HOME COMPUTER AND NETWORK SECURITY

Disabling unnecessary and potentially dangerous services

Windows XP comes with Terminal Services, IIS, and RAS that can open holes into your operating system. It's often convenient to enable Terminal Services to allow remote control functions for the help desk or administering servers, but you have to make sure it's configured correctly. There are also several malicious programs that can run quietly as services without anyone knowing. Be aware of all the services that all run on your servers and audit them periodically.

Below is a list of the common services found on Windows XP, though don't be surprised if the vast majority are not present on your system. This is an almost complete list from Microsoft. Please read this and keep the running services to only those that you need. A useful tip is that instead of disabling something you are unsure of, set it to manual. When you restart your machine if that service has started then it is probably required by one of your components or software products. If it is still OFF then consider disabling it for greater protection.

Here are a list of the services that you "may" see when in the Windows XP services control panel, along with our recommendation for use in a home environment - please note, that we do specify a HOME environment. These settings may not be appropriate for work-based workstations, though in all likelihood the majority of the recommendations apply there too.

Alerter - Notifies selected users and computers of administrative alerts. If this service is turned off, applications that use the NetAlertRaise or NetAlertRaiseEx APIs will be unable to notify a user or computer (by a Message Box from the Messenger service) that the administrative alert took place.
Recommendation: Disabled.

Application Layer Gateway Service - Provides support for 3rd party plug-ins for Internet Connection Sharing/Internet Connection Firewall. Required if using Internet Connection Sharing/Internet Connection Firewall to connect to the Internet.
Recommendation: Automatic if using ICS, Disabled if not.

Application Management - Used for Assign, Publish and Remove software services. If you cannot modify your software installation of certain applications, put this service in to Automatic or Manual.
Recommendation: Disabled

Automatic Updates - Used to check up to see if there are any critical or otherwise updates available for download. It is very important that if you decide to disable this service, you check the Windows Update site often to ensure the latest patches are installed. Manual (and Automatic) update via Windows Update web site requires Cryptographic Services to be running.
Recommends: Automatic if you do not wish to use Windows Update manually.

Background Intelligent Transfer Service - Used to transfer asynchronous data via http1.1 servers. According to Microsoft's site, Windows Update uses this "feature." It "continues" a download if you log off or shutdown the system (that is, when you log back in.) Manual update via Windows Update web site requires Cryptographic Services to be running.
Recommendation: Disabled

ClipBook - Enables the Clipbook Viewer to create and share "pages" of data to be viewed by remote computers.
Recommendation: Disabled

COM+ Event System - Provides automatic distribution of events to subscribing (Component Object Model) COM components.
Recommendation: Disabled

COM+ System Application - as above
Recommendation: Disabled

Computer Browser - Maintains an up-to-date list of computers on your network, and supplies the list to programs that request it. The Computer Browser service is used by Windows-based computers that need to view network domains and resources. Not required unless you attach to a network of Windows computers.
Recommendation: Disabled

Cryptographic Services - Confirms signatures of Windows files. You may always get a dialog box complaining about uncertified drivers if this is disabled. Required for Windows Update to function in manual and automatic mode. Windows Media Player may also require this service to function.
Recommendation: Automatic

DHCP Client - Dynamic Host Configuration Protocol Client manages network configuration by registering and updating IP addresses and Domain Name Server (DNS) names. If you are only dialing up to ISP via modem, cable, etc. If you have a network card in your PC and attach out via a router or sharing device then this may be required. Set to manual if unsure then check on reboot if it has started. If not then disable.
Recommendation: Automatic if required. Disabled if not.

Distributed Link Tracking Client - Maintains links between the NTFS file system files within a computer or across computers in a network domain.
Recommendation: Disabled

Distributed Transaction Coordinator - Coordinates transactions that are distributed across multiple computer systems and/or resource managers, such as databases, message queues, file systems, or other transaction-protected resource managers.
Recommendation: Disabled

DNS Client - Resolves and caches (Domain Name Server) DNS names. The DNS client service must be running on every computer that will perform DNS name resolution.
Recommendation: Disabled

Error Reporting Service - Calls home to Microsoft when errors occur. Spyware?
Recommendation: Disabled

Event Log - Logs event messages issued by programs and Windows. Event Log reports contain information that can be useful in diagnosing problems.
Recommends: Automatic

Fax Service - Enables you to send and receive faxes. Disabling this service will render the computer unable to send or receive faxes. Not used by most people.
Recommendation: Leave not installed or Disabled

Telephony - Provides Telephony API (TAPI) support for programs that control telephony devices and IP-based voice connections on the local computer and through the LAN on servers that are also running the service. If you never use a dial-up modem on a PC but connect via a router then disable.
Recommendation: Automatic (if using Dial-Up Networking/Faxing/ or PC Phone Services) Disabled otherwise

FTP Publishing Service - Not available on Windows XP Home. Not installed by default on Windows XP Pro, provides (file transfer protocol) FTP connectivity and administration through the Internet Information Service (IIS) snap-in. Big security risk!
Recommendation: Leave not installed or Disabled

Help and Support - Required for Microsoft's online help documents.
Recommendation: Disabled.

