops. |
| WbioSrvc | Reads fingerprints and faces for Windows Hello. | Fingerprint and face sign-in stop working. |
| WiaRpc | Starts apps when a scanner or camera event happens. | Scanner buttons stop launching apps. |
| WinRM | Lets administrators manage this PC remotely. | Remote management tools can't reach this PC. Work PCs usually need it. |
| WSearch | Indexes files, email and settings so searches are fast. | Search still works, but slowly, and Outlook search can fail. |
Caution (15)
Usually best left on; stopping it can break something you use.
| Name | What it is | If you stop it |
|---|---|---|
| CDPSvc | Links your PC to your phone and other devices, including Nearby Sharing. | Phone Link, Nearby Sharing and some timeline features stop. |
| defragsvc | Runs scheduled defragmentation, and TRIM on SSDs. | Drive maintenance stops, which slowly hurts SSD and hard-drive performance. |
| DPS | Detects and troubleshoots common problems. | Troubleshooters and some network diagnostics stop working. |
| FontCache | Caches font data so apps start faster. | Apps start slightly slower. |
| FrameServer | Lets more than one app use the camera at once. | The camera can fail in video calls. |
| NcbService | Lets apps get network notifications while they run in the background. | Some Store apps stop syncing. |
| RmSvc | Runs Airplane mode and the radio toggles. | Airplane mode and radio switches stop working. |
| ShellHWDetection | Pops up AutoPlay when you plug in a drive or phone. | AutoPlay stops appearing. |
| swprv | Creates the shadow copies that restore points use. | Restore points can't be created. |
| VSS | Takes point-in-time copies of drives for restore points and backups. | Restore points and many backup tools fail. |
| W32Time | Keeps the clock in sync with an internet time server. | The clock drifts, which can break sign-ins and HTTPS. |
| WdiServiceHost | Runs diagnostics that need Local Service rights. | Some troubleshooters fail. |
| WdiSystemHost | Runs diagnostics that need System rights. | Some troubleshooters fail. |
| WerSvc | Collects crash reports so problems can be diagnosed. | Crash reports aren't collected, and Microsoft advises against disabling it. |
| WpnService | Delivers notifications to apps and the Action Center. | App notifications stop. |
Keep (51)
Keep it running. Windows needs it.
| Name | What it is | If you stop it |
|---|---|---|
| dwm.exe | Composes every window into the image you see on screen, including transparency and animations. | The screen flickers while Windows restarts it; it can't stay stopped. |
| lsass.exe | Checks sign-ins and enforces the PC's security policy. It holds credentials in memory, which is why it is a common target for attackers. | Windows forces a restart. |
| mpdefendercoreservice.exe | Supports Defender's antivirus engine and keeps it running. | Defender protection is weakened. |
| msmpeng.exe | Defender's scanning engine. It can use a lot of CPU during a scan, especially just after an update. | Real-time malware protection stops. Windows protects it from being stopped. |
| nissrv.exe | Defender's network protection, which inspects traffic for known exploits. | Network-level malware protection stops. |
| svchost.exe | A shell process that runs Windows services from DLLs. You normally see dozens of them, one per service or group. | Whatever service it hosts stops, which can take networking, audio or sign-in with it. |
| winlogon.exe | Creates the sign-in and lock screens, handles Ctrl+Alt+Del and signs you out. | Your session ends immediately. |
| Appinfo | Runs programs with administrator rights when you approve a UAC prompt. | Nothing can ask for administrator rights. |
| AppXSvc | Installs, updates and removes Store apps, including RIVET. | Store apps can't install or update. |
| AudioEndpointBuilder | Finds speakers, headphones and microphones for the audio service. | Sound devices disappear. |
| Audiosrv | Plays all sound on the PC. | No sound until it restarts. Microsoft's server guidance allows this on servers, not on a desktop you use. |
| BFE | The engine underneath the firewall and IPsec. | The firewall and VPNs stop working. |
| BITS | Downloads files in the background using spare bandwidth. Windows Update and many apps rely on it. | Updates and app downloads stall. |
| BrokerInfrastructure | Decides which background tasks may run. | Background features across Windows fail. |
| CoreMessagingRegistrar | Passes messages between parts of the Windows shell. | The desktop becomes unusable. |
| CryptSvc | Checks the signatures on Windows files and updates, and manages trusted certificates. | Windows Update and signed installers fail. |
| DcomLaunch | Starts COM servers when programs need them. | Windows stops working. It can't be stopped. |
| Dhcp | Gets an IP address from your router. | Most networks stop working. |