Human Interface Device Access - If all your devices function then disable it. Seems new with no devices for it as yet.
Recommendation: Disabled.

IIS Admin - Not available on Windows XP Home. Not installed by default on Windows XP Pro, allows administration of Internet Information Services (IIS). If this service is not running, you will not be able to run Web, FTP, NNTP, or SMTP sites, or configure IIS. See also World Wide Web Publishing Service. Not usually required unless you are running a local web server. If you are, be sure that if no external access is required that you firewall protect port 80 to only local traffic! Do not run a public web server unless you are 100% sure of the implications - use an ISP server.
Recommendations: Leave not installed or Disabled unless you understand the implications.

IMAPI CD-Burning COM Service - Used for the "drag and drop" CD burn capability. You will need this service to burn CD's. If you still cannot burn a CD with it on Manual, switch to Automatic and feel safe that it will only be used when "needed."
Recommendation: Disabled if you do not burn CD's otherwise set to Manual or Automatic.

Indexing Service - Indexes contents and properties of files on local and remote computers and provides rapid access to files through a flexible querying language.
Recommendation: Disabled

Internet Connection Firewall and Internet Connection Sharing - Provides network address translation (NAT), addressing and name resolution services for all computers on your home or small-office network through a dial-up or broadband connection. Not required unless you are sharing a dial-up connection with other PC's on your network - not recommended! Far better to use a router or gateway firewall software for this purpose. Consider using a higher specification firewall like Kerio Winroute if sharing your connection.
Recommendation: Automatic if sharing connection, Disabled if not required.

IPSEC Services - Manages IP security (IPsec) policy, starts the Internet Key Exchange (IKE) and coordinates IPsec policy settings with the IP security driver. Only leave on if you are using IPSec. Opens Port 500.
Recommendation: Disabled

Logical Disk Manager - Watches Plug and Play events for new drives to be detected and passes volume and/or disk information to the Logical Disk Manager Administrative Service to be configured. If disabled, the Disk Management snap-in display will not change when disks are added or removed. Turn it on only if you add additional disks and then disable again.
Recommendation: Disabled

Logical Disk Manager Administrative Service - as above
Recommendation: Disabled

Message Queuing - A messaging infrastructure and development tool for creating distributed messaging applications for Windows. Not available on Windows XP Home. Not installed by default on Windows XP Pro. Most home users will never need this service.
Recommendation: Leave not installed or Disabled

Message Queuing Triggers - Not available on Windows XP Home. Not installed by default on Windows XP Pro. Required only if you use Message Queuing service.
Recommendation: Leave not installed or Disabled

Messenger - Sends and receives messages to or from users and computers, or those transmitted by administrators or by the Alerter service. Nothing to do with MSN Messenger
Recommendation: Disabled

MS Software Shadow Copy Provider - Used in conjunction with the Volume Shadow Copy Service. Microsoft Backup uses these services so you will need it if you use that. You will receive Event Log entry complaining about not having this service running if Disabled.
Recommendation: Disabled

NetMeeting Remote Desktop Sharing - Allows authorized users to remotely access your Windows desktop from another PC over a corporate intranet by using Microsoft NetMeeting®. Very dangerous - allows remote access to your PC. Only use if absolutely essential and if running effective firewall.
Recommendation: Disabled

Network Connections - Manages objects in the Network and Dial-Up Connections folder, in which you can view both network and remote connections.
Recommendation: Automatic.

Network DDE - Useless service unless you use remote ClipBook.
Recommendation: Disabled

Network DDE DSDM - as above
Recommendation: Disabled

Network Location Awareness (NLA) - Required for use with the Internet Connection Sharing Service (server only.)
Recommendation: Disabled unless running ICS/ICF, not required for using an ICS sharer.

NT LM Security Support Provider - Enables users to log on to the network using the NTLM authentication protocol. If this service is stopped, users will be unable to log on to the domain and access services. NTLM is used mostly by Windows versions prior to Windows 2000.
Recommendation: Disabled

Performance Logs and Alerts - Configures performance logs and alerts.
Recommendation: Disabled

Plug and Play - Enables a computer to recognize and adapt to hardware changes with little or no user input.
Recommendation: Automatic

Portable Media Serial Number - Retrieves serial numbers from portable music players connected to your computer.
Recommendation: Disabled

Print Spooler - Queues and manages print jobs locally and remotely. If you don't have a printer attached then disable.
Recommendation: Automatic if needed, Disabled otherwise.

Protected Storage - Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services processes or users.
Recommendation: Disabled

QoS RSVP - Provides network signaling and local, traffic-control, set-up functionality for (Quality of Service) QoS-aware programs and control applets.
Recommendation: Disabled

Remote Access Auto Connection Manager - Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Disabling the service has no effect on the rest of the operating system. You will have to set up connections to remote computers manually. Whilst this process is convenient, unauthorized applications (such as Trojans) could bring up your network connection without your explicit request. Far better to manually dial.
Recommendation: Disabled.

Remote Access Connection Manager - Creates a network connection.
Recommendation: Automatic if using Dial-Up Networking, Disabled otherwise.

Remote Desktop Help Session Manager - Manages and controls Remote Assistance. Could create a MAJOR security hole so disable it unless absolutely necessary.
Recommendation: Disabled

Remote Procedure Call (RPC) - Provides the endpoint mapper and other miscellaneous RPC services. Absolutely essential.
Recommendation: Automatic.

Remote Procedure Call (RPC) Locator - Manages the RPC name service database. Useless service
Recommendation: Disabled

Remote Registry Service - Not available on Windows XP Home. Allows remote registry manipulation. This service lets users connect to a remote registry and read and/or write keys to it, providing they have the required permissions. Hacker could use this to attack other PC's.
Recommendation: Disabled

Removable Storage - Manages removable media drives and libraries. This service maintains a catalogue of identifying information for removable media used by a system, including tapes, CDs, and so on.
Recommendation: Disabled

RIP Listener - Not installed by default.
Recommendation: Leave not installed or Disabled

Routing and Remote Access - Offers routing services in local area and wide area network environments. Shouldn't be required on a home PC.
Recommendation: Leave not installed or Disabled

Secondary Logon - Allows you to run specific tools and programs with different permissions than your current logon provides.
Recommendation: Disabled

Security Accounts Manager - Start-up of this service signals other services that the Security Accounts Manager subsystem is ready to accept requests.
Recommendation: Disabled unless needed.

Server - Provides RPC support and file print and named pipe sharing over the network. The Server service allows the sharing of your local resources (such as disks and printers) so that other users on the network can access them. You should carefully consider the full implications of enabling this!
Recommendation: Disabled unless absolutely needed. Better still REMOVED.

Shell Hardware Detection - Used for the auto play of devices like memory cards, some CD drives, etc. Set to Automatic if you are experiencing problems with laptop docking stations.
Recommendation: Disabled unless required.

Simple Mail Transport Protocol (SMTP) - Not available on Windows XP Home. Not installed by default on Windows XP Pro. Transports e-mail across the network.
If you are using the built-in mail server for receiving mail then leave on automatic. If not, as would be usual in a home environment, then disable.
Recommendation: Leave not installed or Disabled

Simple TCP/IP Services - Not installed by default, implements support for a number of IP protocols.
Recommendation : Leave not installed or Disabled

Smart Card - Manages and controls access to a smart card inserted into a smart card reader attached to the computer. If not using a smart card reader then disable.
Recommendation: Disabled

Smart Card Helper - Provides support for earlier smart card readers attached to the computer. As above.
Recommendation: Disabled

SNMP Service - Allows incoming (Simple Network Management Protocol) SNMP requests to be serviced by the local computer.
Recommendation: Leave not installed or Disabled

SNMP Trap Service - Receives trap messages generated by local or remote SNMP agents and forwards the messages to SNMP management programs running on the computer.
Recommendation: Leave not installed or Disabled

SSDP Discovery Service - Used to locate UPnP devices on your home network. Used in conjunction with Universal Plug and Play Device Host, it detects and configures UPnP devices on your home network. For security reasons Disable this service. Please read the section in the guide on UPnP. Please note that even the FBI recommends disabling and preferably uninstalling this!!
Recommendation: Disabled for security reasons, better still removed totally as per the Steve Gibson instructions in the UPnP section.