| Dnscache | Looks up and caches website addresses. | Web browsing breaks. Windows protects it from being stopped. |
| EventLog | Records the event logs Windows and apps write to. | Diagnostics are lost and some services fail to start. |
| gpsvc | Applies policies set by the PC's owner or an organisation. | Windows protects it from being stopped. |
| KeyIso | Keeps private keys in a separate protected process. | Wi-Fi sign-in, certificates and some sign-in methods fail. |
| LanmanWorkstation | Connects to shared folders and printers on other PCs. | Network drives and shared printers stop working. |
| MpsSvc | The firewall that decides which programs may use the network. | The firewall stops filtering, and some apps refuse to install. |
| netprofm | Keeps the list of networks you've joined and their settings. | Network settings and status stop updating. |
| NgcCtnrSvc | Stores the keys behind Windows Hello. | PIN and Windows Hello sign-in fail. |
| NgcSvc | Handles Windows Hello PIN and biometric sign-in. | PIN and Windows Hello sign-in fail. |
| NlaSvc | Works out which network you're on and whether it has internet. | Apps think you're offline, and firewall profiles break. |
| nsi | Tells programs about network interfaces and routes. | Networking fails. |
| PlugPlay | Recognises hardware as it's connected and loads its drivers. | New devices aren't recognised. |
| Power | Manages power plans, sleep and battery reporting. | Power settings and sleep misbehave. |
| ProfSvc | Loads your user profile when you sign in. | Nobody can sign in. |
| RpcEptMapper | Tells programs where to reach RPC services. | Much of Windows stops working. |
| RpcSs | The messaging layer most Windows components use to talk to each other. | Windows stops working. It can't be stopped. |
| SamSs | Holds local account information and signals when security services are ready. | Sign-in and security features fail. |
| Schedule | Runs scheduled tasks, including RIVET's delayed startup entries. | Scheduled maintenance and delayed startups don't run. |
| StateRepository | The database behind Store apps and the Start menu. | Start and Store apps break. |
| SystemEventsBroker | Tells apps and scheduled tasks when system events happen. | Scheduled tasks and background apps stop firing. |
| TabletInputService | Runs the touch keyboard, pen input and emoji panel. | Touch keyboard, pen and emoji panel stop working. |
| Themes | Applies visual themes, including high-contrast accessibility themes. | Accessibility themes can't be set. |
| TimeBrokerSvc | Runs background work at the right time for apps and Task Scheduler. | Task Scheduler triggers stop working. |
| TrustedInstaller | Installs and removes Windows updates and optional features. | Updates can't install. |
| UserManager | Provides the runtime pieces that multi-user features need. | Start, notifications and sign-in features break. |
| UsoSvc | Schedules update scans, downloads and installs. | Windows Update stops working properly. |
| VaultSvc | Stores saved passwords for websites, apps and network drives. | Saved passwords stop working. |
| Wcmsvc | Chooses between Wi-Fi, Ethernet and mobile connections. | Automatic connection switching stops. |
| WdNisSvc | Inspects network traffic for known exploits on behalf of Defender. | Network-level protection stops. |
| WinDefend | The built-in antivirus service. | Real-time malware protection stops. |
| Winmgmt | Lets programs read system information and settings. RIVET itself uses it. | Many tools, including RIVET, lose system information. |
| wlidsvc | Signs you in to Windows and apps with a Microsoft account. | Microsoft account sign-in and the Store break. |
| wuauserv | Downloads and installs Windows updates. | Security updates stop arriving. |
Sources
- https://learn.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server
- https://learn.microsoft.com/en-us/windows/application-management/svchost-service-refactoring
- https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows
- https://learn.microsoft.com/en-us/windows/win32/secauthn/winlogon
- https://learn.microsoft.com/en-us/windows/win32/dwm/dwm-overview
- https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
Questions
Which Windows services are safe to disable?
Only ones for features you don't use, such as Xbox services on a PC you don't game on, or Remote Registry. The table above marks them "usually safe to disable". Services marked Keep should stay on.
How can I tell if a process is genuine?
Check where it runs from and who signed it. A genuine Windows process runs from a Windows folder such as System32 and is signed by Microsoft Windows. The same name running from another folder is worth a closer look.
Where does this information come from?
From RIVET's built-in library, written in RIVET's own words and checked against Microsoft Learn documentation, listed under Sources.