System Event Notification - Tracks system events such as Windows logon network and power events. Notifies COM+ Event System subscribers of these events. SENS is an AutoStarted service that depends on COM+ EventSystem service.
Recommendation: Disabled

System Restore Service - Creates system snap shots or restore points for returning to at a later time. Big resource overhead! Forget about it!
Recommendation: Disabled

Task Scheduler - Enables a program to run at a designated time. Can be very dangerous. If you must run scheduled tasks then consider disabling all users other than administrator from running tasks. Can create major security problems and allow a hacker to compromise your system by scheduling Trojans to run.
Recommends: Disabled unless absolutely required

TCP/IP NetBIOS Helper Service - Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution. Only required if you need to share files with others.
Recommendation: Disabled

TCP/IP Printer Server - Not installed by default, but if needed, you may install it later off of the WinXP CD. Used for setting up a local UNIX print server. If you do not need this function, leave it uninstalled.
Recommendation: Leave not installed or Disabled

Telephony - Provides Telephony API (TAPI) support for programs that control telephony devices and IP-based voice connections on the local computer and through the LAN on servers that are also running the service. If you never use a dial-up modem on a PC but connect via a router then disable.
Recommendation: Automatic (if using Dial-Up Networking/Faxing/ or PC Phone Services) Disabled otherwise

Telnet - Not available on Windows XP Home and for good reason!! Allows a remote user to log on to the system and run console programs by using the command line. Very dangerous.
Recommendation: Disabled, preferably uninstall

Terminal Services - Provides a multi-session environment that allows client devices to access a virtual Windows 2000 Professional desktop session and Windows-based programs running on the server. Big security risk!
Recommendation: Disabled, preferably uninstall

Themes - Used to display all those new XP themes and colors on your desktop. Lots of space needed.
Recommendation: Disabled

Uninterruptible Power Supply - Manages communications with a UPS connected to the computer by a serial port.
Recommendation: Disabled

Universal Plug and Play Device Host - Used in conjunction with SSDP Discovery Service, it detects and configures UPnP devices on your home network. For security reasons Disable this service immediately. Please read the section in the guide on UPnP. Please note that even the FBI recommends disabling and preferably deinstalling this!!
Recommendation: Disabled for security reasons, better still removed totally as per the Steve Gibson instructions in the UPnP section.

Upload Manager - As with BITS, this service manages file transfers between clients and servers on the network. This service is NOT required for basic File and Print sharing.
Recommendation: Disabled

Volume Shadow Copy - Used in conjunction with the MS Software Shadow Copy Provider Service. Microsoft Backup uses these services.
Recommendation: Disabled

WebClient - Disable this for security reasons.
Recommendation: Disabled

Windows Audio - This service is Required if you wish to hear any audio at all. If your computer does not have a sound card, Disable this service.
Recommendation: Automatic unless you do not have a sound card, then set it to Disabled.

Windows Image Acquisition (WIA) - Used for some scanners and cameras. If, after Disabling this service, your scanner or camera fails to function properly, enable this service.
Recommendation: Disabled

Windows Installer - Installs, repairs, or removes software according to instructions contained in .MSI files provided with the applications
Recommendation: Manual

Windows Management Instrumentation - Provides system management information. WMI is an infrastructure for building management applications and instrumentation shipped as an integral part of the current generation of Microsoft operating systems.
Recommendation: Automatic

Windows Management Instrumentation Driver Extension - Not available on Windows XP Home. Tracks of all of the drivers that have registered WMI information to publish.
Recommendation: Manual

Windows Time - Sets the computer clock. W32Time maintains date and time synchronization on all computers running on a Microsoft Windows network. NTP can be dangerous. Not worth the risk.
Recommendation: Disabled

Wireless Zero Configuration - Automatic configuration for wireless network devices. If you do not have any wireless network devices in use, Disable this service.
Recommendation: Disabled

WMI Performance Adapter
Recommendation: Disabled

Workstation - provides network connections and communications. If this service is turned off, no network connections can be made to remote computers using Microsoft Networks. Use if you require drive-mapping connections to other Windows PC's.
Recommendation : Disabled, Automatic if required

World Wide Web Publishing Service - Not available on Windows XP Home. Provides HTTP services for applications on the Windows platform. Required if you are running a web server, but consider firewalling such a local web server so it is not visible to the world. Use an ISP web server for greatest security. Most common entry point for hackers!
Recommendation : Leave not installed or Disabled

As you can see from the above, not very much is actually needed to keep your Windows XP installation functioning in a home environment. All the enabled services just pose an enormous security risk, bring little or no benefit, consume resources and can be safely turned off.

Reprinted with permission form Security Focus.